testcases/audit-test/syscalls/dac-run.conf

   1 #!/bin/bash
   2 # =============================================================================
   3 # (c) Copyright Hewlett-Packard Development Company, L.P., 2007
   4 #
   5 #   This program is free software: you can redistribute it and/or modify
   6 #   it under the terms of version 2 the GNU General Public License as
   7 #   published by the Free Software Foundation.
   8 #
   9 #   This program is distributed in the hope that it will be useful,
  10 #   but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 #   GNU General Public License for more details.
  13 #
  14 #   You should have received a copy of the GNU General Public License
  15 #   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16 # =============================================================================
  17
  18 ## Unless specified, the expected error for test failures is EACCES.
  19
  20 ##
  21 ## FS syscalls
  22 ##
  23
  24 ## SYSCALL:     access()
  25 ## PURPOSE:
  26 ## Verify audit of attempts to check permissions for a file.  The testcases
  27 ## below try to check permissions for a file which may or may not be accessible
  28 ## to the test process.  The test procedure is as follows:
  29 ## 1.  Create a new file and make it only accessible to the file owner.
  30 ## 2a. If expres=success, execute the test process as the file owner and
  31 ##     attempt to check permissions; verify the result
  32 ## 2b. If expres=fail, execute the test process as another user and
  33 ##     attempt to check permissions; verify the result
  34 ## 3.  Check the audit log for the correct syscall result
  35 + access perm=file_read expres=success dacugo=user user=super
  36 + access perm=file_read expres=fail dacugo=user user=test
  37
  38 ## SYSCALL:     chdir()
  39 ## PURPOSE:
  40 ## Verify audit of attempts to change working directory.  The test cases
  41 ## below try to change the current working directory to a directory that may or
  42 ## may not be accessible to the test process.  The test procedure is as follows:
  43 ## 1.  Create a new directory.
  44 ## 2a. If expres=success, execute the test process as the directory owner and
  45 ##     attempt to change the working directory to the new directory;
  46 ##     verify the result
  47 ## 2b. If expres=fail, execute the test process as another user and
  48 ##     attempt to change the working directory to the new directory;
  49 ##     verify the result
  50 ## 3.  Check the audit log for the correct syscall result
  51 + chdir perm=dir_exec expres=success dacugo=user user=super
  52 + chdir perm=dir_exec expres=fail dacugo=user user=test
  53
  54 ## SYSCALL:     creat()
  55 ## PURPOSE:
  56 ## Verify audit of attempts to create new files in the filesystem.  The
  57 ## testcases below try to create a new file in a directory which may or may not
  58 ## be accessible to the test process.  The test procedure is as follows:
  59 ## 1.  Create a new directory and make it only accessible to the directory owner.
  60 ## 2a. If expres=success, execute the test process as the directory owner and
  61 ##     attempt to create a new file in the directory, verify the result
  62 ## 2b. If expres=fail, execute the test process as another user and
  63 ##     attempt to create a new file in the directory, verify the result
  64 ## 3.  Check the audit log for the correct syscall result
  65 + creat perm=dir_add_name expres=success dacugo=user user=super
  66 + creat perm=dir_add_name expres=fail dacugo=user user=test
  67
  68 ## SYSCALL:     execve()
  69 ## PURPOSE:
  70 ## Verify audit of attempts to execute program.  The test cases below try to
  71 ## execute a file for which the user may or may not have appropriate
  72 ## permissions. The test procedure is as follows:
  73 ## 1.  Create a file which is only executable by the file owner.
  74 ## 2a. If expres=success, execute the test process as the file owner and
  75 ##     attempt to execute the test file, verify the result
  76 ## 2b. If expres=fail, execute the test process as another user and attempt to
  77 ##     execute the test file, verify the result
  78 ##  3. Check the audit log for the correct syscall result
  79 + execve perm=file_exec expres=success dacugo=user user=super
  80 + execve perm=file_exec expres=fail dacugo=user user=test
  81
  82 ## SYSCALL:     link()
  83 ## PURPOSE:
  84 ## Verify audit of attempts to create hard links in the filesystem. The test
  85 ## cases below try to create a new hard link in a directory for which the user
  86 ## may or may not have appropriate permissions. The test procedure is as
  87 ## follows:
  88 ## 1.  Create a new source file which is accessible to all users.
  89 ## 2.  Create a new destination directory for the hard link which is only
  90 ##     accessible to the directory owner.
  91 ## 3a. If expres=success, execute the test process as the directory owner and
  92 ##     attempt to create a hard link, verify the result
  93 ## 3b. If expres=fail, execute the test process as another user and
  94 ##     attempt to create a hard link, verify the result
  95 ## 4.  Check the audit log for the correct syscall result
  96 + link perm=dir_add_name which=new expres=success dacugo=user user=super
  97 + link perm=dir_add_name which=new expres=fail dacugo=user user=test
  98
  99 ## SYSCALL:     linkat()
 100 ## PURPOSE:
 101 ## Verify audit of attempts to create hard links relative to a directory file
 102 ## descriptor. See above for more details.
