search

linux-audit / audit-testsuite

A simple, self-contained regression test suite for the Linux Kernel's audit subsystem
GNU General Public License v2.0
21 stars 25 forks source link

tests: add test for exe filter not equal operator #67

Closed WOnder93 closed 5 years ago

WOnder93 commented 6 years ago

...and also make the exec_name test consistent with the new test.

Requires the following kernel patch: https://www.redhat.com/archives/linux-audit/2018-April/msg00021.html

Related kernel GH issue: https://github.com/linux-audit/audit-kernel/issues/53

Signed-off-by: Ondrej Mosnacek \omosnace@redhat.com\

rgbriggs commented 6 years ago

On 2018-04-12 02:56, Ondrej Mosnáček wrote:

...and also make the exec_name test consistent with the new test.

I think I was imagining adding eq and not_eq to the same test rather than duplicating the test, but since the feature was added later, maybe it makes sense to have it as a seperate test.

Of course, testing a negative can be harder than a positive...

WOnder93 commented 6 years ago

I tried to do it like that at first, but I ended up duplicating most of the logic anyway (plus I had to avoid redeclaring the variables) so I decided to split off the neq test into its own file so that the tests are at least kind of symmetrical.

I guess they could be also unified to two calls of some common function (in fact only the audit rule strings are different) but it is my first time coding in Perl so I tried to keep it "simple" :) Maybe I'll look up how to do functions in Perl and simplify it on Monday... it shouldn't really take too much time.

WOnder93 commented 6 years ago

I now merged the tests into one (see the last commit). I think it is now much simpler and easier to follow. If there a are no further objections, I will squash the commits into one and update the commit message so Paul can merge it.

pcmoore commented 6 years ago

Thanks @WOnder93, this looks good to me. I'll merge this soon ...

WOnder93 commented 6 years ago

@pcmoore Ping?

pcmoore commented 6 years ago

Pong @WOnder93.

I haven't forgotten, just busy with other topics. Generally the kernel bits take precedence over the tests for obvious reasons and there have been lots of kernel things happening lately.

pcmoore commented 5 years ago

Merged via 66833270af5f06764498346da8bf82603b6d279f after I fixed some style problems with make check-syntax.