The kernel patches that implement AppArmor profile stacking made changes that allow the the backed for change_profile to detect if the target profile does not exist prior to checking if the current profile allows the change_profile.
Signed-off-by: Tyler Hicks <[email protected]> --- tests/regression/apparmor/changeprofile.sh | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/tests/regression/apparmor/changeprofile.sh b/tests/regression/apparmor/changeprofile.sh index dea28d6..04b4cf1 100755 --- a/tests/regression/apparmor/changeprofile.sh +++ b/tests/regression/apparmor/changeprofile.sh @@ -45,10 +45,17 @@ genprofile $file:$okperm runchecktest "NO CHANGEPROFILE (access parent file)" pass nochange $file runchecktest "NO CHANGEPROFILE (access sub file)" fail nochange $subfile -# CHANGEPROFILE NO Target TEST - NO PERMISSION +errno=EACCESS +if [ "$(kernel_features domain/stack)" == "true" ]; then + # The returned errno changed in the set of kernel patches that + # introduced AppArmor profile stacking + errno=ENOENT +fi + +# CHANGEPROFILE NO Target TEST - NO PERMISSION and target does not exist runchecktest "CHANGEPROFILE (no target, nochange)" pass nochange $file -runchecktest_errno EACCES "CHANGEPROFILE (no target, $file)" fail $othertest $file -runchecktest_errno EACCES "CHANGEPROFILE (no target, $subfile)" fail $othertest $subfile +runchecktest_errno $errno "CHANGEPROFILE (no target, $file)" fail $othertest $file +runchecktest_errno $errno "CHANGEPROFILE (no target, $subfile)" fail $othertest $subfile # CHANGEPROFILE NO Target TEST - PERMISSION genprofile $file:$okperm 'change_profile->':$othertest -- 2.7.0 -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