 103 + linkat perm=dir_add_name at=1 which=new expres=success dacugo=user user=super
 104 + linkat perm=dir_add_name at=1 which=new expres=fail dacugo=user user=test
 105
 106 ## SYSCALL:     mkdir()
 107 ## PURPOSE:
 108 ## Verify audit of attempts to create new directories in the filesystem. The
 109 ## test cases below try to create a new sub-directory in a directory for which
 110 ## the user may or may not have appropriate permissions.  The test procedure is
 111 ## as follows:
 112 ## 1.  Create a new destination directory for the sub-directory which is only
 113 ##     accessible to the directory owner.
 114 ## 2a. If expres=success, execute the test process as the directory owner and
 115 ##     attempt to create a directory, verify the result
 116 ## 2b. If expres=fail, execute the test process as another user and
 117 ##     attempt to create a directory, verify the result
 118 ## 3.  Check the audit log for the correct syscall result
 119 + mkdir perm=dir_add_name expres=success dacugo=user user=super
 120 + mkdir perm=dir_add_name expres=fail dacugo=user user=test
 121
 122 ## SYSCALL:     mkdirat()
 123 ## PURPOSE:
 124 ## Verify audit of attempts to create new directories relative to a directory
 125 ## file descriptor. See above for more details.
 126 + mkdirat perm=dir_add_name at=1 expres=success dacugo=user user=super
 127 + mkdirat perm=dir_add_name at=1 expres=fail dacugo=user user=test
 128
 129 ## SYSCALL:     mknod()
 130 ## PURPOSE:
 131 ## Verify audit of attempts to create new nodes in the filesystem. The
 132 ## test cases below try to create a new node in a directory for which the user
 133 ## may or may not have appropriate permissions. The test procedure is as
 134 ## follows:
 135 ## 1.  Create a new destination directory for the node which is only
 136 ##     accessible to the directory owner.
 137 ## 2a. If expres=success, execute the test process as the directory owner and
 138 ##     attempt to create a node, verify the result
 139 ## 2b. If expres=fail, execute the test process as another user and
 140 ##     attempt to create a node, verify the result
 141 ## 3.  Check the audit log for the correct syscall result
 142 + mknod perm=dir_add_name expres=success dacugo=user user=super
 143 + mknod perm=dir_add_name expres=fail dacugo=user user=test
 144
 145 ## SYSCALL:     mknodat()
 146 ## PURPOSE:
 147 ## Verify audit of attempts to create new nodes relative to a directory
 148 ## file descriptor. See above for more details.
 149 + mknodat perm=dir_add_name at=1 expres=success dacugo=user user=super
 150 + mknodat perm=dir_add_name at=1 expres=fail dacugo=user user=test
 151
 152 ## SYSCALL:     open()
 153 ## PURPOSE:
 154 ## Verify audit of attempts to open or create new files in the filesystem.
 155 ## There are three types of testcases in this set of tests.  The first, using the
 156 ## 'perm=dir_add_name' variable, tries to create a new file in a directory which
 157 ## may or may not be accessible to the test process executing the open()
 158 ## syscall.  The second, using the 'perm=file_read' variable, tries to open a
 159 ## file for reading for which the test process may or may not have read
 160 ## permission.  The third, using the 'perm=file_write' variable, tries to open a
 161 ## file for writing for which the test process may or may not have write
 162 ## permission.  The test procedure is as follows:
 163 ## 1a. If perm=dir_add_name, create a new directory and make it only
 164 ##     accessible to the directory owner.
 165 ## 1b. If perm=file_read, create a file which is only read-accessible to the
 166 ##     file owner.
 167 ## 1c. If perm=file_write, create a file which is only write-accessible to the
 168 ##     file owner.
 169 ## 2a. If expres=success, execute the test process as the directory or file
 170 ##     owner and attempt the open() syscall using the value of flag to
 171 ##     determine whether to create a new file or open an existing file for read
 172 ##     or write; verify the result.
 173 ## 2b. If expres=fail, execute the test process as another user and
 174 ##     attempt the open() syscall using the value of flag to determine whether
 175 ##     to create a new file or open an existing file for read or write; verify
 176 ##     the result.
 177 ## 3.  Check the audit log for the correct syscall result
 178 + open perm=dir_add_name flag=create expres=success dacugo=user user=super
 179 + open perm=dir_add_name flag=create expres=fail dacugo=user user=test
 180 + open perm=file_read flag=read expres=success dacugo=user user=super
 181 + open perm=file_read flag=read expres=fail dacugo=user user=test
 182 + open perm=file_write flag=write expres=success dacugo=user user=super
 183 + open perm=file_write flag=write expres=fail dacugo=user user=test
 184
 185 ## SYSCALL:     openat()
 186 ## PURPOSE:
 187 ## Verify audit of attempts to open or create new files relative to a directory
 188 ## file descriptor. See above for more details.
