[apparmor] [patch 6/8] parser - use new caching test script

Seth Arnold seth.arnold at canonical.com
Thu Nov 28 02:01:18 UTC 2013


On Wed, Oct 23, 2013 at 06:41:50PM -0700, Steve Beattie wrote:
> This patch:
>  - incorporates the new python caching test into the make check/make
>    caching target, and removes the older shell based test script
>  - adjusts the python scripts to give verbose output when the VERBOSE
>    flag is set
>  - reorders the tests so that the tests that take a shorter amount of
>    time to run come first, leaving the language sanity test with its
>    69000+ testcases last
>  - moves the make dependency for the auto-generation of the sanity tests
>    into the parser_sanity/valgrind targets and out of the main tests target
> 
> Patch history:
>   v1: initial revision
>   v2: add gen_xtrans/gen_dbus dependency to valgrind test
> 
> Acked-by: Steve Beattie <steve at nxnw.org>
> ---
>  parser/tst/Makefile   |   11 +--
>  parser/tst/caching.sh |  173 --------------------------------------------------
>  2 files changed, 6 insertions(+), 178 deletions(-)

I think I'd have liked to see the caching.py added also in this patch, it
seems odd to ACK a patch that removes so much but doesn't put anything
back... slight whinging aside :)

Acked-by: Seth Arnold <seth.arnold at canonical.com>

Thanks!


