From owner-p4-projects@FreeBSD.ORG Thu Nov 29 07:01:25 2007 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 398DC16A41B; Thu, 29 Nov 2007 07:01:25 +0000 (UTC) Delivered-To: perforce@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BEA0016A419 for ; Thu, 29 Nov 2007 07:01:24 +0000 (UTC) (envelope-from zhouzhouyi@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id C3EC113C45A for ; Thu, 29 Nov 2007 07:01:24 +0000 (UTC) (envelope-from zhouzhouyi@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id lAT71Ohb005519 for ; Thu, 29 Nov 2007 07:01:24 GMT (envelope-from zhouzhouyi@FreeBSD.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.14.1/8.14.1/Submit) id lAT71OCE005516 for perforce@freebsd.org; Thu, 29 Nov 2007 07:01:24 GMT (envelope-from zhouzhouyi@FreeBSD.org) Date: Thu, 29 Nov 2007 07:01:24 GMT Message-Id: <200711290701.lAT71OCE005516@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to zhouzhouyi@FreeBSD.org using -f From: Zhouyi ZHOU To: Perforce Change Reviews Cc: Subject: PERFORCE change 129759 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Nov 2007 07:01:25 -0000 http://perforce.freebsd.org/chv.cgi?CH=129759 Change 129759 by zhouzhouyi@zhouzhouyi_mactest on 2007/11/29 07:00:33 Mandatory access control test for proc schedule Affected files ... .. //depot/projects/soc2007/zhouzhouyi_mactest_soc/regression/mactest/tests/sched/00.t#2 edit Differences ... ==== //depot/projects/soc2007/zhouzhouyi_mactest_soc/regression/mactest/tests/sched/00.t#2 (text+ko) ==== @@ -1,60 +1,65 @@ #!/bin/sh -# $FreeBSD: src/tools/regression/mactest/tests/sched/00.t,v 1.1 2007/06/04 01:42:08 zhouzhouyi Exp $ +# $FreeBSD$ + +desc="test of proc schedule" -desc="checking the Mandatory Access Control Hooks for proc sched" dir=`dirname $0` . ${dir}/../misc.sh -echo "1..3" +case "${os}" in +FreeBSD) + + mac_mls_support=`sysctl -n security.mac.mls.enabled 2>/dev/null` + mac_biba_support=`sysctl -n security.mac.biba.enabled 2>/dev/null` + mac_test_support=`sysctl -n security.mac.test.pseudoinit 2>/dev/null` + + if [ "${mac_mls_support}" != "" ] && [ "${mac_biba_support}" != "" ] && + [ "${mac_test_support}" != "" ]; then #turn off all the switches -for i in `sysctl security.mac | grep "\.enabled"| - sed 's/\([a-z\.]*\.enabled\)\(:\ \)\([01]\)/\1/`; do -sysctl ${i}=0 -done + for i in `sysctl security.mac | grep "\.enabled"| + sed 's/\([a-z\.]*\.enabled\)\(:\ \)\([01]\)/\1/`; do + sysctl ${i}=0 >/dev/null + done -mac_mls_support=`sysctl -n security.mac.mls.enabled 2>/dev/null` -mac_biba_support=`sysctl -n security.mac.biba.enabled 2>/dev/null` -mac_test_support=`sysctl -n security.mac.test.pseudoinit 2>/dev/null` -if [ "${mac_mls_support}" != "" ] && [ "${mac_biba_support}" != "" ] && - [ "${mac_test_support}" != "" ] ; then - setpmac "mls/3,biba/4" ${macproc} -w 10 -f "${pid_file}" - getmacprocpid + if [ -f ${mactest_conf} ]; then + rm ${mactest_conf} + fi + touch ${mactest_conf} + setfmac "mls/equal,biba/equal" ${mactest_conf} + + echo "1..3" + setpmac "mls/3,biba/4" ${macproc} -w 10 -f "${pid_file}" + getmacprocpid - if [ -f ${mactest_conf} ]; then - rm ${mactest_conf} - fi - touch ${mactest_conf} + sysctl security.mac.mls.enabled=1 >/dev/null + sysctl security.mac.biba.enabled=1 > /dev/null -############################################################# - t=`sysctl security.mac.mls.enabled=1` - t=`sysctl security.mac.biba.enabled=1` - echo "enabling mac/mls!" - echo "enabling mac/biba!" - #case 1: can sched the proc when two labels are equal - mactestexpect "" "" -m "biba/4,mls/3" -f ${mactest_conf} system rtprio -t -${pid} + mactestexpect "" "" -m "biba/4,mls/3" -f ${mactest_conf} system rtprio -t -${pid} #case 2: if biba label is not equal, sched should not happen - mactestexpect "*rtprio:.Permission.denied" "" -m "biba/3,mls/3" -f ${mactest_conf} system rtprio -t -${pid} + mactestexpect "*rtprio:.Permission.denied" "" -m "biba/3,mls/3" -f ${mactest_conf} system rtprio -t -${pid} #case 3: if mls label is not equal, sched should not happen - echo -n "pid = -2 mac_test_check_proc_sched:" > ${mactest_conf} - echo "biba/4(low-high),mls/5(low-high) biba/4(low-high),mls/3(low-high)" >> ${mactest_conf} - mactestexpect "*rtprio:.Permission.denied" "" -m "biba/4,mls/5" -f ${mactest_conf} system rtprio -t -${pid} + echo -n "pid = -2 proc_check_sched:" > ${mactest_conf} + echo "biba/4(low-high),mls/5(low-high) biba/4(low-high),mls/3(low-high)" >> ${mactest_conf} + mactestexpect "*rtprio:.Permission.denied" "" -m "biba/4,mls/5" -f ${mactest_conf} system rtprio -t -${pid} - t=`sysctl security.mac.mls.enabled=0` - t=`sysctl security.mac.biba.enabled=0` - echo "disabling mac/mls!" - echo "disabling mac/biba!" - - rm ${mactest_conf} - rm ${pid_file} - -fi - +#cleanup: + sysctl security.mac.mls.enabled=0 >/dev/null + sysctl security.mac.biba.enabled=0 > /dev/null + rm ${mactest_conf} + rm ${pid_file} +#mac_mls mac_biba and mac_test support + fi + ;; +*) + quick_exit + ;; +esac