 189 + openat perm=dir_add_name at=1 flag=create expres=success dacugo=user user=super
 190 + openat perm=dir_add_name at=1 flag=create expres=fail dacugo=user user=test
 191 + openat perm=file_read at=1 flag=read expres=success dacugo=user user=super
 192 + openat perm=file_read at=1 flag=read expres=fail dacugo=user user=test
 193 + openat perm=file_write at=1 flag=write expres=success dacugo=user user=super
 194 + openat perm=file_write at=1 flag=write expres=fail dacugo=user user=test
 195
 196 ## SYSCALL:     readlink()
 197 ## PURPOSE:
 198 ## Verify audit of attempts to read symbolic links in the filesystem.  The test
 199 ## cases below try to read a symbolic link for which the user may or may not
 200 ## have appropriate permissions.  The test procedure is as follows:
 201 ## 1.  Create a new test file which is accessible to all users.
 202 ## 2.  Create a new symbolic link to the test file which is only accessible
 203 ##     to the symlink owner.
 204 ## 3a. If expres=success, execute the test process as the symlink owner and
 205 ##     attempt to read the symlink, verify the result
 206 ## 3b. If expres=fail, execute the test process as another user and
 207 ##     attempt to read the symlink, verify the result
 208 ## 4.  Check the audit log for the correct syscall result
 209 + readlink perm=symlink_read expres=success dacugo=user user=super
 210 + readlink perm=symlink_read expres=fail dacugo=user user=test
 211
 212 ## SYSCALL:     readlinkat()
 213 ## PURPOSE:
 214 ## Verify audit of attempts to read symbolic links relative to a directory
 215 ## file descriptor. See above for more details.
 216 + readlinkat perm=symlink_read at=1 expres=success dacugo=user user=super
 217 + readlinkat perm=symlink_read at=1 expres=fail dacugo=user user=test
 218
 219 ## SYSCALL:     rename()
 220 ## PURPOSE:
 221 ## Verify audit of attempts to change the name or location of a file in the
 222 ## filesystem.  There are three types of testcases in this set of tests.  The
 223 ## first, using the 'perm=dir_remove_name,which=old' variables, creates the
 224 ## original file in a parent directory which may or may not be accessible to the
 225 ## test process and tries to move this file into a new directory.  The second
 226 ## test, using the 'perm=dir_add_name' variable, creates a new parent directory
 227 ## which may or may not be accessible to the test process and tries to move the
 228 ## original file into this new directory.  The third test, using the
 229 ## 'perm=dir_remove_name,which=new' variables, creates a parent directory which
 230 ## may or may not be accessible to the test process and tries to rename a file
 231 ## to the name of an existing file in that directory.  The test procedure is as
 232 ## follows:
 233 ##  1.  Create a new parent directory for the original object. If
 234 ##      perm=dir_remove_name,which=old then make it only accessible to the
 235 ##      directory owner.
 236 ##  2.  Create the original object.
 237 ##  3.  Create a new parent directory for the new location. If perm=dir_add_name
 238 ##      or perm=dir_remove_name,which=new then make it only accessible to the
 239 ##      directory owner.
 240 ##  4.  If perm=dir_remove_name,which=new then create a file at the new location.
 241 ##  5a. If expres=success, execute the test process as the directory owner and
 242 ##      attempt the rename() syscall, verify the result
 243 ##  5b. If expres=fail, execute the test process as another user and attempt the
 244 ##      rename() syscall, verify the result
 245 ##  6.  Check the audit log for the correct syscall result
 246 + rename perm=dir_remove_name entry=file which=old expres=success dacugo=user \
 247   user=super tag=rename__dac_dir_remove_name_old_success_owner
 248 + rename perm=dir_remove_name entry=file which=old expres=fail dacugo=user \
 249   user=test tag=rename__dac_dir_remove_name_old_fail_owner
 250 + rename perm=dir_add_name which=new expres=success dacugo=user user=super
 251 + rename perm=dir_add_name which=new expres=fail dacugo=user user=test
 252 + rename perm=dir_remove_name entry=file which=new expres=success dacugo=user \
 253   user=super tag=rename__dac_dir_remove_name_new_success_owner
 254 + rename perm=dir_remove_name entry=file which=new expres=fail dacugo=user \
 255   user=test tag=rename__dac_dir_remove_name_new_fail_owner
 256
 257 ## SYSCALL:     renameat()
 258 ## PURPOSE:
 259 ## Verify audit of attempts to change the name or location of a file relative to
 260 ## a directory file descriptor. See above for more details.
