blob: 22509c462728cbc45c09b75f6ab1587ccd4cadb6 [file] [log] [blame]
Janis Danisevskis78bd48c2020-07-21 12:27:13 -07001// Copyright 2020, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! This crate provides access control primitives for Keystore 2.0.
16//! It provides high level functions for checking permissions in the keystore2 and keystore2_key
17//! SELinux classes based on the keystore2_selinux backend.
18//! It also provides KeystorePerm and KeyPerm as convenience wrappers for the SELinux permission
19//! defined by keystore2 and keystore2_key respectively.
20
Janis Danisevskisa2f48502021-10-18 16:07:09 -070021use crate::error::Error as KsError;
Janis Danisevskisc5b210b2020-09-11 13:27:37 -070022use android_system_keystore2::aidl::android::system::keystore2::{
23 Domain::Domain, KeyDescriptor::KeyDescriptor, KeyPermission::KeyPermission,
24};
Janis Danisevskisa2f48502021-10-18 16:07:09 -070025use anyhow::Context as AnyhowContext;
26use keystore2_selinux as selinux;
27use lazy_static::lazy_static;
Janis Danisevskis56af0312021-10-18 16:11:41 -070028use selinux::{implement_class, Backend, ClassPermission};
Janis Danisevskis78bd48c2020-07-21 12:27:13 -070029use std::cmp::PartialEq;
30use std::convert::From;
Janis Danisevskis935e6c62020-08-18 12:52:27 -070031use std::ffi::CStr;
Janis Danisevskis78bd48c2020-07-21 12:27:13 -070032
Janis Danisevskis78bd48c2020-07-21 12:27:13 -070033// Replace getcon with a mock in the test situation
34#[cfg(not(test))]
35use selinux::getcon;
36#[cfg(test)]
37use tests::test_getcon as getcon;
38
Janis Danisevskis4ad056f2020-08-05 19:46:46 +000039lazy_static! {
40 // Panicking here is allowed because keystore cannot function without this backend
41 // and it would happen early and indicate a gross misconfiguration of the device.
42 static ref KEYSTORE2_KEY_LABEL_BACKEND: selinux::KeystoreKeyBackend =
43 selinux::KeystoreKeyBackend::new().unwrap();
44}
45
46fn lookup_keystore2_key_context(namespace: i64) -> anyhow::Result<selinux::Context> {
47 KEYSTORE2_KEY_LABEL_BACKEND.lookup(&namespace.to_string())
48}
49
Janis Danisevskis39d57e72021-10-19 16:56:20 -070050implement_class!(
Janis Danisevskis78bd48c2020-07-21 12:27:13 -070051 /// KeyPerm provides a convenient abstraction from the SELinux class `keystore2_key`.
52 /// At the same time it maps `KeyPermissions` from the Keystore 2.0 AIDL Grant interface to
Janis Danisevskis39d57e72021-10-19 16:56:20 -070053 /// the SELinux permissions.
54 #[repr(i32)]
55 #[selinux(class_name = keystore2_key)]
56 #[derive(Clone, Copy, Debug, PartialEq)]
57 pub enum KeyPerm {
58 /// Checked when convert_storage_key_to_ephemeral is called.
59 #[selinux(name = convert_storage_key_to_ephemeral)]
60 ConvertStorageKeyToEphemeral = KeyPermission::CONVERT_STORAGE_KEY_TO_EPHEMERAL.0,
61 /// Checked when the caller tries do delete a key.
62 #[selinux(name = delete)]
63 Delete = KeyPermission::DELETE.0,
64 /// Checked when the caller tries to use a unique id.
65 #[selinux(name = gen_unique_id)]
66 GenUniqueId = KeyPermission::GEN_UNIQUE_ID.0,
67 /// Checked when the caller tries to load a key.
68 #[selinux(name = get_info)]
69 GetInfo = KeyPermission::GET_INFO.0,
70 /// Checked when the caller attempts to grant a key to another uid.
71 /// Also used for gating key migration attempts.
72 #[selinux(name = grant)]
73 Grant = KeyPermission::GRANT.0,
74 /// Checked when the caller attempts to use Domain::BLOB.
75 #[selinux(name = manage_blob)]
76 ManageBlob = KeyPermission::MANAGE_BLOB.0,
77 /// Checked when the caller tries to create a key which implies rebinding
78 /// an alias to the new key.
79 #[selinux(name = rebind)]
80 Rebind = KeyPermission::REBIND.0,
81 /// Checked when the caller attempts to create a forced operation.
82 #[selinux(name = req_forced_op)]
83 ReqForcedOp = KeyPermission::REQ_FORCED_OP.0,
84 /// Checked when the caller attempts to update public key artifacts.
85 #[selinux(name = update)]
86 Update = KeyPermission::UPDATE.0,
87 /// Checked when the caller attempts to use a private or public key.
88 #[selinux(name = use)]
89 Use = KeyPermission::USE.0,
90 /// Checked when the caller attempts to use device ids for attestation.
91 #[selinux(name = use_dev_id)]
92 UseDevId = KeyPermission::USE_DEV_ID.0,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -070093 }
94);
95
Janis Danisevskis56af0312021-10-18 16:11:41 -070096implement_class!(
Janis Danisevskis78bd48c2020-07-21 12:27:13 -070097 /// KeystorePerm provides a convenient abstraction from the SELinux class `keystore2`.
98 /// Using the implement_permission macro we get the same features as `KeyPerm`.
Janis Danisevskis56af0312021-10-18 16:11:41 -070099 #[selinux(class_name = keystore2)]
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700100 #[derive(Clone, Copy, Debug, PartialEq)]
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700101 pub enum KeystorePerm {
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700102 /// Checked when a new auth token is installed.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700103 #[selinux(name = add_auth)]
104 AddAuth,
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700105 /// Checked when an app is uninstalled or wiped.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700106 #[selinux(name = clear_ns)]
107 ClearNs,
Hasini Gunasinghe9ee18412021-03-11 20:12:44 +0000108 /// Checked when the user state is queried from Keystore 2.0.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700109 #[selinux(name = get_state)]
110 GetState,
Janis Danisevskisee10b5f2020-09-22 16:42:35 -0700111 /// Checked when Keystore 2.0 is asked to list a namespace that the caller
112 /// does not have the get_info permission for.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700113 #[selinux(name = list)]
114 List,
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700115 /// Checked when Keystore 2.0 gets locked.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700116 #[selinux(name = lock)]
117 Lock,
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700118 /// Checked when Keystore 2.0 shall be reset.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700119 #[selinux(name = reset)]
120 Reset,
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700121 /// Checked when Keystore 2.0 shall be unlocked.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700122 #[selinux(name = unlock)]
123 Unlock,
Hasini Gunasinghe803c2d42021-01-27 00:48:40 +0000124 /// Checked when user is added or removed.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700125 #[selinux(name = change_user)]
126 ChangeUser,
Hasini Gunasinghe803c2d42021-01-27 00:48:40 +0000127 /// Checked when password of the user is changed.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700128 #[selinux(name = change_password)]
129 ChangePassword,
Hasini Gunasinghe803c2d42021-01-27 00:48:40 +0000130 /// Checked when a UID is cleared.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700131 #[selinux(name = clear_uid)]
132 ClearUID,
Hasini Gunasinghe5fc95252020-12-04 00:35:08 +0000133 /// Checked when Credstore calls IKeystoreAuthorization to obtain auth tokens.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700134 #[selinux(name = get_auth_token)]
135 GetAuthToken,
Satya Tangirala5b9e5b12021-03-09 12:54:21 -0800136 /// Checked when earlyBootEnded() is called.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700137 #[selinux(name = early_boot_ended)]
138 EarlyBootEnded,
Janis Danisevskis333b7c02021-03-23 18:57:41 -0700139 /// Checked when IKeystoreMaintenance::onDeviceOffBody is called.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700140 #[selinux(name = report_off_body)]
141 ReportOffBody,
142 /// Checked when IkeystoreMetrics::pullMetrics is called.
143 #[selinux(name = pull_metrics)]
144 PullMetrics,
Paul Crowley46c703e2021-08-06 15:13:53 -0700145 /// Checked when IKeystoreMaintenance::deleteAllKeys is called.
Janis Danisevskis751d2c82021-10-18 15:37:09 -0700146 #[selinux(name = delete_all_keys)]
147 DeleteAllKeys,
Seth Moore7ee79f92021-12-07 11:42:49 -0800148 /// Checked on calls to IRemotelyProvisionedKeyPool::getAttestationKey
149 #[selinux(name = get_attestation_key)]
150 GetAttestationKey,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700151 }
152);
153
154/// Represents a set of `KeyPerm` permissions.
155/// `IntoIterator` is implemented for this struct allowing the iteration through all the
156/// permissions in the set.
157/// It also implements a function `includes(self, other)` that checks if the permissions
158/// in `other` are included in `self`.
159///
160/// KeyPermSet can be created with the macro `key_perm_set![]`.
161///
162/// ## Example
163/// ```
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700164/// let perms1 = key_perm_set![KeyPerm::Use, KeyPerm::ManageBlob, KeyPerm::Grant];
165/// let perms2 = key_perm_set![KeyPerm::Use, KeyPerm::ManageBlob];
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700166///
167/// assert!(perms1.includes(perms2))
168/// assert!(!perms2.includes(perms1))
169///
170/// let i = perms1.into_iter();
171/// // iteration in ascending order of the permission's numeric representation.
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700172/// assert_eq(Some(KeyPerm::ManageBlob), i.next());
173/// assert_eq(Some(KeyPerm::Grant), i.next());
174/// assert_eq(Some(KeyPerm::Use), i.next());
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700175/// assert_eq(None, i.next());
176/// ```
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700177#[derive(Copy, Clone, Debug, Eq, PartialEq, Ord, PartialOrd)]
178pub struct KeyPermSet(pub i32);
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700179
180mod perm {
181 use super::*;
182
183 pub struct IntoIter {
184 vec: KeyPermSet,
185 pos: u8,
186 }
187
188 impl IntoIter {
189 pub fn new(v: KeyPermSet) -> Self {
190 Self { vec: v, pos: 0 }
191 }
192 }
193
194 impl std::iter::Iterator for IntoIter {
195 type Item = KeyPerm;
196
197 fn next(&mut self) -> Option<Self::Item> {
198 loop {
199 if self.pos == 32 {
200 return None;
201 }
202 let p = self.vec.0 & (1 << self.pos);
203 self.pos += 1;
204 if p != 0 {
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700205 return Some(KeyPerm::from(p));
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700206 }
207 }
208 }
209 }
210}
211
212impl From<KeyPerm> for KeyPermSet {
213 fn from(p: KeyPerm) -> Self {
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700214 Self(p as i32)
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700215 }
216}
217
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700218/// allow conversion from the AIDL wire type i32 to a permission set.
219impl From<i32> for KeyPermSet {
220 fn from(p: i32) -> Self {
221 Self(p)
222 }
223}
224
225impl From<KeyPermSet> for i32 {
226 fn from(p: KeyPermSet) -> i32 {
227 p.0
228 }
229}
230
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700231impl KeyPermSet {
232 /// Returns true iff this permission set has all of the permissions that are in `other`.
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700233 pub fn includes<T: Into<KeyPermSet>>(&self, other: T) -> bool {
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700234 let o: KeyPermSet = other.into();
235 (self.0 & o.0) == o.0
236 }
237}
238
239/// This macro can be used to create a `KeyPermSet` from a list of `KeyPerm` values.
240///
241/// ## Example
242/// ```
243/// let v = key_perm_set![Perm::delete(), Perm::manage_blob()];
244/// ```
245#[macro_export]
246macro_rules! key_perm_set {
247 () => { KeyPermSet(0) };
248 ($head:expr $(, $tail:expr)* $(,)?) => {
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700249 KeyPermSet($head as i32 $(| $tail as i32)*)
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700250 };
251}
252
253impl IntoIterator for KeyPermSet {
254 type Item = KeyPerm;
255 type IntoIter = perm::IntoIter;
256
257 fn into_iter(self) -> Self::IntoIter {
258 Self::IntoIter::new(self)
259 }
260}
261
Janis Danisevskis56af0312021-10-18 16:11:41 -0700262/// Uses `selinux::check_permission` to check if the given caller context `caller_cxt` may access
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700263/// the given permision `perm` of the `keystore2` security class.
Janis Danisevskis935e6c62020-08-18 12:52:27 -0700264pub fn check_keystore_permission(caller_ctx: &CStr, perm: KeystorePerm) -> anyhow::Result<()> {
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700265 let target_context = getcon().context("check_keystore_permission: getcon failed.")?;
Janis Danisevskis56af0312021-10-18 16:11:41 -0700266 selinux::check_permission(caller_ctx, &target_context, perm)
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700267}
268
Janis Danisevskis56af0312021-10-18 16:11:41 -0700269/// Uses `selinux::check_permission` to check if the given caller context `caller_cxt` has
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700270/// all the permissions indicated in `access_vec` for the target domain indicated by the key
271/// descriptor `key` in the security class `keystore2_key`.
272///
273/// Also checks if the caller has the grant permission for the given target domain.
274///
275/// Attempts to grant the grant permission are always denied.
276///
277/// The only viable target domains are
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700278/// * `Domain::APP` in which case u:r:keystore:s0 is used as target context and
279/// * `Domain::SELINUX` in which case the `key.nspace` parameter is looked up in
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700280/// SELinux keystore key backend, and the result is used
281/// as target context.
282pub fn check_grant_permission(
Janis Danisevskis935e6c62020-08-18 12:52:27 -0700283 caller_ctx: &CStr,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700284 access_vec: KeyPermSet,
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700285 key: &KeyDescriptor,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700286) -> anyhow::Result<()> {
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700287 let target_context = match key.domain {
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700288 Domain::APP => getcon().context("check_grant_permission: getcon failed.")?,
289 Domain::SELINUX => lookup_keystore2_key_context(key.nspace)
290 .context("check_grant_permission: Domain::SELINUX: Failed to lookup namespace.")?,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700291 _ => return Err(KsError::sys()).context(format!("Cannot grant {:?}.", key.domain)),
292 };
293
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700294 selinux::check_permission(caller_ctx, &target_context, KeyPerm::Grant)
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700295 .context("Grant permission is required when granting.")?;
296
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700297 if access_vec.includes(KeyPerm::Grant) {
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700298 return Err(selinux::Error::perm()).context("Grant permission cannot be granted.");
299 }
300
301 for p in access_vec.into_iter() {
Janis Danisevskis56af0312021-10-18 16:11:41 -0700302 selinux::check_permission(caller_ctx, &target_context, p).context(format!(
303 "check_grant_permission: check_permission failed. \
304 The caller may have tried to grant a permission that they don't possess. {:?}",
305 p
306 ))?