> 
> Index: b/parser/tst/Makefile
> ===================================================================
> --- a/parser/tst/Makefile
> +++ b/parser/tst/Makefile
> @@ -8,12 +8,13 @@ PROVE_ARG=-f
>  
>  ifeq ($(VERBOSE),1)
>    PROVE_ARG+=-v
> +  PYTEST_ARG = -v
>  endif
>  
>  all: tests
>  
>  .PHONY: tests error_output gen_xtrans parser_sanity caching minimize equality
> -tests: error_output gen_xtrans gen_dbus parser_sanity caching minimize equality
> +tests: error_output caching minimize equality parser_sanity
>  
>  GEN_TRANS_DIRS=simple_tests/generated_x/ simple_tests/generated_perms_leading/ simple_tests/generated_perms_safe/ simple_tests/generated_dbus
>  
> @@ -38,11 +39,11 @@ error_output: $(PARSER)
>  		grep -q "AppArmor parser error for errors/multi_include.sd in errors/multi_include.sd at line 12: Could not open 'failure'"
>  	@echo "Error Output: PASS"
>  
> -parser_sanity: $(PARSER)
> +parser_sanity: $(PARSER) gen_xtrans gen_dbus
>  	$(Q)LANG=C APPARMOR_PARSER="$(PARSER)" ${PROVE} ${PROVE_ARG} ${TESTS}
>  
>  caching: $(PARSER)
> -	LANG=C APPARMOR_PARSER="$(PARSER)" ./caching.sh
> +	LANG=C ./caching.py -p "$(PARSER)" $(PYTEST_ARG)
>  
>  minimize: $(PARSER)
>  	LANG=C APPARMOR_PARSER="$(PARSER)" ./minimize.sh
> @@ -50,8 +51,8 @@ minimize: $(PARSER)
>  equality: $(PARSER)
>  	LANG=C APPARMOR_PARSER="$(PARSER)" ./equality.sh
>  
> -valgrind: $(PARSER)
> -	LANG=C ./valgrind_simple.py -p "$(PARSER)" -v simple_tests
> +valgrind: $(PARSER) gen_xtrans gen_dbus
> +	LANG=C ./valgrind_simple.py -p "$(PARSER)" $(PYTEST_ARG) simple_tests
>  
>  $(PARSER):
>  	make -C $(PARSER_DIR) $(PARSER_BIN)
> Index: b/parser/tst/caching.sh
> ===================================================================
> --- a/parser/tst/caching.sh
> +++ /dev/null
> @@ -1,173 +0,0 @@
> -#!/bin/bash
> -# These tests will stop running as soon as a failure is seen since they tend to build
> -# on the actions and results of the prior tests.
> -set -e
> -
> -# This test requires introspection
> -if [ ! -d /sys/kernel/security/apparmor ]; then
> -    echo "WARNING: /sys/kernel/security/apparmor does not exist. Skipping tests"
> -    echo "requiring introspection."
> -    exit 0
> -fi
> -
> -APPARMOR_PARSER="${APPARMOR_PARSER:-../apparmor_parser}"
> -
> -# fake base directory
> -basedir=$(mktemp -d -t aa-cache-XXXXXX)
> -altcachedir=$(mktemp -d -t aa-alt-cache-XXXXXXXX)
> -trap "rm -rf $basedir $altcachedir" EXIT
> -mkdir -p $basedir/cache
> -
> -ARGS="--base $basedir --skip-kernel-load"
> -
> -profile=sbin.pingy
> -cp caching.profile $basedir/$profile
> -
> -# Detect and slow down cache test when filesystem can't represent nanosecond delays.
> -timeout=0.1
> -_count=10
> -for ((i = 0; i < ${_count} ; i++)) ; do
> -	touch $basedir/test${i}
> -	sleep $timeout
> -done
> -TIMES=$(stat $basedir/test* -c %z | cut -d" " -f2 | cut -d: -f3 | sort -u | wc -l)
> -if [ $TIMES -ne ${_count} ]; then
> -    echo "WARNING: $basedir lacks nanosecond timestamp resolution, falling back to slower test"
> -    timeout=1
> -fi
> -rm -f $basedir/test*
> -
> -echo -n "Profiles are not cached by default: "
> -${APPARMOR_PARSER} $ARGS -q -r $basedir/$profile
> -[ -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile exists)" && exit 1
> -echo "ok"
> -
> -echo -n "Profiles are not cached when using --skip-cache: "
> -${APPARMOR_PARSER} $ARGS -q --write-cache --skip-cache -r $basedir/$profile
> -[ -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile exists)" && exit 1
> -echo "ok"
> -
> -sleep $timeout
> -
> -echo -n "Profiles are cached when requested: "
> -${APPARMOR_PARSER} $ARGS -q --write-cache -r $basedir/$profile
> -[ ! -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile does not exist)" && exit 1
> -echo "ok"
> -
> -read_features_dir()
> -{
> -    directory="$1"
> -    if [ ! -d "$directory" ] ; then
> -	return
> -    fi
> -    for f in `ls -AU "$directory"` ; do
> -	if [ -f "$directory/$f" ] ; then
> -	    read -r -d "" KF < "$directory/$f" || true
> -	    echo -e "$f {$KF\n}"
> -	elif [ -d "$directory/$f" ] ; then
> -	    echo -n "$f {"
> -	    KF=`read_features_dir "$directory/$f" "$KF"` || true
> -	    echo "$KF"
> -	    echo -e "}"
> -	fi
> -    done
> -}
> -
> -echo -n "Kernel features are written to cache: "
> -[ ! -f $basedir/cache/.features ] && echo "FAIL ($basedir/cache/.features missing)" && exit 1
> -read -r -d "" CF < $basedir/cache/.features || true
> -if [ -d /sys/kernel/security/apparmor/features ] ; then
> -    KF=`read_features_dir /sys/kernel/security/apparmor/features`
> -else
> -    read -r -d "" KF < /sys/kernel/security/apparmor/features || true
> -fi
> -[ "$CF" != "$KF" ] && echo -e "FAIL (feature text mismatch:\n  cache '$CF'\nvs\n  kernel '$KF')" && exit 1
