From b00a063e976fe2f97a3297b769310fc70ca4f699 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Wed, 21 Nov 2012 12:54:34 -0500 Subject: Apply MMAC changes from master. Change-Id: I01f2a9084dfe7886087b1497070b0d7f2ad8477e --- .../coretests/apks/mmac_install_media/Android.mk | 10 + .../apks/mmac_install_media/AndroidManifest.xml | 27 ++ .../android/frameworks/coretests/DoNothing.java | 21 ++ .../apks/mmac_install_platform/AndroidManifest.xml | 3 + .../apks/mmac_install_platform_2/Android.mk | 10 + .../mmac_install_platform_2/AndroidManifest.xml | 27 ++ .../android/frameworks/coretests/DoNothing.java | 21 ++ .../coretests/res/raw/mac_permissions_default.xml | 13 - .../coretests/res/raw/mac_permissions_no_match.xml | 15 - .../res/raw/mac_permissions_package_name.xml | 17 - .../res/raw/mac_permissions_signature.xml | 28 -- core/tests/coretests/res/raw/mmac_default_all.xml | 15 + .../tests/coretests/res/raw/mmac_default_black.xml | 16 + .../coretests/res/raw/mmac_default_black_deny.xml | 16 + .../coretests/res/raw/mmac_default_inner_pkg.xml | 23 ++ .../res/raw/mmac_default_inner_pkg_deny.xml | 21 ++ .../res/raw/mmac_default_inner_pkg_out_empty.xml | 21 ++ .../coretests/res/raw/mmac_default_null_seinfo.xml | 14 + .../tests/coretests/res/raw/mmac_default_white.xml | 18 + .../coretests/res/raw/mmac_default_white_deny.xml | 15 + .../res/raw/mmac_diff_name_deny_outer.xml | 30 ++ .../res/raw/mmac_diff_name_skip_outer.xml | 28 ++ .../raw/mmac_inner_seinfo_null_outer_seinfo.xml | 28 ++ .../res/raw/mmac_inside_pkg_allow_all.xml | 30 ++ .../res/raw/mmac_inside_pkg_allow_black.xml | 31 ++ .../res/raw/mmac_inside_pkg_allow_null_seinfo.xml | 32 ++ .../res/raw/mmac_inside_pkg_allow_white.xml | 33 ++ .../res/raw/mmac_inside_pkg_deny_default.xml | 33 ++ .../res/raw/mmac_inside_pkg_deny_noother.xml | 30 ++ .../coretests/res/raw/mmac_inside_pkg_deny_pkg.xml | 30 ++ core/tests/coretests/res/raw/mmac_no_match.xml | 15 + .../res/raw/mmac_outer_no_rule_catch_inner.xml | 28 ++ core/tests/coretests/res/raw/mmac_pkg_all.xml | 20 ++ core/tests/coretests/res/raw/mmac_pkg_black.xml | 21 ++ .../coretests/res/raw/mmac_pkg_deny_black.xml | 21 ++ .../coretests/res/raw/mmac_pkg_deny_white.xml | 20 ++ .../coretests/res/raw/mmac_pkg_null_seinfo.xml | 22 ++ core/tests/coretests/res/raw/mmac_pkg_white.xml | 23 ++ .../coretests/res/raw/mmac_same_name_diff_cert.xml | 30 ++ core/tests/coretests/res/raw/mmac_sig_all.xml | 26 ++ core/tests/coretests/res/raw/mmac_sig_black.xml | 26 ++ .../res/raw/mmac_sig_deny_default_allow.xml | 21 ++ .../res/raw/mmac_sig_deny_default_deny.xml | 21 ++ .../coretests/res/raw/mmac_sig_deny_noother.xml | 16 + .../coretests/res/raw/mmac_sig_deny_pkg_allow.xml | 26 ++ .../coretests/res/raw/mmac_sig_deny_pkg_deny.xml | 26 ++ core/tests/coretests/res/raw/mmac_sig_null.xml | 25 ++ core/tests/coretests/res/raw/mmac_sig_white.xml | 29 ++ .../src/android/content/pm/SELinuxMMACTests.java | 365 +++++++++++++++++++-- 49 files changed, 1343 insertions(+), 94 deletions(-) create mode 100644 core/tests/coretests/apks/mmac_install_media/Android.mk create mode 100644 core/tests/coretests/apks/mmac_install_media/AndroidManifest.xml create mode 100644 core/tests/coretests/apks/mmac_install_media/src/com/android/frameworks/coretests/DoNothing.java create mode 100644 core/tests/coretests/apks/mmac_install_platform_2/Android.mk create mode 100644 core/tests/coretests/apks/mmac_install_platform_2/AndroidManifest.xml create mode 100644 core/tests/coretests/apks/mmac_install_platform_2/src/com/android/frameworks/coretests/DoNothing.java delete mode 100644 core/tests/coretests/res/raw/mac_permissions_default.xml delete mode 100644 core/tests/coretests/res/raw/mac_permissions_no_match.xml delete mode 100644 core/tests/coretests/res/raw/mac_permissions_package_name.xml delete mode 100644 core/tests/coretests/res/raw/mac_permissions_signature.xml create mode 100644 core/tests/coretests/res/raw/mmac_default_all.xml create mode 100644 core/tests/coretests/res/raw/mmac_default_black.xml create mode 100644 core/tests/coretests/res/raw/mmac_default_black_deny.xml create mode 100644 