Ensure property owners are exclusive
system_property_type and vendor_property_type can't be assigned
together. For example, the following policy snippet will fail.
system_public_prop(foo_prop)
typeattribute foo_prop vendor_property_type;
product_property_type is currently synonym for system_property_type, so
we only check those two.
Bug: 171437654
Test: m selinux_policy
Test: add "typeattribute default_prop vendor_property_type;" to
property.te and then "m selinux_policy"
Change-Id: I1cdbf3d04264bb045568c30f19339dfe3889dbb4
diff --git a/tests/policy.py b/tests/policy.py
index 0f51e2f..24466e9 100644
--- a/tests/policy.py
+++ b/tests/policy.py
@@ -103,6 +103,17 @@
ret += " ".join(str(x) for x in sorted(violators)) + "\n"
return ret
+ def AssertPropertyOwnersAreExclusive(self):
+ systemProps = self.QueryTypeAttribute('system_property_type', True)
+ vendorProps = self.QueryTypeAttribute('vendor_property_type', True)
+ violators = systemProps.intersection(vendorProps)
+ ret = ""
+ if len(violators) > 0:
+ ret += "The following types have both system_property_type "
+ ret += "and vendor_property_type: "
+ ret += " ".join(str(x) for x in sorted(violators)) + "\n"
+ return ret
+
# Return all file_contexts entries that map to the input Type.
def QueryFc(self, Type):
if Type in self.__FcDict:
diff --git a/tests/sepolicy_tests.py b/tests/sepolicy_tests.py
index f8dc466..c92be7a 100644
--- a/tests/sepolicy_tests.py
+++ b/tests/sepolicy_tests.py
@@ -37,6 +37,10 @@
return pol.AssertPathTypesHaveAttr(["/data/"], ["/data/vendor",
"/data/vendor_ce", "/data/vendor_de"], "core_data_file_type")
+def TestPropertyTypeViolations(pol):
+ return pol.AssertPropertyOwnersAreExclusive()
+
+
###
# extend OptionParser to allow the same option flag to be used multiple times.
# This is used to allow multiple file_contexts files and tests to be
@@ -62,6 +66,7 @@
"TestDebugfsTypeViolations",
"TestVendorTypeViolations",
"TestCoreDataTypeViolations",
+ "TestPropertyTypeViolations"
]
if __name__ == '__main__':
@@ -115,6 +120,8 @@
results += TestVendorTypeViolations(pol)
if options.test is None or "TestCoreDataTypeViolations" in options.test:
results += TestCoreDataTypeViolations(pol)
+ if options.test is None or "TestPropertyTypeViolations" in options.test:
+ results += TestPropertyTypeViolations(pol)
if len(results) > 0:
sys.exit(results)