Commit 36cb0492 authored by anonym's avatar anonym
Browse files

Directly verify apparmor blocking of the Tor Browser.

... by looking in the audit log. This way we actually know that
apparmor denied the operation, and so we don't get false positives of
some classes of errors (e.g. the file simply has wrong permission or
similar).

Since we migrated to a browser based on Firefox esr38 we no longer get
any graphical feedback for the apparmor blocking, which is the actual
reason for implementing this.
parent c15916aa
......@@ -1047,3 +1047,24 @@ Given /^I wait (?:between (\d+) and )?(\d+) seconds$/ do |min, max|
puts "Slept for #{time} seconds"
sleep(time)
end
When /^AppArmor has (not )?denied "([^"]+)" from opening "([^"]+)"(?: after at most (\d+) seconds)?$/ do |anti_test, profile, file, time|
next if @skip_steps_while_restoring_background
expected_cmd_status = anti_test ? false : true
block = Proc.new do
audit_line = 'apparmor="DENIED" operation="open" profile="' + profile +
'" name="' + file + '"'
cmd = @vm.execute("grep -q '#{audit_line}' /var/log/syslog")
assert_equal(expected_cmd_status, cmd.success?)
true
end
begin
if time
try_for(time.to_i) { block.call }
else
block.call
end
rescue Timeout::Error, Test::Unit::AssertionFailedError => e
raise e, "apparmor has #{anti_test ? "" : "not "}denied the operation"
end
end
......@@ -60,8 +60,10 @@ Feature: Browsing the web using the Tor Browser
And the Tor Browser has started and loaded the startup page
When I open the address "file:///home/amnesia/Tor Browser/synaptic.html" in the Tor Browser
Then I see "TorBrowserSynapticManual.png" after at most 10 seconds
And AppArmor has not denied "/usr/local/lib/tor-browser/firefox" from opening "/home/amnesia/Tor Browser/synaptic.html"
Given AppArmor has not denied "/usr/local/lib/tor-browser/firefox" from opening "/home/amnesia/.gnupg/synaptic.html"
When I open the address "file:///home/amnesia/.gnupg/synaptic.html" in the Tor Browser
Then I see "TorBrowserUnableToOpen.png" after at most 10 seconds
Then AppArmor has denied "/usr/local/lib/tor-browser/firefox" from opening "/home/amnesia/.gnupg/synaptic.html" after at most 10 seconds
Scenario: The "Tails documentation" link on the Desktop works
When I double-click on the "Tails documentation" link on the Desktop
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment