RFE: add filter_saddr_fam test

[rgbriggs]

Signed-off-by: Richard Guy Briggs rgb@redhat.com

[rgbriggs]

Sorry, added the AF_MAX check and formatting bit me. I'm done with the forced pushes for now.

[pcmoore]

I see the following failures when I run this:

# uname -a
secnext.fc32.x86_64 #1 SMP Tue Dec 10 19:29:35 EST 2019 x86_64 x86_64 x86_64 GNU/Linux

Running as   user    root
        with context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
        on   system  Fedora

exec_execve/test ......... ok   
exec_name/test ........... ok     
file_create/test ......... ok   
file_delete/test ......... ok   
file_rename/test ......... ok   
filter_exclude/test ...... ok     
filter_saddr_fam/test .... 1/5 Use of uninitialized value $1 in string eq at filter_saddr_fam/test line 117, <$fh> line 12.
# Test 4 got: "0" (filter_saddr_fam/test at line 127)
#   Expected: "1"
#  filter_saddr_fam/test line 127 is: ok( $found_msg,    1 );     # Was the inet message found?
# Test 5 got: <UNDEF> (filter_saddr_fam/test at line 128)
#   Expected: ""
#  filter_saddr_fam/test line 128 is: ok( $found_unfilt, "" );    # Were non-inet messages filtered?
filter_saddr_fam/test .... Failed 2/5 subtests 
filter_sessionid/test .... ok   
login_tty/test ........... ok   
lost_reset/test .......... ok   
netfilter_pkt/test ....... ok     
syscalls_file/test ....... ok   
syscall_module/test ...... ok   
syscall_socketcall/test .. ok   
user_msg/test ............ ok   

Test Summary Report
-------------------
filter_saddr_fam/test  (Wstat: 0 Tests: 5 Failed: 2)
  Failed tests:  4-5
Files=15, Tests=109, 16 wallclock secs ( 0.07 usr  0.04 sys +  6.21 cusr  2.44 csys =  8.76 CPU)
Result: FAIL
Failed 1/15 test programs. 2/109 subtests failed.

1..5
# Running under perl version 5.030001 for linux
# Current time local: Thu Dec 12 13:29:25 2019
# Current time GMT:   Thu Dec 12 18:29:25 2019
# Using Test.pm version 1.31
ok 1
not ok 2
# Test 2 got: "65280" (./test at line 59)
#   Expected: "0"
#  ./test line 59 is: ok( $result, 0 );
not ok 3
# Test 3 got: "256" (./test at line 86)
#   Expected: "0"
#  ./test line 86 is: ok( $result, 0 );    # Was an event found?
not ok 4
# Test 4 got: "0" (./test at line 127)
#   Expected: "1"
#  ./test line 127 is: ok( $found_msg,    1 );     # Was the inet message found?
ok 5
Stopping logging:                                          [  OK  ]
Redirecting start to /bin/systemctl start auditd.service

I'm assuming this was working for you @rgbriggs, right? I just wanted to check before I dig into these failures.

[rgbriggs]

On 2019-12-12 10:31, Paul Moore wrote: I see the following failures when I run this: filter_saddr_fam/test .... 1/5 Use of uninitialized value $1 in string eq at filter_saddr_fam/test line 117, <$fh> line 12. # Test 4 got: "0" (filter_saddr_fam/test at line 127) # Expected: "1" # filter_saddr_fam/test line 127 is: ok( $found_msg, 1 ); # Was the inet message found? # Test 5 got: <UNDEF> (filter_saddr_fam/test at line 128) # Expected: "" # filter_saddr_fam/test line 128 is: ok( $found_unfilt, "" ); # Were non-inet messages filtered? filter_saddr_fam/test .... Failed 2/5 subtests filter_saddr_fam/test (Wstat: 0 Tests: 5 Failed: 2) Failed tests: 4-5

...

ok 1 not ok 2 # Test 2 got: "65280" (./test at line 59) # Expected: "0" # ./test line 59 is: ok( $result, 0 ); not ok 3 # Test 3 got: "256" (./test at line 86) # Expected: "0" # ./test line 86 is: ok( $result, 0 ); # Was an event found? not ok 4 # Test 4 got: "0" (./test at line 127) # Expected: "1" # ./test line 127 is: ok( $found_msg, 1 ); # Was the inet message found? ok 5 I'm assuming this was working for you @rgbriggs, right? I just wanted to check before I dig into these failures.

It was, but omoris caught something in here: linux-audit/audit-kernel#64 (comment) The search term should be changed from: / fam=([a-z]+) / to / saddr_fam=([a-z]+) / For some reason, I thought Ondrej had updated that test. I've just updated it and pushed a fixed copy: rgbriggs@678d7d4 Sorry to slow you down!

[pcmoore]

Merged via 73342b7, although I had to fix a style error caught by Travis and ./tools/check-syntax.

[rgbriggs]

On 2019-12-12 11:13, Richard Guy Briggs wrote: For some reason, I thought Ondrej had updated that test. I've just updated it and pushed a fixed copy: rgbriggs@678d7d4

...and travis says that's broken, so here's an update: rgbriggs@8762d2b