 261 + renameat perm=dir_remove_name at=1 entry=file which=old expres=success \
 262   dacugo=user user=super tag=renameat__dac_dir_remove_name_old_success_owner
 263 + renameat perm=dir_remove_name at=1 entry=file which=old expres=fail \
 264   dacugo=user user=test tag=renameat__dac_dir_remove_name_old_fail_owner
 265 + renameat perm=dir_add_name at=1 which=new expres=success dacugo=user user=super
 266 + renameat perm=dir_add_name at=1 which=new expres=fail dacugo=user user=test
 267 + renameat perm=dir_remove_name at=1 entry=file which=new expres=success \
 268   dacugo=user user=super tag=renameat__dac_dir_remove_name_new_success_owner
 269 + renameat perm=dir_remove_name at=1 entry=file which=new expres=fail \
 270   dacugo=user user=test tag=renameat__dac_dir_remove_name_new_fail_owner
 271
 272 ## SYSCALL:     rmdir()
 273 ## PURPOSE:
 274 ## Verify audit of attempts to an remove empty directory from the filesystem.
 275 ## The testcases below try to remove a sub-directory from a directory which may
 276 ## or may not be accessible to the test process.  The test procedure is as
 277 ## follows:
 278 ## 1.  Create a new parent directory which is only accessible to the directory
 279 ##     owner.
 280 ## 2.  Create a new sub-directory in the parent directory.
 281 ## 3a. If expres=success, execute the test process as the directory owner and
 282 ##     attempt to remove the sub-directory, verify the result
 283 ## 3b. If expres=fail, execute the test process as another user and
 284 ##     attempt to remove the sub-directory, verify the result
 285 ## 4.  Check the audit log for the correct syscall result
 286 + rmdir perm=dir_remove_name entry=dir expres=success dacugo=user user=super
 287 + rmdir perm=dir_remove_name entry=dir expres=fail dacugo=user user=test
 288
 289 ## SYSCALL:     symlink()
 290 ## PURPOSE:
 291 ## Verify audit of attempts to create a symbolic link in the filesystem.  The
 292 ## testcases below try to create a new symbolic link in a directory for which
 293 ## the user may or may not have appropriate permissions.  The test procedure is
 294 ## as follows:
 295 ## 1.  Create a new destination directory for the symlink which is only
 296 ##     accessible to the directory owner.
 297 ## 2a. If expres=success, execute the test process as the directory owner and
 298 ##     attempt to create a symlink, verify the result
 299 ## 2b. If expres=fail, execute the test process as another user and
 300 ##     attempt to create a symlink, verify the result
 301 ## 3.  Check the audit log for the correct syscall result
 302 + symlink perm=dir_add_name which=new expres=success dacugo=user user=super
 303 + symlink perm=dir_add_name which=new expres=fail dacugo=user user=test
 304
 305 ## SYSCALL:     symlinkat()
 306 ## PURPOSE:
 307 ## Verify audit of attempts to create a symbolic link relative to a directory
 308 ## file descriptor. See above for more details.
 309 + symlinkat perm=dir_add_name at=1 which=new expres=success dacugo=user user=super
 310 + symlinkat perm=dir_add_name at=1 which=new expres=fail dacugo=user user=test
 311
 312 ## SYSCALL:     truncate(), truncate64()
 313 ## PURPOSE:
 314 ## Verify audit of attempts to truncate a file to a specified length.  The test
 315 ## cases below try to truncate a file which may or may not be writeable by the
 316 ## test process executing the truncate() syscall.  The test procedure is as
 317 ## follows:
 318 ## 1.  Create a file which is only write-accessible to the file owner.
 319 ## 2a. If expres=success, execute the test process as the file owner and
 320 ##     attempt to truncate the file, verify the result
 321 ## 2b. If expres=fail, execute the test process as another user and
 322 ##     attempt to truncate the file, verify the result
 323 ## 3.  Check the audit log for the correct syscall result
 324 + truncate perm=file_write expres=success dacugo=user user=super
 325 + truncate perm=file_write expres=fail dacugo=user user=test
 326 if [[ $MODE == 32 ]]; then
 327 + truncate64 perm=file_write expres=success dacugo=user user=super
 328 + truncate64 perm=file_write expres=fail dacugo=user user=test
 329 fi
 330
 331 ## SYSCALL:     unlink()
 332 ## PURPOSE:
 333 ## Verify audit of attempts to remove a file in the filesystem.  The testcases
 334 ## below try to remove a file from a directory for which the user may or may not
 335 ## have appropriate permissions.  The test procedure is as follows:
 336 ## 1.  Create a new parent directory which is only accessible to the directory
 337 ##     owner.
 338 ## 2.  Create a new file in the parent directory.