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700307 }
308 Ok(())
309}
310
Janis Danisevskis56af0312021-10-18 16:11:41 -0700311/// Uses `selinux::check_permission` to check if the given caller context `caller_cxt`
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700312/// has the permissions indicated by `perm` for the target domain indicated by the key
313/// descriptor `key` in the security class `keystore2_key`.
314///
315/// The behavior differs slightly depending on the selected target domain:
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700316/// * `Domain::APP` u:r:keystore:s0 is used as target context.
317/// * `Domain::SELINUX` `key.nspace` parameter is looked up in the SELinux keystore key
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700318/// backend, and the result is used as target context.
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700319/// * `Domain::BLOB` Same as SELinux but the "manage_blob" permission is always checked additionally
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700320/// to the one supplied in `perm`.
Janis Danisevskis56af0312021-10-18 16:11:41 -0700321/// * `Domain::GRANT` Does not use selinux::check_permission. Instead the `access_vector`
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700322/// parameter is queried for permission, which must be supplied in this case.
323///
324/// ## Return values.
325/// * Ok(()) If the requested permissions were granted.
326/// * Err(selinux::Error::perm()) If the requested permissions were denied.
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700327/// * Err(KsError::sys()) This error is produced if `Domain::GRANT` is selected but no `access_vec`
328/// was supplied. It is also produced if `Domain::KEY_ID` was selected, and
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700329/// on various unexpected backend failures.
330pub fn check_key_permission(
Janis Danisevskis45760022021-01-19 16:34:10 -0800331 caller_uid: u32,
Janis Danisevskis935e6c62020-08-18 12:52:27 -0700332 caller_ctx: &CStr,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700333 perm: KeyPerm,
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700334 key: &KeyDescriptor,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700335 access_vector: &Option<KeyPermSet>,
336) -> anyhow::Result<()> {
Janis Danisevskis45760022021-01-19 16:34:10 -0800337 // If an access vector was supplied, the key is either accessed by GRANT or by KEY_ID.
338 // In the former case, key.domain was set to GRANT and we check the failure cases
339 // further below. If the access is requested by KEY_ID, key.domain would have been
340 // resolved to APP or SELINUX depending on where the key actually resides.
341 // Either way we can return here immediately if the access vector covers the requested
342 // permission. If it does not, we can still check if the caller has access by means of
343 // ownership.
344 if let Some(access_vector) = access_vector {
345 if access_vector.includes(perm) {
346 return Ok(());
347 }
348 }
349
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700350 let target_context = match key.domain {
351 // apps get the default keystore context
Janis Danisevskis45760022021-01-19 16:34:10 -0800352 Domain::APP => {
353 if caller_uid as i64 != key.nspace {
354 return Err(selinux::Error::perm())
355 .context("Trying to access key without ownership.");
356 }
357 getcon().context("check_key_permission: getcon failed.")?
358 }
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700359 Domain::SELINUX => lookup_keystore2_key_context(key.nspace)
360 .context("check_key_permission: Domain::SELINUX: Failed to lookup namespace.")?,
361 Domain::GRANT => {
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700362 match access_vector {
Janis Danisevskis45760022021-01-19 16:34:10 -0800363 Some(_) => {
364 return Err(selinux::Error::perm())
Janis Danisevskis56af0312021-10-18 16:11:41 -0700365 .context(format!("\"{}\" not granted", perm.name()));
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700366 }
367 None => {
368 // If DOMAIN_GRANT was selected an access vector must be supplied.
369 return Err(KsError::sys()).context(
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700370 "Cannot check permission for Domain::GRANT without access vector.",
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700371 );
372 }
373 }
374 }
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700375 Domain::KEY_ID => {
376 // We should never be called with `Domain::KEY_ID. The database
377 // lookup should have converted this into one of `Domain::APP`
378 // or `Domain::SELINUX`.
379 return Err(KsError::sys()).context("Cannot check permission for Domain::KEY_ID.");
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700380 }
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700381 Domain::BLOB => {
382 let tctx = lookup_keystore2_key_context(key.nspace)
383 .context("Domain::BLOB: Failed to lookup namespace.")?;
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700384 // If DOMAIN_KEY_BLOB was specified, we check for the "manage_blob"
385 // permission in addition to the requested permission.
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700386 selinux::check_permission(caller_ctx, &tctx, KeyPerm::ManageBlob)?;
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700387
388 tctx
389 }
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700390 _ => {
391 return Err(KsError::sys())
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700392 .context(format!("Unknown domain value: \"{:?}\".", key.domain))
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700393 }
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700394 };
395
Janis Danisevskis56af0312021-10-18 16:11:41 -0700396 selinux::check_permission(caller_ctx, &target_context, perm)
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700397}
398
399#[cfg(test)]
400mod tests {
401 use super::*;
402 use anyhow::anyhow;
403 use anyhow::Result;
404 use keystore2_selinux::*;
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700405
406 const ALL_PERMS: KeyPermSet = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700407 KeyPerm::ManageBlob,
408 KeyPerm::Delete,
409 KeyPerm::UseDevId,
410 KeyPerm::ReqForcedOp,
411 KeyPerm::GenUniqueId,
412 KeyPerm::Grant,
413 KeyPerm::GetInfo,
414 KeyPerm::Rebind,
415 KeyPerm::Update,
416 KeyPerm::Use,
417 KeyPerm::ConvertStorageKeyToEphemeral,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700418 ];
419
Janis Danisevskisa31dd9e2021-01-30 00:13:17 -0800420 const SYSTEM_SERVER_PERMISSIONS_NO_GRANT: KeyPermSet = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700421 KeyPerm::Delete,
422 KeyPerm::UseDevId,
423 // No KeyPerm::Grant
424 KeyPerm::GetInfo,
425 KeyPerm::Rebind,
426 KeyPerm::Update,
427 KeyPerm::Use,
Janis Danisevskisa31dd9e2021-01-30 00:13:17 -0800428 ];
429
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700430 const NOT_GRANT_PERMS: KeyPermSet = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700431 KeyPerm::ManageBlob,
432 KeyPerm::Delete,
433 KeyPerm::UseDevId,
434 KeyPerm::ReqForcedOp,
435 KeyPerm::GenUniqueId,
436 // No KeyPerm::Grant
437 KeyPerm::GetInfo,
438 KeyPerm::Rebind,
439 KeyPerm::Update,
440 KeyPerm::Use,
441 KeyPerm::ConvertStorageKeyToEphemeral,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700442 ];
443
444 const UNPRIV_PERMS: KeyPermSet = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700445 KeyPerm::Delete,
446 KeyPerm::GetInfo,
447 KeyPerm::Rebind,
448 KeyPerm::Update,
449 KeyPerm::Use,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700450 ];
451
452 /// The su_key namespace as defined in su.te and keystore_key_contexts of the
453 /// SePolicy (system/sepolicy).
454 const SU_KEY_NAMESPACE: i32 = 0;
455 /// The shell_key namespace as defined in shell.te and keystore_key_contexts of the
456 /// SePolicy (system/sepolicy).
457 const SHELL_KEY_NAMESPACE: i32 = 1;
458
459 pub fn test_getcon() -> Result<Context> {
460 Context::new("u:object_r:keystore:s0")
461 }
462
463 // This macro evaluates the given expression and checks that
464 // a) evaluated to Result::Err() and that
465 // b) the wrapped error is selinux::Error::perm() (permission denied).
466 // We use a macro here because a function would mask which invocation caused the failure.
467 //
468 // TODO b/164121720 Replace this macro with a function when `track_caller` is available.
469 macro_rules! assert_perm_failed {
470 ($test_function:expr) => {
471 let result = $test_function;
472 assert!(result.is_err(), "Permission check should have failed.");
473 assert_eq!(
474 Some(&selinux::Error::perm()),
475 result.err().unwrap().root_cause().downcast_ref::<selinux::Error>()
476 );
477 };
478 }
479
480 fn check_context() -> Result<(selinux::Context, i32, bool)> {
481 // Calling the non mocked selinux::getcon here intended.
482 let context = selinux::getcon()?;
483 match context.to_str().unwrap() {
484 "u:r:su:s0" => Ok((context, SU_KEY_NAMESPACE, true)),
485 "u:r:shell:s0" => Ok((context, SHELL_KEY_NAMESPACE, false)),
486 c => Err(anyhow!(format!(
487 "This test must be run as \"su\" or \"shell\". Current context: \"{}\"",
488 c
489 ))),
490 }
491 }
492
493 #[test]
494 fn check_keystore_permission_test() -> Result<()> {
495 let system_server_ctx = Context::new("u:r:system_server:s0")?;
Janis Danisevskisa916d992021-10-19 15:46:09 -0700496 assert!(check_keystore_permission(&system_server_ctx, KeystorePerm::AddAuth).is_ok());
497 assert!(check_keystore_permission(&system_server_ctx, KeystorePerm::ClearNs).is_ok());
498 assert!(check_keystore_permission(&system_server_ctx, KeystorePerm::GetState).is_ok());
499 assert!(check_keystore_permission(&system_server_ctx, KeystorePerm::Lock).is_ok());
500 assert!(check_keystore_permission(&system_server_ctx, KeystorePerm::Reset).is_ok());
501 assert!(check_keystore_permission(&system_server_ctx, KeystorePerm::Unlock).is_ok());
502 assert!(check_keystore_permission(&system_server_ctx, KeystorePerm::ChangeUser).is_ok());
503 assert!(check_keystore_permission(&system_server_ctx, KeystorePerm::ChangePassword).is_ok());
504 assert!(check_keystore_permission(&system_server_ctx, KeystorePerm::ClearUID).is_ok());
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700505 let shell_ctx = Context::new("u:r:shell:s0")?;
Janis Danisevskisa916d992021-10-19 15:46:09 -0700506 assert_perm_failed!(check_keystore_permission(&shell_ctx, KeystorePerm::AddAuth));
507 assert_perm_failed!(check_keystore_permission(&shell_ctx, KeystorePerm::ClearNs));
508 assert!(check_keystore_permission(&shell_ctx, KeystorePerm::GetState).is_ok());
509 assert_perm_failed!(check_keystore_permission(&shell_ctx, KeystorePerm::List));
510 assert_perm_failed!(check_keystore_permission(&shell_ctx, KeystorePerm::Lock));
511 assert_perm_failed!(check_keystore_permission(&shell_ctx, KeystorePerm::Reset));
512 assert_perm_failed!(check_keystore_permission(&shell_ctx, KeystorePerm::Unlock));
513 assert_perm_failed!(check_keystore_permission(&shell_ctx, KeystorePerm::ChangeUser));
514 assert_perm_failed!(check_keystore_permission(&shell_ctx, KeystorePerm::ChangePassword));