core/tests/coretests/res/raw/mmac_default_inner_pkg.xml create mode 100644 core/tests/coretests/res/raw/mmac_default_inner_pkg_deny.xml create mode 100644 core/tests/coretests/res/raw/mmac_default_inner_pkg_out_empty.xml create mode 100644 core/tests/coretests/res/raw/mmac_default_null_seinfo.xml create mode 100644 core/tests/coretests/res/raw/mmac_default_white.xml create mode 100644 core/tests/coretests/res/raw/mmac_default_white_deny.xml create mode 100644 core/tests/coretests/res/raw/mmac_diff_name_deny_outer.xml create mode 100644 core/tests/coretests/res/raw/mmac_diff_name_skip_outer.xml create mode 100644 core/tests/coretests/res/raw/mmac_inner_seinfo_null_outer_seinfo.xml create mode 100644 core/tests/coretests/res/raw/mmac_inside_pkg_allow_all.xml create mode 100644 core/tests/coretests/res/raw/mmac_inside_pkg_allow_black.xml create mode 100644 core/tests/coretests/res/raw/mmac_inside_pkg_allow_null_seinfo.xml create mode 100644 core/tests/coretests/res/raw/mmac_inside_pkg_allow_white.xml create mode 100644 core/tests/coretests/res/raw/mmac_inside_pkg_deny_default.xml create mode 100644 core/tests/coretests/res/raw/mmac_inside_pkg_deny_noother.xml create mode 100644 core/tests/coretests/res/raw/mmac_inside_pkg_deny_pkg.xml create mode 100644 core/tests/coretests/res/raw/mmac_no_match.xml create mode 100644 core/tests/coretests/res/raw/mmac_outer_no_rule_catch_inner.xml create mode 100644 core/tests/coretests/res/raw/mmac_pkg_all.xml create mode 100644 core/tests/coretests/res/raw/mmac_pkg_black.xml create mode 100644 core/tests/coretests/res/raw/mmac_pkg_deny_black.xml create mode 100644 core/tests/coretests/res/raw/mmac_pkg_deny_white.xml create mode 100644 core/tests/coretests/res/raw/mmac_pkg_null_seinfo.xml create mode 100644 core/tests/coretests/res/raw/mmac_pkg_white.xml create mode 100644 core/tests/coretests/res/raw/mmac_same_name_diff_cert.xml create mode 100644 core/tests/coretests/res/raw/mmac_sig_all.xml create mode 100644 core/tests/coretests/res/raw/mmac_sig_black.xml create mode 100644 core/tests/coretests/res/raw/mmac_sig_deny_default_allow.xml create mode 100644 core/tests/coretests/res/raw/mmac_sig_deny_default_deny.xml create mode 100644 core/tests/coretests/res/raw/mmac_sig_deny_noother.xml create mode 100644 core/tests/coretests/res/raw/mmac_sig_deny_pkg_allow.xml create mode 100644 core/tests/coretests/res/raw/mmac_sig_deny_pkg_deny.xml create mode 100644 core/tests/coretests/res/raw/mmac_sig_null.xml create mode 100644 core/tests/coretests/res/raw/mmac_sig_white.xml (limited to 'core/tests') diff --git a/core/tests/coretests/apks/mmac_install_media/Android.mk b/core/tests/coretests/apks/mmac_install_media/Android.mk new file mode 100644 index 0000000..615ea10 --- /dev/null +++ b/core/tests/coretests/apks/mmac_install_media/Android.mk @@ -0,0 +1,10 @@ +LOCAL_PATH:= $(call my-dir) +include $(CLEAR_VARS) + +LOCAL_PACKAGE_NAME := signed_media + +LOCAL_SRC_FILES := $(call all-subdir-java-files) + +LOCAL_CERTIFICATE := media + +include $(FrameworkCoreTests_BUILD_PACKAGE) diff --git a/core/tests/coretests/apks/mmac_install_media/AndroidManifest.xml b/core/tests/coretests/apks/mmac_install_media/AndroidManifest.xml new file mode 100644 index 0000000..8a16dfc --- /dev/null +++ b/core/tests/coretests/apks/mmac_install_media/AndroidManifest.xml @@ -0,0 +1,27 @@ + + + + + + + + + + + + diff --git a/core/tests/coretests/apks/mmac_install_media/src/com/android/frameworks/coretests/DoNothing.java b/core/tests/coretests/apks/mmac_install_media/src/com/android/frameworks/coretests/DoNothing.java new file mode 100644 index 0000000..51f8f19 --- /dev/null +++ b/core/tests/coretests/apks/mmac_install_media/src/com/android/frameworks/coretests/DoNothing.java @@ -0,0 +1,21 @@ +/* + * Copyright (C) 2012 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.android.frameworks.coretests; + +public class DoNothing { + +} \ No newline at end of file diff --git a/core/tests/coretests/apks/mmac_install_platform/AndroidManifest.xml b/core/tests/coretests/apks/mmac_install_platform/AndroidManifest.xml index fdb6894..6394823 100644 --- a/core/tests/coretests/apks/mmac_install_platform/AndroidManifest.xml +++ b/core/tests/coretests/apks/mmac_install_platform/AndroidManifest.xml @@ -17,6 +17,9 @@ xmlns:android="http://schemas.android.com/apk/res/android" package="com.android.frameworks.coretests.mmac_install_platform"> + + + diff --git a/core/tests/coretests/apks/mmac_install_platform_2/Android.mk b/core/tests/coretests/apks/mmac_install_platform_2/Android.mk new file mode 100644 index 0000000..4df2b84 --- /dev/null +++ b/core/tests/coretests/apks/mmac_install_platform_2/Android.mk @@ -0,0 +1,10 @@ +LOCAL_PATH:= $(call my-dir) +include $(CLEAR_VARS) + +LOCAL_PACKAGE_NAME := signed_platform_2 + +LOCAL_SRC_FILES := $(call all-subdir-java-files) + +LOCAL_CERTIFICATE := platform + +include $(FrameworkCoreTests_BUILD_PACKAGE) diff --git a/core/tests/coretests/apks/mmac_install_platform_2/AndroidManifest.xml b/core/tests/coretests/apks/mmac_install_platform_2/AndroidManifest.xml new file mode 100644 index 0000000..672ef84 --- /dev/null +++ b/core/tests/coretests/apks/mmac_install_platform_2/AndroidManifest.xml @@ -0,0 +1,27 @@ + + + + + + + + + + + + diff --git a/core/tests/coretests/apks/mmac_install_platform_2/src/com/android/frameworks/coretests/DoNothing.java b/core/tests/coretests/apks/mmac_install_platform_2/src/com/android/frameworks/coretests/DoNothing.java new file mode 100644 index 0000000..51f8f19 --- /dev/null +++ b/core/tests/coretests/apks/mmac_install_platform_2/src/com/android/frameworks/coretests/DoNothing.java @@ -0,0 +1,21 @@ +/* + * Copyright (C) 2012 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.android.frameworks.coretests; + +public class DoNothing { + +} \ No newline at end of file diff --git a/core/tests/coretests/res/raw/mac_permissions_default.xml b/core/tests/coretests/res/raw/mac_permissions_default.xml deleted file mode 100644 index 3e17a8d..0000000 --- a/core/tests/coretests/res/raw/mac_permissions_default.xml +++ /dev/null @@ -1,13 +0,0 @@ - - - - - - - - - - - - - diff --git a/core/tests/coretests/res/raw/mac_permissions_no_match.xml b/core/tests/coretests/res/raw/mac_permissions_no_match.xml deleted file mode 100644 index 4f8621a..0000000 --- a/core/tests/coretests/res/raw/mac_permissions_no_match.xml +++ /dev/null @@ -1,15 +0,0 @@ - - - - - - - - - - - - - - - diff --git a/core/tests/coretests/res/raw/mac_permissions_package_name.xml b/core/tests/coretests/res/raw/mac_permissions_package_name.xml deleted file mode 100644 index bdb081f..0000000 --- a/core/tests/coretests/res/raw/mac_permissions_package_name.xml +++ /dev/null @@ -1,17 +0,0 @@ - - - - - - - - - - - - - - - - - diff --git a/core/tests/coretests/res/raw/mac_permissions_signature.xml b/core/tests/coretests/res/raw/mac_permissions_signature.xml deleted file mode 100644 index 78050fb..0000000 --- a/core/tests/coretests/res/raw/mac_permissions_signature.xml +++ /dev/null @@ -1,28 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/core/tests/coretests/res/raw/mmac_default_all.xml b/core/tests/coretests/res/raw/mmac_default_all.xml new file mode 100644 index 0000000..63a2f12 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_default_all.xml @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_default_black.xml b/core/tests/coretests/res/raw/mmac_default_black.xml new file mode 100644 index 0000000..7d30351 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_default_black.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_default_black_deny.xml b/core/tests/coretests/res/raw/mmac_default_black_deny.xml new file mode 100644 index 0000000..ddd779c --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_default_black_deny.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_default_inner_pkg.xml b/core/tests/coretests/res/raw/mmac_default_inner_pkg.xml new file mode 100644 index 0000000..691e9f0 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_default_inner_pkg.