felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(aa-log): add support dbus session log using journactl.

Browse source
This commit is contained in:
Alexandre Pujol 2022-08-19 19:05:46 +01:00
parent a2fa2421cb
commit c0356e92e5
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 212 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

131
cmd/aa-log/main_test.go
View file

@ -93,6 +93,40 @@ func TestAppArmorEvents(t *testing.T) {
},
},
},
{
name: "dbus system",
event: `type=USER_AVC msg=audit(1111111111.111:1111): pid=1780 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call" bus="system" path="/org/freedesktop/PolicyKit1/Authority" interface="org.freedesktop.PolicyKit1.Authority" member="CheckAuthorization" mask="send" name="org.freedesktop.PolicyKit1" pid=1794 label="snapd" peer_pid=1790 peer_label="polkitd" exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=?'UID="messagebus" AUID="unset" SAUID="messagebus"`,
want: AppArmorLogs{
{
"apparmor": "ALLOWED",
"profile": "",
"label": "snapd",
"operation": "dbus_method_call",
"name": "org.freedesktop.PolicyKit1",
"mask": "send",
"bus": "system",
"path": "/org/freedesktop/PolicyKit1/Authority",
"interface": "org.freedesktop.PolicyKit1.Authority",
"member": "CheckAuthorization",
"peer_label": "polkitd",
},
},
},
{
name: "dbus session",
event: `apparmor="ALLOWED" operation="dbus_bind" bus="session" name="org.freedesktop.portal.Documents" mask="bind" pid=2174 label="xdg-document-portal"`,
want: AppArmorLogs{
{
"apparmor": "ALLOWED",
"profile": "",
"label": "xdg-document-portal",
"operation": "dbus_bind",
"name": "org.freedesktop.portal.Documents",
"mask": "bind",
"bus": "session",
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
@ -153,6 +187,25 @@ func TestNewApparmorLogs(t *testing.T) {
path: "../../tests/audit.log",
want: refMan,
},
{
name: "power-profiles-daemon",
path: "../../tests/audit.log",
want: AppArmorLogs{
{
"apparmor": "ALLOWED",
"profile": "",
"label": "power-profiles-daemon",
"operation": "dbus_method_call",
"name": "org.freedesktop.DBus",
"mask": "send",
"bus": "system",
"path": "/org/freedesktop/DBus",
"interface": "org.freedesktop.DBus",
"member": "AddMatch",
"peer_label": "dbus-daemon",
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
@ -164,6 +217,51 @@ func TestNewApparmorLogs(t *testing.T) {
}
}
func Test_getJournalctlDbusSessionLogs(t *testing.T) {
tests := []struct {
name string
path string
useFile bool
want AppArmorLogs
}{
{
name: "gsd-xsettings",
useFile: true,
path: "../../tests/systemd.log",
want: AppArmorLogs{
{
"apparmor": "ALLOWED",
"profile": "",
"label": "gsd-xsettings",
"operation": "dbus_method_call",
"name": ":1.88",
"mask": "receive",
"bus": "session",
"path": "/org/gtk/Settings",
"interface": "org.freedesktop.DBus.Properties",
"member": "GetAll",
"peer_label": "gnome-extension-ding",
},
},
},
{
name: "journalctl",
useFile: false,
path: "",
want: AppArmorLogs{},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
file, _ := os.Open(tt.path)
reader, _ := getJournalctlDbusSessionLogs(file, tt.useFile)
if got := NewApparmorLogs(reader, tt.name); !reflect.DeepEqual(got, tt.want) {
t.Errorf("NewApparmorLogs() = %v, want %v", got, tt.want)
}
})
}
}
func TestAppArmorLogs_String(t *testing.T) {
tests := []struct {
name string
@ -180,6 +278,25 @@ func TestAppArmorLogs_String(t *testing.T) {
aaLogs: refMan,
want: "\033[1;32mALLOWED\033[0m \033[34mman\033[0m \033[33mexec\033[0m \033[35m/usr/bin/preconv\033[0m info=\"no new privs\" comm=man requested_mask=\033[1;31mx\033[0m denied_mask=\033[1;31mx\033[0m error=-1\n",
},
{
name: "power-profiles-daemon",
aaLogs: AppArmorLogs{
{
"apparmor": "ALLOWED",
"profile": "",
"label": "power-profiles-daemon",
"operation": "dbus_method_call",
"name": "org.freedesktop.DBus",
"mask": "send",
"bus": "system",
"path": "/org/freedesktop/DBus",
"interface": "org.freedesktop.DBus",
"member": "AddMatch",
"peer_label": "dbus-daemon",
},
},
want: "\033[1;32mALLOWED\033[0m \033[34mpower-profiles-daemon\033[0m \033[33mdbus_method_call\033[0m \033[35morg.freedesktop.DBus\033[0m \033[1;31msend\033[0m \033[36mbus=system\033[0m path=\033[37m/org/freedesktop/DBus\033[0m interface=\033[37morg.freedesktop.DBus\033[0m member=\033[32mAddMatch\033[0m peer_label=dbus-daemon\n",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
@ -195,24 +312,34 @@ func Test_app(t *testing.T) {
name string
path string
profile string
dbus bool
wantErr bool
}{
{
name: "OK",
name: "Test audit.log",
path: "../../tests/audit.log",
profile: "",
dbus: false,
wantErr: false,
},
{
name: "Test Dbus Session",
path: "../../tests/systemd.log",
profile: "",
dbus: true,
wantErr: false,
},
{
name: "No logfile",
path: "../../tests/log",
profile: "",
dbus: false,
wantErr: true,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if err := aaLog(tt.path, tt.profile); (err != nil) != tt.wantErr {
if err := aaLog(tt.path, tt.profile, tt.dbus); (err != nil) != tt.wantErr {
t.Errorf("aaLog() error = %v, wantErr %v", err, tt.wantErr)
}
})