 339 ## 3a. If expres=success, execute the test process as the directory owner and
 340 ##     attempt to remove the file, verify the result
 341 ## 3b. If expres=fail, execute the test process as another user and
 342 ##     attempt to remove the file, verify the result
 343 ## 4.  Check the audit log for the correct syscall result
 344 + unlink perm=dir_remove_name entry=file expres=success dacugo=user user=super
 345 + unlink perm=dir_remove_name entry=file expres=fail dacugo=user user=test
 346
 347 ## SYSCALL:     unlinkat()
 348 ## PURPOSE:
 349 ## Verify audit of attempts to remove a file relative to a directory file
 350 ## descriptor. See above for more details.
 351 + unlinkat perm=dir_remove_name at=1 entry=file expres=success dacugo=user user=super
 352 + unlinkat perm=dir_remove_name at=1 entry=file expres=fail dacugo=user user=test
 353
 354 ## SYSCALL:     uselib()
 355 ## PURPOSE:
 356 ## Verify audit of attempts to load shared library.  The testcases below try to
 357 ## load a library for which the user may or may not have appropriate
 358 ## permissions.
 359 ## NOTE:
 360 ## The kernel only accepts obsolete formats, so the true success case is
 361 ## difficult to reproduce. Permission checks happen before the format checks, so
 362 ## verifying ENOEXEC is sufficient to demonstrate DAC/MAC success.
 363 ## The test procedure is as follows:
 364 ## 1.  Create a dummy shared library which is only accessible to the library
 365 ##     owner.
 366 ## 2a. If expres=success, execute the test process as the directory owner and
 367 ##     attempt to load the library, verify the result
 368 ## 2b. If expres=fail, execute the test process as another user and
 369 ##     attempt to load the library, verify the result
 370 ##  3. Check the audit log for the correct syscall result
 371 if [[ $HOSTTYPE != x86_64 ]]; then
 372 + uselib perm=file_exec expres=fail dacugo=user user=root err=ENOEXEC \
 373   tag=uselib__dac_file_exec_success_user
 374 + uselib perm=file_exec expres=fail dacugo=user user=test
 375 fi
 376
 377 ## SYSCALL:     utime(), utimes()
 378 ## PURPOSE:
 379 ## Verify audit of attempts to change access and/or modification times of an
 380 ## inode.  The testcases below try to change the timestamps to the current time
 381 ## for a file which may or may not be write accessible to the test process.
 382 ## The test procedure is as follows:
 383 ## 1.  Create a new file which is only write accessible to the file owner.
 384 ## 2a. If expres=success, execute the test process as the file owner and
 385 ##     attempt to change the file's timestamps; verify the result
 386 ## 2b. If expres=fail, execute the test process as another user and
 387 ##     attempt to change the file's timestamps; verify the result
 388 ## 3.  Check the audit log for the correct syscall result
 389 if [[ $HOSTTYPE != ia64 ]]; then
 390 + utime perm=file_write expres=success dacugo=user user=super
 391 + utime perm=file_write expres=fail dacugo=user user=test
 392 fi
 393 + utimes perm=file_write expres=success dacugo=user user=super
 394 + utimes perm=file_write expres=fail dacugo=user user=test
 395
 396 ##
 397 ## IPC syscalls
 398 ##
 399
 400 ## Note: When testing the ipc() syscall, the 'op' variable determines the tested
 401 ## syscall operation.
 402
 403 ## SYSCALL:     msgget(), ipc()
 404 ## PURPOSE:
 405 ## Verify audit of attempts to get a message queue identifier.  There are two
 406 ## types of testcases in this set of tests. The first, using the
 407 ## 'perm=msg_key_read' variable, tries to open a message queue for reading which
 408 ## may or may not be read-accessible to the test process.  The second, using the
 409 ## 'perm=msg_key_write' variable, tries to open a message queue for writing
 410 ## which may or may not be write-accessible to the test process.  The test
 411 ## procedure is as follows:
 412 ## 1a. If perm=msg_key_read, create a message queue which is only
 413 ##     read-accessible to the message queue owner.
 414 ## 1b. If perm=msg_key_write, create a message queue which is only
 415 ##     write-accessible to the message queue owner.
 416 ## 2a. If expres=success, execute the test process as the message queue
 417 ##     owner and attempt the syscall using the value of flag to determine
 418 ##     whether to open the message queue for read or write; verify the result.
 419 ## 2b. If expres=fail, execute the test process as another user and attempt the
 420 ##     syscall using the value of flag to determine whether to open the message
 421 ##     queue for read or write; verify the result.