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_default_inner_pkg_deny.xml b/core/tests/coretests/res/raw/mmac_default_inner_pkg_deny.xml new file mode 100644 index 0000000..5d872ab --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_default_inner_pkg_deny.xml @@ -0,0 +1,21 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_default_inner_pkg_out_empty.xml b/core/tests/coretests/res/raw/mmac_default_inner_pkg_out_empty.xml new file mode 100644 index 0000000..adbb4a2 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_default_inner_pkg_out_empty.xml @@ -0,0 +1,21 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_default_null_seinfo.xml b/core/tests/coretests/res/raw/mmac_default_null_seinfo.xml new file mode 100644 index 0000000..20d4a2c --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_default_null_seinfo.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_default_white.xml b/core/tests/coretests/res/raw/mmac_default_white.xml new file mode 100644 index 0000000..c7f6eab --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_default_white.xml @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_default_white_deny.xml b/core/tests/coretests/res/raw/mmac_default_white_deny.xml new file mode 100644 index 0000000..0c49ce8 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_default_white_deny.xml @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_diff_name_deny_outer.xml b/core/tests/coretests/res/raw/mmac_diff_name_deny_outer.xml new file mode 100644 index 0000000..d221d21 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_diff_name_deny_outer.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_diff_name_skip_outer.xml b/core/tests/coretests/res/raw/mmac_diff_name_skip_outer.xml new file mode 100644 index 0000000..4e961d7 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_diff_name_skip_outer.xml @@ -0,0 +1,28 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_inner_seinfo_null_outer_seinfo.xml b/core/tests/coretests/res/raw/mmac_inner_seinfo_null_outer_seinfo.xml new file mode 100644 index 0000000..78ff6bc --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_inner_seinfo_null_outer_seinfo.xml @@ -0,0 +1,28 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_inside_pkg_allow_all.xml b/core/tests/coretests/res/raw/mmac_inside_pkg_allow_all.xml new file mode 100644 index 0000000..75cb633 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_inside_pkg_allow_all.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_inside_pkg_allow_black.xml b/core/tests/coretests/res/raw/mmac_inside_pkg_allow_black.xml new file mode 100644 index 0000000..20491cf --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_inside_pkg_allow_black.xml @@ -0,0 +1,31 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_inside_pkg_allow_null_seinfo.xml b/core/tests/coretests/res/raw/mmac_inside_pkg_allow_null_seinfo.xml new file mode 100644 index 0000000..a2e6aa1 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_inside_pkg_allow_null_seinfo.xml @@ -0,0 +1,32 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_inside_pkg_allow_white.xml b/core/tests/coretests/res/raw/mmac_inside_pkg_allow_white.xml new file mode 100644 index 0000000..64d3132 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_inside_pkg_allow_white.xml @@ -0,0 +1,33 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_inside_pkg_deny_default.xml b/core/tests/coretests/res/raw/mmac_inside_pkg_deny_default.xml new file mode 100644 index 0000000..6d2e678 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_inside_pkg_deny_default.xml @@ -0,0 +1,33 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_inside_pkg_deny_noother.xml b/core/tests/coretests/res/raw/mmac_inside_pkg_deny_noother.xml new file mode 100644 index 0000000..53cf65c --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_inside_pkg_deny_noother.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_inside_pkg_deny_pkg.xml b/core/tests/coretests/res/raw/mmac_inside_pkg_deny_pkg.xml new file mode 100644 index 0000000..b444b33 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_inside_pkg_deny_pkg.