> -echo "ok"
> -
> -echo -n "Cache is loaded when it exists and features match: "
> -${APPARMOR_PARSER} $ARGS -v -r $basedir/$profile | grep -q 'Cached reload succeeded' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> -echo -n "Cache is not loaded when skipping is requested: "
> -${APPARMOR_PARSER} $ARGS -v --skip-read-cache -r $basedir/$profile | grep -q 'Replacement succeeded for' || { echo "FAIL"; exit 1; }
> -${APPARMOR_PARSER} $ARGS -v --skip-cache -r $basedir/$profile | grep -q 'Replacement succeeded for' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> -echo -n "Cache reading is skipped when features do not match cache: "
> -echo -n "monkey" > $basedir/cache/.features
> -${APPARMOR_PARSER} $ARGS -v -r $basedir/$profile | grep -q 'Replacement succeeded for' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> -echo -n "Cache writing is skipped when features do not match and not cleared: "
> -rm $basedir/cache/$profile
> -${APPARMOR_PARSER} $ARGS -v --write-cache --skip-bad-cache -r $basedir/$profile | grep -q 'Replacement succeeded for' || { echo "FAIL"; exit 1; }
> -[ -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile exists)" && exit 1
> -echo "ok"
> -
> -rm -f $basedir/cache/.features || true
> -rm -f $basedir/cache/$profile || true
> -echo -n "monkey" > $basedir/cache/.features
> -echo -n "monkey" > $basedir/cache/$profile
> -echo -n "monkey" > $basedir/cache/monkey
> -${APPARMOR_PARSER} $ARGS -v --write-cache -r $basedir/$profile | grep -q 'Replacement succeeded for' || { echo "Cache clear setup FAIL"; exit 1; }
> -echo -n "Cache clear updates features: "
> -echo -n "monkey" | diff -q $basedir/cache/.features - | grep -q 'differ' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -echo -n "Cache clear writes updated profile: "
> -echo -n "monkey" | diff -q $basedir/cache/$profile - | grep -q 'differ' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -echo -n "Cache clear cleans out all files: "
> -[ -f $basedir/cache/monkey ] && { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> -rm -f $basedir/cache/monkey
> -rm -f $basedir/cache/.features || true
> -rm -f $basedir/cache/$profile || true
> -echo -n "monkey" > $basedir/cache/.features
> -echo -n "monkey" > $basedir/cache/$profile
> -echo -n "monkey" > $basedir/cache/monkey
> -echo -n "Cache purge remove profiles unconditionally: "
> -${APPARMOR_PARSER} $ARGS -v --purge-cache -r $basedir/$profile || { echo "Cache purge setup FAIL"; exit 1; }
> -[ -f $basedir/cache/.features ] && { echo "FAIL"; exit 1; }
> -[ -f $basedir/cache/$profile ] && { echo "FAIL"; exit 1; }
> -[ -f $basedir/cache/monkey ] && { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> -echo -n "Profiles are cached when requested (again): "
> -rm -f $basedir/cache/.features || true
> -rm -f $basedir/cache/$profile || true
> -${APPARMOR_PARSER} $ARGS -q --write-cache -r $basedir/$profile
> -[ ! -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile does not exist)" && exit 1
> -echo "ok"
> -
> -echo -n "Cache reading is skipped when profile is newer: "
> -sleep $timeout
> -touch $basedir/$profile
> -${APPARMOR_PARSER} $ARGS -v -r $basedir/$profile | grep -q 'Replacement succeeded for' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> -echo -n "Cache is used when cache is newer: "
> -sleep $timeout
> -touch $basedir/cache/$profile
> -${APPARMOR_PARSER} $ARGS -v -r $basedir/$profile | grep -q 'Cached reload succeeded' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> -echo -n "Cache reading is skipped when parser is newer: "
> -mkdir $basedir/parser
> -cp ${APPARMOR_PARSER} $basedir/parser/
> -$basedir/parser/apparmor_parser $ARGS -v -r $basedir/$profile | grep -q 'Replacement succeeded for' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> -echo -n "Cache reading is skipped when parser in \$PATH is newer: "
> -(PATH=$basedir/parser/ /bin/sh -c "apparmor_parser $ARGS -v -r $basedir/$profile") | grep -q 'Replacement succeeded for' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> -echo -n "Profiles are cached in alternate location when requested: "
> -${APPARMOR_PARSER} $ARGS -q --write-cache --cache-loc $altcachedir -r $basedir/$profile
> -[ ! -f $altcachedir/$profile ] && echo "FAIL ($altcachedir/$profile does not exist)" && exit 1
> -echo "ok"
> -
> -echo -n "Cache is loaded from alt location when it exists and features match: "
> -${APPARMOR_PARSER} $ARGS -v -r $basedir/$profile --cache-loc $altcachedir | grep -q 'Cached reload succeeded' || { echo "FAIL"; exit 1; }
> -echo "ok"
> -
> 
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20131127/99f97e66/attachment-0001.pgp>


More information about the AppArmor mailing list