Add basic sanity integration tests
Check that udica can create policy for both podman and docker containers. Check that generated policy can be loaded. Check that generated policy provides required access.
This commit is contained in:
Jan Zarsky
parent
94598a163f
commit
0037a4e5ec
65
tests/docker/runtest.sh
Executable file
65
tests/docker/runtest.sh
Executable file
@ -0,0 +1,65 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Description: Compare udica output between podman and docker
|
||||||
|
# Author: Jan Zarsky <jzarsky@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2019 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="udica"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm "udica"
|
||||||
|
rlAssertRpm "policycoreutils"
|
||||||
|
rlAssertRpm "podman"
|
||||||
|
rlAssertRpm "docker"
|
||||||
|
rlRun "rlServiceStart docker"
|
||||||
|
OUTPUT_FILE=$(mktemp)
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
for BACKEND in podman docker ; do
|
||||||
|
rlRun "$BACKEND run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||||
|
rlRun "$BACKEND ps | grep test"
|
||||||
|
CONT_ID=$($BACKEND ps | grep test | cut -d ' ' -f 1)
|
||||||
|
rlRun "udica -i $CONT_ID my_container"
|
||||||
|
rlRun "mv my_container.cil my_cont_$BACKEND.cil"
|
||||||
|
rlRun "$BACKEND stop test"
|
||||||
|
rlRun "$BACKEND rm test"
|
||||||
|
done
|
||||||
|
|
||||||
|
rlRun "sed -i '/capability/d' my_cont_podman.cil"
|
||||||
|
rlRun "diff -b -B my_cont_podman.cil my_cont_docker.cil"
|
||||||
|
|
||||||
|
rlRun "rm my_cont_podman.cil my_cont_docker.cil"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "rm -f $OUTPUT_FILE"
|
||||||
|
rlRun "rlServiceRestore docker"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
127
tests/sanity/runtest.sh
Executable file
127
tests/sanity/runtest.sh
Executable file
@ -0,0 +1,127 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Description: Test basic functionality of udica
|
||||||
|
# Author: Jan Zarsky <jzarsky@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2019 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="udica"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm "udica"
|
||||||
|
rlAssertRpm "policycoreutils"
|
||||||
|
rlAssertRpm "podman"
|
||||||
|
OUTPUT_FILE=$(mktemp)
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
rlRun "udica --help"
|
||||||
|
rlRun "PAGER=cat man udica"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "Test basic scenario"
|
||||||
|
rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||||
|
rlRun "podman ps | grep test"
|
||||||
|
rlRun "ps -efZ | grep bash"
|
||||||
|
rlRun "ps -efZ | grep bash | grep container_t"
|
||||||
|
|
||||||
|
rlRun "podman exec test ls /home" 1,2
|
||||||
|
rlRun "podman exec test touch /var/spool/test" 1
|
||||||
|
rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3
|
||||||
|
|
||||||
|
CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
|
||||||
|
rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE"
|
||||||
|
rlRun "podman stop test"
|
||||||
|
rlRun "podman rm test"
|
||||||
|
|
||||||
|
rlRun "cat $OUTPUT_FILE"
|
||||||
|
rlAssertExists "my_container.cil"
|
||||||
|
SEMODULE=$(cat $OUTPUT_FILE | grep "semodule -i" | cut -d '#' -f 2)
|
||||||
|
rlRun "$SEMODULE"
|
||||||
|
|
||||||
|
PODMAN_OPT=$(cat $OUTPUT_FILE | grep "security-opt" | cut -d '"' -f 2)
|
||||||
|
rlRun "podman run -dit --name test2 $PODMAN_OPT -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||||
|
rlRun "podman ps | grep test2"
|
||||||
|
rlRun "ps -efZ | grep bash"
|
||||||
|
rlRun "ps -efZ | grep bash | grep my_container.process"
|
||||||
|
|
||||||
|
rlRun "podman exec test2 ls /home" 0
|
||||||
|
rlRun "podman exec test2 touch /var/spool/test" 0
|
||||||
|
rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 1" 3
|
||||||
|
|
||||||
|
rlRun "podman stop test2"
|
||||||
|
rlRun "podman rm test2"
|
||||||
|
|
||||||
|
rlRun "semodule -r my_container base_container net_container home_container"
|
||||||
|
rlRun "rm my_container.cil"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "Compare different ways of obtaining policy"
|
||||||
|
rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||||
|
rlRun "podman ps | grep test"
|
||||||
|
|
||||||
|
CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
|
||||||
|
rlRun "podman inspect $CONT_ID | udica my_container >pipe.result"
|
||||||
|
|
||||||
|
rlRun "podman inspect $CONT_ID >container.json"
|
||||||
|
rlRun "udica -j container.json my_container >json.result"
|
||||||
|
|
||||||
|
rlRun "udica -i $CONT_ID my_container >id.result"
|
||||||
|
|
||||||
|
rlRun "diff pipe.result json.result"
|
||||||
|
rlRun "diff pipe.result id.result"
|
||||||
|
|
||||||
|
rlRun "rm -f pipe.result json.result id.result container.json"
|
||||||
|
rlRun "podman stop test"
|
||||||
|
rlRun "podman rm test"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "Test loading modules"
|
||||||
|
rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||||
|
rlRun "podman ps | grep test"
|
||||||
|
|
||||||
|
CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
|
||||||
|
rlRun "podman inspect $CONT_ID | udica -l my_container"
|
||||||
|
|
||||||
|
rlRun "podman stop test"
|
||||||
|
rlRun "podman rm test"
|
||||||
|
|
||||||
|
rlRun "semodule -l >$OUTPUT_FILE"
|
||||||
|
rlAssertGrep "my_container" $OUTPUT_FILE
|
||||||
|
rlAssertGrep "base_container" $OUTPUT_FILE
|
||||||
|
rlAssertGrep "net_container" $OUTPUT_FILE
|
||||||
|
rlAssertGrep "home_container" $OUTPUT_FILE
|
||||||
|
|
||||||
|
rlRun "semodule -r my_container base_container net_container home_container"
|
||||||
|
rlRun "rm my_container.cil"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "rm -f $OUTPUT_FILE"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
Loading…
Reference in New Issue
Block a user