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_no_match.xml b/core/tests/coretests/res/raw/mmac_no_match.xml new file mode 100644 index 0000000..4f8621a --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_no_match.xml @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_outer_no_rule_catch_inner.xml b/core/tests/coretests/res/raw/mmac_outer_no_rule_catch_inner.xml new file mode 100644 index 0000000..4e961d7 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_outer_no_rule_catch_inner.xml @@ -0,0 +1,28 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_pkg_all.xml b/core/tests/coretests/res/raw/mmac_pkg_all.xml new file mode 100644 index 0000000..fad1834 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_pkg_all.xml @@ -0,0 +1,20 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_pkg_black.xml b/core/tests/coretests/res/raw/mmac_pkg_black.xml new file mode 100644 index 0000000..e996c8e --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_pkg_black.xml @@ -0,0 +1,21 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_pkg_deny_black.xml b/core/tests/coretests/res/raw/mmac_pkg_deny_black.xml new file mode 100644 index 0000000..c1bd872 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_pkg_deny_black.xml @@ -0,0 +1,21 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_pkg_deny_white.xml b/core/tests/coretests/res/raw/mmac_pkg_deny_white.xml new file mode 100644 index 0000000..9dbf0e8 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_pkg_deny_white.xml @@ -0,0 +1,20 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_pkg_null_seinfo.xml b/core/tests/coretests/res/raw/mmac_pkg_null_seinfo.xml new file mode 100644 index 0000000..d763a66 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_pkg_null_seinfo.xml @@ -0,0 +1,22 @@ + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_pkg_white.xml b/core/tests/coretests/res/raw/mmac_pkg_white.xml new file mode 100644 index 0000000..4d785c4 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_pkg_white.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_same_name_diff_cert.xml b/core/tests/coretests/res/raw/mmac_same_name_diff_cert.xml new file mode 100644 index 0000000..d9bfb28 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_same_name_diff_cert.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_sig_all.xml b/core/tests/coretests/res/raw/mmac_sig_all.xml new file mode 100644 index 0000000..20b6278 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_sig_all.xml @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_sig_black.xml b/core/tests/coretests/res/raw/mmac_sig_black.xml new file mode 100644 index 0000000..525d25c --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_sig_black.xml @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_sig_deny_default_allow.xml b/core/tests/coretests/res/raw/mmac_sig_deny_default_allow.xml new file mode 100644 index 0000000..4f2b808 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_sig_deny_default_allow.xml @@ -0,0 +1,21 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_sig_deny_default_deny.xml b/core/tests/coretests/res/raw/mmac_sig_deny_default_deny.xml new file mode 100644 index 0000000..f2e9200 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_sig_deny_default_deny.xml @@ -0,0 +1,21 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_sig_deny_noother.xml b/core/tests/coretests/res/raw/mmac_sig_deny_noother.xml new file mode 100644 index 0000000..a82e9e6 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_sig_deny_noother.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_sig_deny_pkg_allow.xml b/core/tests/coretests/res/raw/mmac_sig_deny_pkg_allow.xml new file mode 100644 index 0000000..254b06c --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_sig_deny_pkg_allow.xml @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_sig_deny_pkg_deny.xml b/core/tests/coretests/res/raw/mmac_sig_deny_pkg_deny.xml new file mode 100644 index 0000000..cc55f61 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_sig_deny_pkg_deny.xml @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_sig_null.xml b/core/tests/coretests/res/raw/mmac_sig_null.xml new file mode 100644 index 0000000..89b9f86 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_sig_null.xml @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/res/raw/mmac_sig_white.xml b/core/tests/coretests/res/raw/mmac_sig_white.xml new file mode 