 422 ## 3.  Check the audit log for the correct syscall result
 423 if [[ $MODE == 64 ]]; then
 424 + msgget perm=msg_key_read expres=success dacugo=user user=super
 425 + msgget perm=msg_key_read expres=fail dacugo=user user=test
 426 + msgget perm=msg_key_write expres=success dacugo=user user=super
 427 + msgget perm=msg_key_write expres=fail dacugo=user user=test
 428 fi
 429 if [[ $MODE == 32 ]]; then
 430 + ipc op=msgget perm=msg_key_read expres=success dacugo=user user=super
 431 + ipc op=msgget perm=msg_key_read expres=fail dacugo=user user=test
 432 + ipc op=msgget perm=msg_key_write expres=success dacugo=user user=super
 433 + ipc op=msgget perm=msg_key_write expres=fail dacugo=user user=test
 434 fi
 435
 436 ## SYSCALL:     msgrcv(), ipc()
 437 ## PURPOSE:
 438 ## Verify audit of attempts to receive messages from a message queue.  The test
 439 ## cases below try to receive a message from a message queue which may or may
 440 ## not be accessible to the test process.  The test procedure is as follows:
 441 ## 1.  Create a message queue which is only read-accessible to the message queue
 442 ##     owner.
 443 ## 2a. If expres=success, execute the test process as the message queue
 444 ##     owner and attempt to receive a message, verify the result
 445 ## 2b. If expres=fail, execute the test process as another user and attempt to
 446 ##     receive a message, verify the result
 447 ## 3.  Check the audit log for the correct syscall result
 448 if [[ $MODE == 64 ]]; then
 449 + msgrcv perm=msg_id_recv expres=success dacugo=user user=super
 450 + msgrcv perm=msg_id_recv expres=fail dacugo=user user=test
 451 fi
 452 if [[ $MODE == 32 ]]; then
 453 + ipc op=msgrcv perm=msg_id_recv expres=success dacugo=user user=super
 454 + ipc op=msgrcv perm=msg_id_recv expres=fail dacugo=user user=test
 455 fi
 456
 457 ## SYSCALL:     msgsnd(), ipc()
 458 ## PURPOSE:
 459 ## Verify audit of attempts to send messages to a message queue.  The test
 460 ## cases below try to send a message to a message queue which may or may
 461 ## not be accessible to the test process.  The test procedure is as follows:
 462 ## 1.  Create a message queue which is only write-accessible to the message
 463 ##     queue owner.
 464 ## 2a. If expres=success, execute the test process as the message queue
 465 ##     owner and attempt to send a message, verify the result
 466 ## 2b. If expres=fail, execute the test process as another user and attempt to
 467 ##     send a message, verify the result
 468 ## 3.  Check the audit log for the correct syscall result
 469 if [[ $MODE == 64 ]]; then
 470 + msgsnd perm=msg_id_send msg="this is a test" expres=success dacugo=user \
 471   user=super testfunc=test_su_msg_send
 472 + msgsnd perm=msg_id_send msg="this is a test" expres=fail dacugo=user \
 473   user=test testfunc=test_su_msg_send
 474 fi
 475 if [[ $MODE == 32 ]]; then
 476 + ipc op=msgsnd perm=msg_id_send msg="this is a test" expres=success dacugo=user \
 477   user=super testfunc=test_su_msg_send
 478 + ipc op=msgsnd perm=msg_id_send msg="this is a test" expres=fail dacugo=user \
 479   user=test testfunc=test_su_msg_send
 480 fi
 481
 482 ## SYSCALL:     semget(), ipc()
 483 ## PURPOSE:
 484 ## Verify audit of attempts to get a semaphore set identifier.  There are two
 485 ## types of testcases in this set of tests. The first, using the
 486 ## 'perm=sem_key_read' variable, tries to open a semaphore set for read
 487 ## operations which may or may not be read-accessible to the test process.  The
 488 ## second, using the 'perm=sem_key_write' variable, tries to open a semaphore
 489 ## set for write operations which may or may not be write-accessible to the test
 490 ## process.  The test procedure is as follows:
 491 ## 1a. If perm=sem_key_read, create a semaphore set which is only
 492 ##     read-accessible to the semaphore set owner.
 493 ## 1b. If perm=sem_key_write, create a semaphore set which is only
 494 ##     write-accessible to the semaphore set owner.
 495 ## 2a. If expres=success, execute the test process as the semaphore set
 496 ##     owner and attempt the syscall using the value of flag to determine
 497 ##     whether to open the semaphore set for read or write; verify the result.
 498 ## 2b. If expres=fail, execute the test process as another user and attempt the
 499 ##     syscall using the value of flag to determine whether to open the
 500 ##     semaphore set for read or write; verify the result.
 501 ## 3.  Check the audit log for the correct syscall result
 502 if [[ $MODE == 64 ]]; then
 503 + semget perm=sem_key_read expres=success dacugo=user user=super
 504 + semget perm=sem_key_read expres=fail dacugo=user user=test
 505 + semget perm=sem_key_write expres=success dacugo=user user=super
 506 + semget perm=sem_key_write expres=fail dacugo=user user=test
 507 fi
 508 if [[ $MODE == 32 ]]; then
 509 + ipc op=semget perm=sem_key_read expres=success dacugo=user user=super
 510 + ipc op=semget perm=sem_key_read expres=fail dacugo=user user=test
 511 + ipc op=semget perm=sem_key_write expres=success dacugo=user user=super
 512 + ipc op=semget perm=sem_key_write expres=fail dacugo=user user=test
 513 fi
 514
 515 ## SYSCALL:     semop(), ipc()
 516 ## PURPOSE:
 517 ## Verify audit of attempts to perform semaphore operations.  The test
 518 ## cases below try to perform a read operation on a semaphore in a set which may
 519 ## or may not be accessible to the test process.  The test procedure is as
 520 ## follows:
 521 ## 1.  Create a semaphore set which is only read-accessible to the semaphore set
 522 ##     owner.
