felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tests(check): add support for global exclusion.

Browse source
This commit is contained in:
Alexandre Pujol 2025-09-06 23:51:12 +02:00
parent e2f11d46b0
commit 618b1116f8
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
1 changed files with 34 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

42
tests/check.sh
View file

@ -15,6 +15,8 @@ APPARMORD=${CHECK_APPARMORD:-apparmor.d}
SBIN_LIST=${CHECK_SBIN_LIST:-tests/sbin.list} SBIN_LIST=${CHECK_SBIN_LIST:-tests/sbin.list}
declare WITH_CHECK declare WITH_CHECK
declare _check_is_disabled declare _check_is_disabled
declare _check_is_disabled_global
_FILE_IGNORE_ALL=false
readonly APPARMORD SBIN_LIST RES MAX_JOBS readonly APPARMORD SBIN_LIST RES MAX_JOBS
readonly reset="\033[0m" fgRed="\033[0;31m" fgYellow="\033[0;33m" fgWhite="\033[0;37m" BgWhite="\033[1;37m" readonly reset="\033[0m" fgRed="\033[0;31m" fgYellow="\033[0;33m" fgWhite="\033[0;37m" BgWhite="\033[1;37m"
_msg() { printf '%b%s%b\n' "$BgWhite" "$*" "$reset"; } _msg() { printf '%b%s%b\n' "$BgWhite" "$*" "$reset"; }
@ -44,6 +46,11 @@ _in_array() {
_is_enabled() { _is_enabled() {
local check="$1" local check="$1"
if _in_array "$check" "${WITH_CHECK[@]}"; then if _in_array "$check" "${WITH_CHECK[@]}"; then
if [[ -n "${_check_is_disabled_global+x}" && ${#_check_is_disabled_global[@]} -gt 0 ]]; then
if _in_array "$check" "${_check_is_disabled_global[@]}"; then
return 1
fi
fi
if [[ -z "${_check_is_disabled+x}" || ${#_check_is_disabled[@]} -eq 0 ]]; then if [[ -z "${_check_is_disabled+x}" || ${#_check_is_disabled[@]} -eq 0 ]]; then
return 0 return 0
fi fi
@ -70,10 +77,18 @@ _ignore_lint() {
local checks line="$1" local checks line="$1"
if [[ "$line" =~ ^[[:space:]]*$_IGNORE_LINT=.*$ ]]; then if [[ "$line" =~ ^[[:space:]]*$_IGNORE_LINT=.*$ ]]; then
# Start of an ignore block # Start of an ignore block (or file-wide if in header)
_IGNORE_LINT_BLOCK=true
checks="${line#*"$_IGNORE_LINT="}" checks="${line#*"$_IGNORE_LINT="}"
read -ra _check_is_disabled <<<"${checks//,/ }" read -ra _parsed <<<"${checks//,/ }"
if (( line_number <= 10 )); then
# Treat as file-wide ignore
_check_is_disabled_global=("${_parsed[@]}")
_FILE_IGNORE_ALL=true
_IGNORE_LINT_BLOCK=false
return 0
fi
_IGNORE_LINT_BLOCK=true
_check_is_disabled=("${_parsed[@]}")
elif [[ $_IGNORE_LINT_BLOCK == true && "$line" =~ ^[[:space:]]*$ ]]; then elif [[ $_IGNORE_LINT_BLOCK == true && "$line" =~ ^[[:space:]]*$ ]]; then
# New paragraph, end of block # New paragraph, end of block
@ -81,22 +96,33 @@ _ignore_lint() {
_check_is_disabled=() _check_is_disabled=()
elif [[ $_IGNORE_LINT_BLOCK == true ]]; then elif [[ $_IGNORE_LINT_BLOCK == true ]]; then
# Nothing to do, we are in a block # Nothing to do, we are in a block/paragraph
return 0 return 0
elif [[ "$line" == *"$_IGNORE_LINT="* ]]; then elif [[ "$line" == *"$_IGNORE_LINT="* ]]; then
# Inline ignore # Inline ignore (or file-wide if in header)
checks="${line#*"$_IGNORE_LINT="}" checks="${line#*"$_IGNORE_LINT="}"
read -ra _check_is_disabled <<<"${checks//,/ }" read -ra _parsed <<<"${checks//,/ }"
if (( line_number <= 10 )); then
_check_is_disabled_global=("${_parsed[@]}")
_FILE_IGNORE_ALL=true
return 0
fi
_check_is_disabled=("${_parsed[@]}")
else else
_check_is_disabled=() # Do not clear if file-wide ignore is set
if ! $_FILE_IGNORE_ALL; then
_check_is_disabled=()
fi
fi fi
} }
_check() { _check() {
local file="$1" local file="$1"
local line_number=0 line_number=0
_FILE_IGNORE_ALL=false
_check_is_disabled_global=()
while IFS= read -r line; do while IFS= read -r line; do
line_number=$((line_number + 1)) line_number=$((line_number + 1))