100644 index 0000000..9ee7275 --- /dev/null +++ b/core/tests/coretests/res/raw/mmac_sig_white.xml @@ -0,0 +1,29 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/tests/coretests/src/android/content/pm/SELinuxMMACTests.java b/core/tests/coretests/src/android/content/pm/SELinuxMMACTests.java index f086113..b0a7979 100644 --- a/core/tests/coretests/src/android/content/pm/SELinuxMMACTests.java +++ b/core/tests/coretests/src/android/content/pm/SELinuxMMACTests.java @@ -110,11 +110,12 @@ public class SELinuxMMACTests extends AndroidTestCase { /** * Takes the policy xml file as a resource, the apk as a resource, - * and the expected seinfo string. + * the expected seinfo string, and the expected install value. * We mock a package install here by calling parsePackage. */ - void checkSeinfoWithPolicy(int policyRes, int apkRes, - String expectedSeinfo) { + void checkInstallMMAC(int policyRes, int apkRes, + String expectedSeinfo, + boolean expectedPassed) { // grab policy file Uri policyURI = getResourceURI(policyRes, MAC_INSTALL_TMP); assertNotNull(policyURI); @@ -128,8 +129,10 @@ public class SELinuxMMACTests extends AndroidTestCase { PackageParser.Package pkg = parsePackage(apkURI); assertNotNull(pkg); assertNotNull(pkg.packageName); + // check for correct passed policy value + boolean passed = SELinuxMMAC.passInstallPolicyChecks(pkg); + assertEquals(expectedPassed, passed); // check for correct seinfo label - SELinuxMMAC.assignSeinfoValue(pkg); String seinfo = pkg.applicationInfo.seinfo; if (seinfo == null) seinfo = "null"; @@ -144,7 +147,7 @@ public class SELinuxMMACTests extends AndroidTestCase { * Requested policy file doesn't exist. */ @LargeTest - public void testPOLICY_BADPATH() { + public void testINSTALL_POLICY_BADPATH() { boolean ret = SELinuxMMAC.readInstallPolicy(new File("/d/o/e/s/n/t/e/x/i/s/t")); assertFalse(ret); } @@ -153,44 +156,364 @@ public class SELinuxMMACTests extends AndroidTestCase { * Requested policy file is null object. */ @LargeTest - public void testPOLICY_NULL() { + public void testINSTALL_POLICY_NULL() { boolean ret = SELinuxMMAC.readInstallPolicy(null); assertFalse(ret); } /* - * Parse an apk that should be labeled with signature stanza. + * No need to test a valid install policy file. All the tests + * below test it implicitly. + */ + + /* + * Signature stanza hits. apk is installed from allow-all. + */ + @LargeTest + public void testSIGNATURE_ALLOWALL_INSTALLED() { + checkInstallMMAC(R.raw.mmac_sig_all, R.raw.signed_platform, + "platform", true); + } + + /* + * Signature stanza hits. apk is installed from whitelist. + */ + @LargeTest + public void testSIGNATURE_WHITELIST_INSTALLED() { + checkInstallMMAC(R.raw.mmac_sig_white, R.raw.signed_platform, + "platform", true); + } + + /* + * Signature stanza hits. apk is installed from blacklist. + */ + @LargeTest + public void testSIGNATURE_BLACKLIST_INSTALLED() { + checkInstallMMAC(R.raw.mmac_sig_black, R.raw.signed_platform, + "platform", true); + } + + /* + * Signature stanza hits. apk is installed. null seinfo tag. + */ + @LargeTest + public void testSIGNATURE_INSTALLED_NULL_SEINFO() { + checkInstallMMAC(R.raw.mmac_sig_null, R.raw.signed_platform, + "null", true); + } + + /* + * Signature stanza hits. apk is denied. + * Package stanza allows. + */ + @LargeTest + public void testSIGNATURE_DENIED_PACKAGE_ALLOWS() { + checkInstallMMAC(R.raw.mmac_sig_deny_pkg_allow, R.raw.signed_platform, + "package", true); + } + + /* + * Signature stanza hits. apk is denied. + * Package stanza then denys. + */ + @LargeTest + public void testSIGNATURE_DENIED_PACKAGE_DENY() { + checkInstallMMAC(R.raw.mmac_sig_deny_pkg_deny, R.raw.signed_platform, + "null", false); + } + + /* + * Signature stanza hits. apk is denied. + * Default stanza allows. + */ + @LargeTest + public void testSIGNATURE_DENIED_DEFAULT_ALLOWS() { + checkInstallMMAC(R.raw.mmac_sig_deny_default_allow, R.raw.signed_platform, + "default", true); + } + + /* + * Signature stanza hits yet denys. Default stanza hits and denys. + */ + @LargeTest + public void testSIGNATURE_DENY_DEFAULT_DENY() { + checkInstallMMAC(R.raw.mmac_sig_deny_default_deny, R.raw.signed_platform, + "null", false); + } + + /* + * Signature