 523 ## 2a. If expres=success, execute the test process as the semaphore set
 524 ##     owner and attempt a read operation, verify the result
 525 ## 2b. If expres=fail, execute the test process as another user and attempt a
 526 ##     read operation, verify the result
 527 ## 3.  Check the audit log for the correct syscall result
 528 if [[ $MODE == 64 ]]; then
 529 + semop perm=sem_id_read expres=success dacugo=user user=super
 530 + semop perm=sem_id_read expres=fail dacugo=user user=test
 531 fi
 532 if [[ $MODE == 32 ]]; then
 533 + ipc op=semop perm=sem_id_read expres=success dacugo=user user=super
 534 + ipc op=semop perm=sem_id_read expres=fail dacugo=user user=test
 535 fi
 536
 537 ## SYSCALL:     semtimedop(), ipc()
 538 ## PURPOSE:
 539 ## Verify audit of attempts to perform semaphore operations.  The test
 540 ## cases below try to perform a write operation on a semaphore in a set which
 541 ## may or may not be accessible to the test process.  The test procedure is as
 542 ## follows:
 543 ## 1.  Create a semaphore set which is only write-accessible to the semaphore
 544 ##     set owner.
 545 ## 2a. If expres=success, execute the test process as the semaphore set
 546 ##     owner and attempt a write operation, verify the result
 547 ## 2b. If expres=fail, execute the test process as another user and attempt a
 548 ##     write operation, verify the result
 549 ## 3.  Check the audit log for the correct syscall result
 550 if [[ $MODE == 64 ]]; then
 551 + semtimedop perm=sem_id_write expres=success dacugo=user user=super
 552 + semtimedop perm=sem_id_write expres=fail dacugo=user user=test
 553 fi
 554 if [[ $MODE == 32 ]]; then
 555 + ipc op=semtimedop perm=sem_id_write expres=success dacugo=user user=super
 556 + ipc op=semtimedop perm=sem_id_write expres=fail dacugo=user user=test
 557 fi
 558
 559 ## SYSCALL:     shmat(), ipc()
 560 ## PURPOSE:
 561 ## Verify audit of attempts to perform shared memory operations.  The test
 562 ## cases below try to perform shared memory operations on a shared memory
 563 ## segment which may or may not be accessible to the test process.  The test
 564 ## procedure is as follows:
 565 ## 1a. If perm=shm_key_read, create a shared memory segment which is only
 566 ##     read-accessible to the shared memory segment owner.
 567 ## 1b. If perm=shm_key_write, create a shared memory segment which is only
 568 ##     write-accessible to the shared memory segment owner.
 569 ## 2a. If expres=success, execute the test process as the shared memory segment
 570 ##     owner and attempt the syscall using the value of perm to determine
 571 ##     whether to perform a read or write operation; verify the result
 572 ## 2b. If expres=fail, execute the test process as another user and attempt the
 573 ##     syscall using the value of perm to determine whether to perform a read or
 574 ##     write operation; verify the result
 575 ## 3.  Check the audit log for the correct syscall result
 576 if [[ $MODE == 64 ]]; then
 577 + shmat perm=shm_id_read expres=success dacugo=user user=super
 578 + shmat perm=shm_id_read expres=fail dacugo=user user=test
 579 + shmat perm=shm_id_write expres=success dacugo=user user=super
 580 + shmat perm=shm_id_write expres=fail dacugo=user user=test
 581 fi
 582 if [[ $MODE == 32 ]]; then
 583 + ipc op=shmat perm=shm_id_read expres=success dacugo=user user=super \
 584   augrokfunc=augrok_op_no_exit
 585 + ipc op=shmat perm=shm_id_read expres=fail dacugo=user user=test
 586 + ipc op=shmat perm=shm_id_write expres=success dacugo=user user=super \
 587   augrokfunc=augrok_op_no_exit
 588 + ipc op=shmat perm=shm_id_write expres=fail dacugo=user user=test
 589 fi
 590
 591 ## SYSCALL:     shmget(), ipc()
 592 ## PURPOSE:
 593 ## Verify audit of attempts to get a shared memory id.  There are two types of
 594 ## testcases in this set of tests. The first, using the 'perm=shm_key_read'
 595 ## variable, tries to open a shared memory segment for read operations which may
 596 ## or may not be read-accessible to the test process.  The second, using the
 597 ## 'perm=shm_key_write' variable, tries to open a shared memory segment for
 598 ## write operations which may or may not be write-accessible to the test
 599 ## process.  The test procedure is as follows:
 600 ## 1a. If perm=shm_key_read, create a shared memory segment which is only
 601 ##     read-accessible to the shared memory segment owner.
