Merge ~georgiag/qa-regression-testing:abi-mqueue-test into qa-regression-testing:master

[Georgia Garcia]

[Alex Murray (alexmurray)]

LGTM - thanks Georgia (I've tested this against apparmor in Ubuntu for a few different releases).

review: Approve

[Alex Murray (alexmurray)]

Georgia does this need any further work? If not, can you please merge it?

[Georgia Garcia (georgiag)]

Sorry I didn't do it before, I thought I still didn't have permission. But it's done. Thank you!

diff --git a/scripts/test-apparmor.py b/scripts/test-apparmor.py
index 30b8097..1d10111 100755
--- a/scripts/test-apparmor.py
+++ b/scripts/test-apparmor.py
@@ -1798,6 +1798,82 @@ class ApparmorTestsuites(testlib.TestlibCase):
         if os.path.exists(topsrc) and os.path.exists(os.path.join(self.source, '.downloaded_source')):
             testlib.recursive_rm(topsrc)
 
+    def test_regression_mqueue_abi(self):
+        '''Test if abi is working properly'''
+
+        if not os.path.exists('/sys/kernel/security/apparmor/features/ipc/posix_mqueue'):
+            return self._skipped('mqueue feature not available for testing')
+
+        if not os.path.exists('/etc/apparmor.d/abi/2.13'):
+            return self._skipped('abi file not available for testing')
+
+        self._prepare_source()
+        if os.path.exists('./tests/regression/apparmor'):
+            os.chdir("./tests/regression/apparmor")
+        else:
+            return self._skipped('apparmor regression tests not available')
+
+        rc, report = testlib.cmd(['make'])
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEqual(expected, rc, result + report)
+
+        posix_mq_rcv = os.getcwd() + '/posix_mq_rcv'
+        posix_mq_snd = os.getcwd() + '/posix_mq_snd'
+
+        if not os.path.exists(posix_mq_rcv) or not os.path.exists(posix_mq_snd):
+            return self._skipped('mqueue tests not available')
+
+        contents = '''
+abi <kernel>,
+include <tunables/global>
+%s {
+  include <abstractions/base>
+  %s ux,
+}
+''' % (posix_mq_rcv, posix_mq_snd)
+
+        profile = os.path.join(self.tmpdir, 'profile')
+        testlib.create_fill(profile, contents, mode=0o644)
+
+        rc, report = testlib.cmd(['apparmor_parser', '-r', profile])
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEqual(expected, rc, result + report)
+
+        # execution should fail with permission denied
+        # abi is kernel, mqueue should be enforced
+        # policy does not contain mqueue rule
+        rc, report = testlib.cmd([posix_mq_rcv, '-c', posix_mq_snd])
+        expected = 1
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEqual(expected, rc, result + report)
+
+        contents = '''
+abi <abi/2.13>,
+include <tunables/global>
+%s {
+  include <abstractions/base>
+  %s ux,
+}
+''' % (posix_mq_rcv, posix_mq_snd)
+
+        profile = os.path.join(self.tmpdir, 'profile')
+        testlib.create_fill(profile, contents, mode=0o644)
+
+        rc, report = testlib.cmd(['apparmor_parser', '-r', profile])
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEqual(expected, rc, result + report)
+
+        # execution should be allowed
+        # abi is 2.13 - does not contain mqueue, mqueue should not be enforced
+        # policy does not contain mqueue rule
+        rc, report = testlib.cmd([posix_mq_rcv, '-c', posix_mq_snd])
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEqual(expected, rc, result + report)
+
     def test_regression_testsuite(self):
         '''Run kernel regression tests'''
         self._prepare_source()