stanza hits. apk is denied. + * No other policy present. + */ + @LargeTest + public void testSIGNATURE_DENIED_NOOTHER_POLICY() { + checkInstallMMAC(R.raw.mmac_sig_deny_noother, R.raw.signed_platform, + "null", false); + } + + /* + * Package stanza hits. apk is installed from allow-all. + */ + @LargeTest + public void testPACKAGE_ALLOWALL_INSTALLED() { + checkInstallMMAC(R.raw.mmac_pkg_all, R.raw.signed_platform, + "package", true); + } + + /* + * Package stanza hits. apk is installed from whitelist. + */ + @LargeTest + public void testPACKAGE_WHITELIST_INSTALLED() { + checkInstallMMAC(R.raw.mmac_pkg_white, R.raw.signed_platform, + "package", true); + } + + /* + * Package stanza hits. apk is installed from blacklist. + */ + @LargeTest + public void testPACKAGE_BLACKLIST_INSTALLED() { + checkInstallMMAC(R.raw.mmac_pkg_black, R.raw.signed_platform, + "package", true); + } + + /* + * Package stanza hits. apk is installed. seinfo is null. */ @LargeTest - public void testSIGNATURE_LABEL() { - checkSeinfoWithPolicy(R.raw.mac_permissions_signature, R.raw.signed_platform, - "platform"); + public void testPACKAGE_INSTALLED_NULL_SEINFO() { + checkInstallMMAC(R.raw.mmac_pkg_null_seinfo, R.raw.signed_platform, + "null", true); } /* - * Parse an apk that should be labeled with default stanza. + * Package stanza hits. apk is denied on whitelist. */ @LargeTest - public void testDEFAULT_LABEL() { - checkSeinfoWithPolicy(R.raw.mac_permissions_default, R.raw.signed_platform, - "default"); + public void testPACKAGE_WHITELIST_DENIED() { + checkInstallMMAC(R.raw.mmac_pkg_deny_white, R.raw.signed_platform, + "null", false); } /* - * Parse an apk that should be labeled with package stanza. + * Package stanza hits. apk is denied on blacklist. */ @LargeTest - public void testPACKAGENAME_LABEL() { - checkSeinfoWithPolicy(R.raw.mac_permissions_package_name, R.raw.signed_platform, - "per-package"); + public void testPACKAGE_BLACKLIST_DENIED() { + checkInstallMMAC(R.raw.mmac_pkg_deny_black, R.raw.signed_platform, + "null", false); } /* - * Parse an apk that should not be labeled. No matching entry in policy. + * Default stanza hits. apk is installed from allowall. + */ + @LargeTest + public void testDEFAULT_ALLOWALL_INSTALLED() { + checkInstallMMAC(R.raw.mmac_default_all, R.raw.signed_platform, + "default", true); + } + + /* + * Default stanza hits. apk is installed from whitelist. + */ + @LargeTest + public void testDEFAULT_WHITELIST_INSTALLED() { + checkInstallMMAC(R.raw.mmac_default_white, R.raw.signed_platform, + "default", true); + } + + /* + * Default stanza hits. apk is installed from blacklist. + */ + @LargeTest + public void testDEFAULT_BLACKLIST_INSTALLED() { + checkInstallMMAC(R.raw.mmac_default_black, R.raw.signed_platform, + "default", true); + } + + /* + * Default stanza hits. apk installed. null seinfo. + */ + @LargeTest + public void testDEFAULT_INSTALLED_NULL_SEINFO() { + checkInstallMMAC(R.raw.mmac_default_null_seinfo, R.raw.signed_platform, + "null", true); + } + + /* + * Default stanza hits. apk is denied on whitelist. + */ + @LargeTest + public void testDEFAULT_WHITELIST_DENIED() { + checkInstallMMAC(R.raw.mmac_default_white_deny, R.raw.signed_platform, + "null", false); + } + + /* + * Default stanza hits. apk is denied on blacklist. + */ + @LargeTest + public void testDEFAULT_BLACKLIST_DENIED() { + checkInstallMMAC(R.raw.mmac_default_black_deny, R.raw.signed_platform, + "null", false); + } + + /* + * No matching entry in policy. */ @LargeTest public void testNO_MATCHING_POLICY() { - checkSeinfoWithPolicy(R.raw.mac_permissions_no_match, R.raw.signed_platform, - "null"); + checkInstallMMAC(R.raw.mmac_no_match, R.raw.signed_platform, + "null", false); + } + + /* + * Signature catches yet there is a package stanza inside that allows + * based on allow-all. + */ + @LargeTest + public void testPACKAGE_INSIDE_SIG_ALLOW_ALL() { + checkInstallMMAC(R.raw.mmac_inside_pkg_allow_all, R.raw.signed_platform, + "insidepackage", true); + } + + /* + * Signature catches yet there is a package stanza inside that allows + * based