515 assert_perm_failed!(check_keystore_permission(&shell_ctx, KeystorePerm::ClearUID));
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700516 Ok(())
517 }
518
519 #[test]
520 fn check_grant_permission_app() -> Result<()> {
521 let system_server_ctx = Context::new("u:r:system_server:s0")?;
522 let shell_ctx = Context::new("u:r:shell:s0")?;
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700523 let key = KeyDescriptor { domain: Domain::APP, nspace: 0, alias: None, blob: None };
Janis Danisevskisa31dd9e2021-01-30 00:13:17 -0800524 check_grant_permission(&system_server_ctx, SYSTEM_SERVER_PERMISSIONS_NO_GRANT, &key)
525 .expect("Grant permission check failed.");
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700526
Janis Danisevskisa31dd9e2021-01-30 00:13:17 -0800527 // attempts to grant the grant permission must always fail even when privileged.
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700528 assert_perm_failed!(check_grant_permission(
529 &system_server_ctx,
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700530 KeyPerm::Grant.into(),
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700531 &key
532 ));
533 // unprivileged grant attempts always fail. shell does not have the grant permission.
534 assert_perm_failed!(check_grant_permission(&shell_ctx, UNPRIV_PERMS, &key));
535 Ok(())
536 }
537
538 #[test]
539 fn check_grant_permission_selinux() -> Result<()> {
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700540 let (sctx, namespace, is_su) = check_context()?;
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700541 let key = KeyDescriptor {
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700542 domain: Domain::SELINUX,
543 nspace: namespace as i64,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700544 alias: None,
545 blob: None,
546 };
547 if is_su {
548 assert!(check_grant_permission(&sctx, NOT_GRANT_PERMS, &key).is_ok());
549 // attempts to grant the grant permission must always fail even when privileged.
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700550 assert_perm_failed!(check_grant_permission(&sctx, KeyPerm::Grant.into(), &key));
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700551 } else {
552 // unprivileged grant attempts always fail. shell does not have the grant permission.
553 assert_perm_failed!(check_grant_permission(&sctx, UNPRIV_PERMS, &key));
554 }
555 Ok(())
556 }
557
558 #[test]
559 fn check_key_permission_domain_grant() -> Result<()> {
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700560 let key = KeyDescriptor { domain: Domain::GRANT, nspace: 0, alias: None, blob: None };
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700561
562 assert_perm_failed!(check_key_permission(
Janis Danisevskis45760022021-01-19 16:34:10 -0800563 0,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700564 &selinux::Context::new("ignored").unwrap(),
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700565 KeyPerm::Grant,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700566 &key,
567 &Some(UNPRIV_PERMS)
568 ));
569
570 check_key_permission(
Janis Danisevskis45760022021-01-19 16:34:10 -0800571 0,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700572 &selinux::Context::new("ignored").unwrap(),
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700573 KeyPerm::Use,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700574 &key,
575 &Some(ALL_PERMS),
576 )
577 }
578
579 #[test]
580 fn check_key_permission_domain_app() -> Result<()> {
581 let system_server_ctx = Context::new("u:r:system_server:s0")?;
582 let shell_ctx = Context::new("u:r:shell:s0")?;
583 let gmscore_app = Context::new("u:r:gmscore_app:s0")?;
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700584
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700585 let key = KeyDescriptor { domain: Domain::APP, nspace: 0, alias: None, blob: None };
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700586
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700587 assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Use, &key, &None).is_ok());
588 assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Delete, &key, &None).is_ok());
589 assert!(check_key_permission(0, &system_server_ctx, KeyPerm::GetInfo, &key, &None).is_ok());
590 assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Rebind, &key, &None).is_ok());
591 assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Update, &key, &None).is_ok());
592 assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Grant, &key, &None).is_ok());
593 assert!(check_key_permission(0, &system_server_ctx, KeyPerm::UseDevId, &key, &None).is_ok());
594 assert!(check_key_permission(0, &gmscore_app, KeyPerm::GenUniqueId, &key, &None).is_ok());
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700595
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700596 assert!(check_key_permission(0, &shell_ctx, KeyPerm::Use, &key, &None).is_ok());
597 assert!(check_key_permission(0, &shell_ctx, KeyPerm::Delete, &key, &None).is_ok());
598 assert!(check_key_permission(0, &shell_ctx, KeyPerm::GetInfo, &key, &None).is_ok());
599 assert!(check_key_permission(0, &shell_ctx, KeyPerm::Rebind, &key, &None).is_ok());
600 assert!(check_key_permission(0, &shell_ctx, KeyPerm::Update, &key, &None).is_ok());
601 assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::Grant, &key, &None));
602 assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::ReqForcedOp, &key, &None));
603 assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::ManageBlob, &key, &None));
604 assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::UseDevId, &key, &None));
605 assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::GenUniqueId, &key, &None));
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700606
Janis Danisevskis45760022021-01-19 16:34:10 -0800607 // Also make sure that the permission fails if the caller is not the owner.
