- Image Types:
- basesdk-amd64 / minimal-armhf-internal / minimal-armhf / minimal-arm64 / minimal-amd64 / sdk-amd64 / target-armhf-internal / target-armhf / target-amd64
- Image Deployment:
Test apparmor_parser and other tools in apparmor package can be executed
- Ensure Rootfs is remounted as read/write.
- Install dependencies
- Restart the system to restore the filesystem state to read-only before running the test.
- Clone the tests repository from another computer (Note that the branch being tested may change depending on the release, please make sure to clone the correct branch for the release in question):
- Copy the test directory apertis-tests to the target device:
- Log into the target device:
$ sudo mount -o remount,rw /
$ sudo apt install apparmor-utils-tests busybox apertis-tests-apparmor-report
$ sudo reboot
$ git clone --branch apertis/v2020pre https://gitlab.apertis.org/infrastructure/apertis-tests.git
$ scp -r apertis-tests user@$DUT_IP:
$ ssh user@$DUT_IP
- Enter test directory:
- Run the the following commands:
$ cd apertis-tests
$ common/run-test-in-systemd --name=aa-enforce-test --timeout 90 -- sh /usr/lib/apparmor-utils-tests/aa-enforce-test.sh
$ common/run-test-in-systemd --name=apparmor_parser --timeout 90 -- sh /usr/lib/apparmor-utils-tests/apparmor_parser.sh
$ sudo journalctl -b -t audit -o cat | /usr/bin/aa_log_extract_tokens.sh ALLOWED DENIED
The test will show on stdout OK,FAIL or SKIP and exit code will be non zero if at least one subtest will fail. A similar output will be shown:
checking /bin/true is enforced: OK -
If the test_profile_syntax test-case in the apparmor-basic-profiles test is failing, please report that failure instead: it produces better diagnostics.
When that test case is failing, the go in complain mode, change for enforced profiles in enforce->complain, change in complaininig profiles in enforce->complain, gran total enforce/disable and change for enforced profiles in enforce->disable test-cases in this test are also expected to fail.
- Make sure that you have disconnect the ethernet connection to the target before you start the tethering process.
- Implement a minimum set of test to be sure things works properly. No advanced features tested.
- This test depends on all AppArmor profiles being syntactically valid, and does not have useful diagnostics if they are not. If the test_profile_syntax test-case in the apparmor-basic-profiles test fails, please report that failure instead. You can mention this failure in the same bug report, but please do not report it separately.