 602 ## 1b. If perm=shm_key_write, create a shared memory segment which is only
 603 ##     write-accessible to the shared memory segment owner.
 604 ## 2a. If expres=success, execute the test process as the shared memory segment
 605 ##     owner and attempt the syscall using the value of flag to determine
 606 ##     whether to request the shared memory segment for read or write; verify
 607 ##     the result.
 608 ## 2b. If expres=fail, execute the test process as another user and attempt the
 609 ##     syscall using the value of flag to determine whether to request the
 610 ##     shared memory segment for read or write; verify the result.
 611 ## 3.  Check the audit log for the correct syscall result
 612 if [[ $MODE == 64 ]]; then
 613 + shmget perm=shm_key_read expres=success dacugo=user user=super
 614 + shmget perm=shm_key_read expres=fail dacugo=user user=test
 615 + shmget perm=shm_key_write expres=success dacugo=user user=super
 616 + shmget perm=shm_key_write expres=fail dacugo=user user=test
 617 fi
 618 if [[ $MODE == 32 ]]; then
 619 + ipc op=shmget perm=shm_key_read expres=success dacugo=user user=super
 620 + ipc op=shmget perm=shm_key_read expres=fail dacugo=user user=test
 621 + ipc op=shmget perm=shm_key_write expres=success dacugo=user user=super
 622 + ipc op=shmget perm=shm_key_write expres=fail dacugo=user user=test
 623 fi
 624
 625 ##
 626 ## XATTR syscalls
 627 ##
 628
 629 ## SYSCALL:     removexattr(), fremovexattr(), lremovexattr()
 630 ## PURPOSE:
 631 ## Verify audit of attempts to remove an extended attribute.  The testcases
 632 ## below try to remove an extended attribute on a file which may or may not be
 633 ## accessible to the test process.  The test procedure is as follows:
 634 ## 1.  Create a file which is only write-accessible to the file owner.
 635 ## 2a. If expres=success, execute the test process as the file owner and
 636 ##     attempt to remove an extended attribute, verify the result
 637 ## 2b. If expres=fail, execute the test process as another user and
 638 ##     attempt to remove an extended attribute, verify the result
 639 ## 3.  Check the audit log for the correct syscall result
 640 + fremovexattr perm=xattr_remove flag=user.mime_type expres=success dacugo=user \
 641   user=super
 642 + fremovexattr perm=xattr_remove flag=user.mime_type expres=fail dacugo=user \
 643   user=test
 644 + lremovexattr perm=xattr_remove flag=user.mime_type expres=success dacugo=user \
 645   user=super
 646 + lremovexattr perm=xattr_remove flag=user.mime_type expres=fail dacugo=user \
 647   user=test
 648 + removexattr perm=xattr_remove flag=user.mime_type expres=success dacugo=user \
 649   user=super
 650 + removexattr perm=xattr_remove flag=user.mime_type expres=fail dacugo=user \
 651   user=test
 652
 653 ## SYSCALL:     setxattr(), fsetxattr(), lsetxattr()
 654 ## PURPOSE:
 655 ## Verify audit of attempts to set an extended attribute.  The testcases
 656 ## below try to set an extended attribute on a file which may or may not be
 657 ## accessible to the test process.  The test procedure is as follows:
 658 ## 1.  Create a file which is only write-accessible to the file owner.
 659 ## 2a. If expres=success, execute the test process as the file owner and
 660 ##     attempt to set an extended attribute, verify the result
 661 ## 2b. If expres=fail, execute the test process as another user and
 662 ##     attempt to set an extended attribute, verify the result
 663 ## 3.  Check the audit log for the correct syscall result
 664 + fsetxattr perm=xattr_set flag=user.mime_type expres=success dacugo=user \
 665   user=super testfunc=test_su_setxattr
 666 + fsetxattr perm=xattr_set flag=user.mime_type expres=fail dacugo=user \
 667   user=test  testfunc=test_su_setxattr
 668 + lsetxattr perm=xattr_set flag=user.mime_type expres=success dacugo=user \
 669   user=super testfunc=test_su_setxattr
 670 + lsetxattr perm=xattr_set flag=user.mime_type expres=fail dacugo=user \
 671   user=test  testfunc=test_su_setxattr
 672 + setxattr perm=xattr_set flag=user.mime_type expres=success dacugo=user \
 673   user=super testfunc=test_su_setxattr
 674 + setxattr perm=xattr_set flag=user.mime_type expres=fail dacugo=user \
 675   user=test testfunc=test_su_setxattr