608 assert_perm_failed!(check_key_permission(
609 1, // the owner is 0
610 &system_server_ctx,
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700611 KeyPerm::Use,
Janis Danisevskis45760022021-01-19 16:34:10 -0800612 &key,
613 &None
614 ));
615 // Unless there was a grant.
616 assert!(check_key_permission(
617 1,
618 &system_server_ctx,
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700619 KeyPerm::Use,
Janis Danisevskis45760022021-01-19 16:34:10 -0800620 &key,
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700621 &Some(key_perm_set![KeyPerm::Use])
Janis Danisevskis45760022021-01-19 16:34:10 -0800622 )
623 .is_ok());
624 // But fail if the grant did not cover the requested permission.
625 assert_perm_failed!(check_key_permission(
626 1,
627 &system_server_ctx,
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700628 KeyPerm::Use,
Janis Danisevskis45760022021-01-19 16:34:10 -0800629 &key,
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700630 &Some(key_perm_set![KeyPerm::GetInfo])
Janis Danisevskis45760022021-01-19 16:34:10 -0800631 ));
632
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700633 Ok(())
634 }
635
636 #[test]
637 fn check_key_permission_domain_selinux() -> Result<()> {
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700638 let (sctx, namespace, is_su) = check_context()?;
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700639 let key = KeyDescriptor {
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700640 domain: Domain::SELINUX,
641 nspace: namespace as i64,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700642 alias: None,
643 blob: None,
644 };
645
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700646 assert!(check_key_permission(0, &sctx, KeyPerm::Use, &key, &None).is_ok());
647 assert!(check_key_permission(0, &sctx, KeyPerm::Delete, &key, &None).is_ok());
648 assert!(check_key_permission(0, &sctx, KeyPerm::GetInfo, &key, &None).is_ok());
649 assert!(check_key_permission(0, &sctx, KeyPerm::Rebind, &key, &None).is_ok());
650 assert!(check_key_permission(0, &sctx, KeyPerm::Update, &key, &None).is_ok());
Chris Wailes3877f292021-07-26 19:24:18 -0700651
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700652 if is_su {
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700653 assert!(check_key_permission(0, &sctx, KeyPerm::Grant, &key, &None).is_ok());
654 assert!(check_key_permission(0, &sctx, KeyPerm::ManageBlob, &key, &None).is_ok());
655 assert!(check_key_permission(0, &sctx, KeyPerm::UseDevId, &key, &None).is_ok());
656 assert!(check_key_permission(0, &sctx, KeyPerm::GenUniqueId, &key, &None).is_ok());
657 assert!(check_key_permission(0, &sctx, KeyPerm::ReqForcedOp, &key, &None).is_ok());
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700658 } else {
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700659 assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::Grant, &key, &None));
660 assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::ReqForcedOp, &key, &None));
661 assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::ManageBlob, &key, &None));
662 assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::UseDevId, &key, &None));
663 assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::GenUniqueId, &key, &None));
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700664 }
665 Ok(())
666 }
667
668 #[test]
669 fn check_key_permission_domain_blob() -> Result<()> {
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700670 let (sctx, namespace, is_su) = check_context()?;
Janis Danisevskis1b3a6e22020-08-07 12:39:56 -0700671 let key = KeyDescriptor {
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700672 domain: Domain::BLOB,
673 nspace: namespace as i64,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700674 alias: None,
675 blob: None,
676 };
677
678 if is_su {
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700679 check_key_permission(0, &sctx, KeyPerm::Use, &key, &None)
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700680 } else {
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700681 assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::Use, &key, &None));
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700682 Ok(())
683 }
684 }
685
686 #[test]
687 fn check_key_permission_domain_key_id() -> Result<()> {
Janis Danisevskisc5b210b2020-09-11 13:27:37 -0700688 let key = KeyDescriptor { domain: Domain::KEY_ID, nspace: 0, alias: None, blob: None };
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700689
690 assert_eq!(
691 Some(&KsError::sys()),
692 check_key_permission(
Janis Danisevskis45760022021-01-19 16:34:10 -0800693 0,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700694 &selinux::Context::new("ignored").unwrap(),
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700695 KeyPerm::Use,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700696 &key,
697 &None
698 )
699 .err()
700 .unwrap()
701 .root_cause()
702 .downcast_ref::<KsError>()
703 );
704 Ok(())
705 }
706
707 #[test]
708 fn key_perm_set_all_test() {
709 let v = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700710 KeyPerm::ManageBlob,