on whitelist. + */ + @LargeTest + public void testPACKAGE_INSIDE_SIG_ALLOW_WHITE() { + checkInstallMMAC(R.raw.mmac_inside_pkg_allow_white, R.raw.signed_platform, + "insidepackage", true); + } + + /* + * Signature catches yet there is a package stanza inside that allows + * based on blacklist. + */ + @LargeTest + public void testPACKAGE_INSIDE_SIG_ALLOW_BLACK() { + checkInstallMMAC(R.raw.mmac_inside_pkg_allow_black, R.raw.signed_platform, + "insidepackage", true); + } + + /* + * Signature catches yet there is a package stanza inside that denies + * based on blacklist. Stand alone package stanza then allows. + */ + @LargeTest + public void testPACKAGE_INSIDE_SIG_DENY_PKG_OUT_ALLOWS() { + checkInstallMMAC(R.raw.mmac_inside_pkg_deny_pkg, R.raw.signed_platform, + "package", true); + } + + /* + * Signature catches yet there is a package stanza inside that denies + * based on whitelist. default stanza catches and allows. + */ + @LargeTest + public void testPACKAGE_INSIDE_SIG_DENY_DEFAULT_ALLOWS() { + checkInstallMMAC(R.raw.mmac_inside_pkg_deny_default, R.raw.signed_platform, + "default", true); + } + + /* + * Signature catches yet there is a package stanza inside that denies. + * No other policy catches. app is denied. + */ + @LargeTest + public void testPACKAGE_INSIDE_SIG_DENY_NOOTHER() { + checkInstallMMAC(R.raw.mmac_inside_pkg_deny_noother, R.raw.signed_platform, + "null", false); + } + + /* + * Signature catches yet there is a package stanza inside that allows. + * However, the seingo tag is null. + */ + @LargeTest + public void testPACKAGE_INSIDE_SIG_ALLOWS_NULL_SEINFO() { + checkInstallMMAC(R.raw.mmac_inside_pkg_allow_null_seinfo, R.raw.signed_platform, + "null", true); + } + + /* + * Signature stanza has inner package stanza. Outer sig stanza + * has no rules. Check app signed with same key, diff pkg name, doesn't + * catch on outer signer stanza. Catches on default though. + */ + @LargeTest + public void testPACKAGE_SAME_CERT_DIFF_NAME_SKIPS_OUTER() { + checkInstallMMAC(R.raw.mmac_diff_name_skip_outer, R.raw.signed_platform_2, + "default", true); + } + + /* + * Signature stanza has inner package stanza. Outer sig stanza + * has no rules. Check app catches on inner. + */ + @LargeTest + public void testPACKAGE_INNER_HITS_NO_OUTER_RULES() { + checkInstallMMAC(R.raw.mmac_outer_no_rule_catch_inner, R.raw.signed_platform, + "insidepackage", true); + } + + /* + * Signature stanza has inner package stanza with no seinfo tag. + * Outer sig stanza has no rules but seinfo tag. Check app labeled null. + */ + @LargeTest + public void testPACKAGE_INSIDE_SIG_ALLOWS_NULL_SEINFO_OUTER_SEINFO_MISSED() { + checkInstallMMAC(R.raw.mmac_inner_seinfo_null_outer_seinfo, R.raw.signed_platform, + "null", true); + } + + /* + * Signature stanza has inner package stanza. Outer sig stanza + * has blacklist. Check app signed with same key, diff pkg name, + * denied on outer signer stanza. Catches on default though. + */ + @LargeTest + public void testPACKAGE_SAME_CERT_DIFF_NAME_DENIED_OUTER() { + checkInstallMMAC(R.raw.mmac_diff_name_deny_outer, R.raw.signed_platform_2, + "default", true); + } + + /* + * Signature stanza has inner package stanza. Check that app + * with same package name, diff key, catches on another cert. + */ + @LargeTest + public void testPACKAGE_DIFF_CERT_SAME_NAME() { + checkInstallMMAC(R.raw.mmac_same_name_diff_cert, R.raw.signed_media, + "media", true); + } + + /* + * Default stanza with inner package that hits. Outer not empty. + */ + @LargeTest + public void testPACKAGE_INNER_DEFAULT() { + checkInstallMMAC(R.raw.mmac_default_inner_pkg, R.raw.signed_media, + "insidedefault", true); + } + + /* + * Default stanza with inner package that hits. Outer empty. + */ + @LargeTest + public void testPACKAGE_INNER_DEFAULT_OUTER_EMPTY() { + checkInstallMMAC(R.raw.mmac_default_inner_pkg_out_empty, R.raw.signed_media, + "insidedefault", true); + } + + /* + * Default stanza with inner package that denies. + */ + @LargeTest + public void testPACKAGE_INNER_DEFAULT_DENY() { + checkInstallMMAC(R.raw.mmac_default_inner_pkg_deny, R.raw.signed_media, + "null", false); } } -- cgit v1.1