aboutsummaryrefslogtreecommitdiffstats
path: root/recipes-mac/smack/tcp-smack-test/test_smack_tcp_sockets.sh
blob: ed18f2371da714d6c1b3f4d8849af0958e5c2db3 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
#!/bin/sh
RC=0
test_file=/tmp/smack_socket_tcp
SMACK_PATH=`grep smack /proc/mounts | awk '{print $2}' `
# make sure no access is granted
#        12345678901234567890123456789012345678901234567890123456
echo -n "label1                  label2                  -----" > $SMACK_PATH/load

tcp_server=`which tcp_server`
if [ -z $tcp_server ]; then
	if [ -f "/tmp/tcp_server" ]; then
		tcp_server="/tmp/tcp_server"
	else
		echo "tcp_server binary not found"
		exit 1
	fi
fi
tcp_client=`which tcp_client`
if [ -z $tcp_client ]; then
	if [ -f "/tmp/tcp_client" ]; then
		tcp_client="/tmp/tcp_client"
	else
		echo "tcp_client binary not found"
		exit 1
	fi
fi

# checking access for sockets with different labels
$tcp_server 50016 label1 &>/dev/null &
server_pid=$!
sleep 2
$tcp_client 50016 label2 label1 &>/dev/null &
client_pid=$!

wait $server_pid
server_rv=$?
wait $client_pid
client_rv=$?

if [ $server_rv -eq 0 -o $client_rv -eq 0 ]; then
	echo "Sockets with different labels should not communicate on tcp"
	exit 1
fi

# granting access between different labels
#        12345678901234567890123456789012345678901234567890123456
echo -n "label1                  label2                  rw---" > $SMACK_PATH/load
# checking access for sockets with different labels, but having a rule granting rw
$tcp_server 50017 label1 2>$test_file &
server_pid=$!
sleep 1
$tcp_client 50017 label2 label1 2>$test_file &
client_pid=$!
wait $server_pid
server_rv=$?
wait $client_pid
client_rv=$?
if [ $server_rv -ne 0 -o $client_rv -ne 0 ]; then
	echo "Sockets with different labels, but having rw access, should communicate on tcp"
	exit 1
fi

# checking access for sockets with the same label
$tcp_server 50018 label1 2>$test_file &
server_pid=$!
sleep 1
$tcp_client 50018 label1 label1  2>$test_file &
client_pid=$!
wait $server_pid
server_rv=$?
wait $client_pid
client_rv=$?
if [ $server_rv -ne 0 -o $client_rv -ne 0 ]; then
	echo "Sockets with same labels should communicate on tcp"
	exit 1
fi

# checking access on socket labeled star (*)
# should always be permitted
$tcp_server 50019 \* 2>$test_file &
server_pid=$!
sleep 1
$tcp_client 50019 label1 label1 2>$test_file &
client_pid=$!
wait $server_pid
server_rv=$?
wait $client_pid
client_rv=$?
if [ $server_rv -ne 0 -o $client_rv -ne 0 ]; then
	echo "Should have access on tcp socket labeled star (*)"
	exit 1
fi

# checking access from socket labeled star (*)
# all access from subject star should be denied
$tcp_server 50020 label1 2>$test_file &
server_pid=$!
sleep 1
$tcp_client 50020 label1 \* 2>$test_file &
client_pid=$!
wait $server_pid
server_rv=$?
wait $client_pid
client_rv=$?
if [ $server_rv -eq 0 -o  $client_rv -eq 0 ]; then
	echo "Socket labeled star should not have access to any tcp socket"
	exit 1
fi