711 KeyPerm::Delete,
712 KeyPerm::UseDevId,
713 KeyPerm::ReqForcedOp,
714 KeyPerm::GenUniqueId,
715 KeyPerm::Grant,
716 KeyPerm::GetInfo,
717 KeyPerm::Rebind,
718 KeyPerm::Update,
719 KeyPerm::Use // Test if the macro accepts missing comma at the end of the list.
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700720 ];
721 let mut i = v.into_iter();
Janis Danisevskis56af0312021-10-18 16:11:41 -0700722 assert_eq!(i.next().unwrap().name(), "delete");
723 assert_eq!(i.next().unwrap().name(), "gen_unique_id");
724 assert_eq!(i.next().unwrap().name(), "get_info");
725 assert_eq!(i.next().unwrap().name(), "grant");
726 assert_eq!(i.next().unwrap().name(), "manage_blob");
727 assert_eq!(i.next().unwrap().name(), "rebind");
728 assert_eq!(i.next().unwrap().name(), "req_forced_op");
729 assert_eq!(i.next().unwrap().name(), "update");
730 assert_eq!(i.next().unwrap().name(), "use");
731 assert_eq!(i.next().unwrap().name(), "use_dev_id");
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700732 assert_eq!(None, i.next());
733 }
734 #[test]
735 fn key_perm_set_sparse_test() {
736 let v = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700737 KeyPerm::ManageBlob,
738 KeyPerm::ReqForcedOp,
739 KeyPerm::GenUniqueId,
740 KeyPerm::Update,
741 KeyPerm::Use, // Test if macro accepts the comma at the end of the list.
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700742 ];
743 let mut i = v.into_iter();
Janis Danisevskis56af0312021-10-18 16:11:41 -0700744 assert_eq!(i.next().unwrap().name(), "gen_unique_id");
745 assert_eq!(i.next().unwrap().name(), "manage_blob");
746 assert_eq!(i.next().unwrap().name(), "req_forced_op");
747 assert_eq!(i.next().unwrap().name(), "update");
748 assert_eq!(i.next().unwrap().name(), "use");
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700749 assert_eq!(None, i.next());
750 }
751 #[test]
752 fn key_perm_set_empty_test() {
753 let v = key_perm_set![];
754 let mut i = v.into_iter();
755 assert_eq!(None, i.next());
756 }
757 #[test]
758 fn key_perm_set_include_subset_test() {
759 let v1 = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700760 KeyPerm::ManageBlob,
761 KeyPerm::Delete,
762 KeyPerm::UseDevId,
763 KeyPerm::ReqForcedOp,
764 KeyPerm::GenUniqueId,
765 KeyPerm::Grant,
766 KeyPerm::GetInfo,
767 KeyPerm::Rebind,
768 KeyPerm::Update,
769 KeyPerm::Use,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700770 ];
771 let v2 = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700772 KeyPerm::ManageBlob,
773 KeyPerm::Delete,
774 KeyPerm::Rebind,
775 KeyPerm::Update,
776 KeyPerm::Use,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700777 ];
778 assert!(v1.includes(v2));
779 assert!(!v2.includes(v1));
780 }
781 #[test]
782 fn key_perm_set_include_equal_test() {
783 let v1 = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700784 KeyPerm::ManageBlob,
785 KeyPerm::Delete,
786 KeyPerm::Rebind,
787 KeyPerm::Update,
788 KeyPerm::Use,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700789 ];
790 let v2 = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700791 KeyPerm::ManageBlob,
792 KeyPerm::Delete,
793 KeyPerm::Rebind,
794 KeyPerm::Update,
795 KeyPerm::Use,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700796 ];
797 assert!(v1.includes(v2));
798 assert!(v2.includes(v1));
799 }
800 #[test]
801 fn key_perm_set_include_overlap_test() {
802 let v1 = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700803 KeyPerm::ManageBlob,
804 KeyPerm::Delete,
805 KeyPerm::Grant, // only in v1
806 KeyPerm::Rebind,
807 KeyPerm::Update,
808 KeyPerm::Use,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700809 ];
810 let v2 = key_perm_set![
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700811 KeyPerm::ManageBlob,
812 KeyPerm::Delete,
813 KeyPerm::ReqForcedOp, // only in v2
814 KeyPerm::Rebind,
815 KeyPerm::Update,
816 KeyPerm::Use,
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700817 ];
818 assert!(!v1.includes(v2));
819 assert!(!v2.includes(v1));
820 }
821 #[test]
822 fn key_perm_set_include_no_overlap_test() {
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700823 let v1 = key_perm_set![KeyPerm::ManageBlob, KeyPerm::Delete, KeyPerm::Grant,];
824 let v2 =
825 key_perm_set![KeyPerm::ReqForcedOp, KeyPerm::Rebind, KeyPerm::Update, KeyPerm::Use,];
Janis Danisevskis78bd48c2020-07-21 12:27:13 -0700826 assert!(!v1.includes(v2));
827 assert!(!v2.includes(v1));
828 }
829}