libvirt/tests/file_access_whitelist.txt

# This is a whitelist that allows accesses to files not in our
# build directory nor source directory. The records are in the
# following formats:
#
#  $path: $progname: $testname
#  $path: $action: $progname: $testname
#
# All these variables are evaluated as perl RE. So to allow
# /dev/sda and /dev/sdb, you can just '/dev/sd[a-b]', or to allow
# /proc/$pid/status you can '/proc/\d+/status' and so on.
# Moreover, $action, $progname and $testname can be empty, in which
# which case $path is allowed for all tests. However, $action (if
# specified) must be one of "open", "fopen", "access", "stat",
# "lstat", "connect".

/bin/cat: sysinfotest
/bin/dirname: sysinfotest: x86 sysinfo
/bin/sleep: commandtest
/bin/true: commandtest
/dev/null
/dev/urandom
/etc/hosts
/proc/\d+/status

/etc/passwd: fopen

# This is just a dummy example, DO NOT USE IT LIKE THAT!
.*: nonexistent-test-touching-everything
tests: Introduce check-file-access.pl This script will check output generated by virtestmock against a white list. All non matching records found are printed out. So far, the white list is rather sparse at the moment. This test should be ran only after all other tests finished, and should cleanup the temporary file before their execution. Because I'm unable to reflect these requirements in Makefile.am correctly, I've introduced new target 'check-access' under which this test is available. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> 2016-04-18 17:15:35 +03:00			`# This is a whitelist that allows accesses to files not in our`
			`# build directory nor source directory. The records are in the`
check-file-access: Allow specifying action The check-file-access.pl script is used to match access list generated by virtestmock against whitelisted rules stored in file_access_whitelist.txt. So far the rules are in form: $path: $progname: $testname This is not sufficient because the rule does not take into account 'action' that caused $path to appear in the list of accessed files. After this commit the rule can be in new form: $path: $action: $progname: $testname where $action is one from ("open", "fopen", "access", "stat", "lstat", "connect"). This way the white list can be fine tuned to allow say access() but not connect(). Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: John Ferlan <jferlan@redhat.com> 2018-07-09 11:53:17 +03:00			`# following formats:`
tests: Introduce check-file-access.pl This script will check output generated by virtestmock against a white list. All non matching records found are printed out. So far, the white list is rather sparse at the moment. This test should be ran only after all other tests finished, and should cleanup the temporary file before their execution. Because I'm unable to reflect these requirements in Makefile.am correctly, I've introduced new target 'check-access' under which this test is available. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> 2016-04-18 17:15:35 +03:00			`#`
			`# $path: $progname: $testname`
check-file-access: Allow specifying action The check-file-access.pl script is used to match access list generated by virtestmock against whitelisted rules stored in file_access_whitelist.txt. So far the rules are in form: $path: $progname: $testname This is not sufficient because the rule does not take into account 'action' that caused $path to appear in the list of accessed files. After this commit the rule can be in new form: $path: $action: $progname: $testname where $action is one from ("open", "fopen", "access", "stat", "lstat", "connect"). This way the white list can be fine tuned to allow say access() but not connect(). Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: John Ferlan <jferlan@redhat.com> 2018-07-09 11:53:17 +03:00			`# $path: $action: $progname: $testname`
tests: Introduce check-file-access.pl This script will check output generated by virtestmock against a white list. All non matching records found are printed out. So far, the white list is rather sparse at the moment. This test should be ran only after all other tests finished, and should cleanup the temporary file before their execution. Because I'm unable to reflect these requirements in Makefile.am correctly, I've introduced new target 'check-access' under which this test is available. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> 2016-04-18 17:15:35 +03:00			`#`
check-file-access: Allow specifying action The check-file-access.pl script is used to match access list generated by virtestmock against whitelisted rules stored in file_access_whitelist.txt. So far the rules are in form: $path: $progname: $testname This is not sufficient because the rule does not take into account 'action' that caused $path to appear in the list of accessed files. After this commit the rule can be in new form: $path: $action: $progname: $testname where $action is one from ("open", "fopen", "access", "stat", "lstat", "connect"). This way the white list can be fine tuned to allow say access() but not connect(). Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: John Ferlan <jferlan@redhat.com> 2018-07-09 11:53:17 +03:00			`# All these variables are evaluated as perl RE. So to allow`
			`# /dev/sda and /dev/sdb, you can just '/dev/sd[a-b]', or to allow`
tests: Introduce check-file-access.pl This script will check output generated by virtestmock against a white list. All non matching records found are printed out. So far, the white list is rather sparse at the moment. This test should be ran only after all other tests finished, and should cleanup the temporary file before their execution. Because I'm unable to reflect these requirements in Makefile.am correctly, I've introduced new target 'check-access' under which this test is available. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> 2016-04-18 17:15:35 +03:00			`# /proc/$pid/status you can '/proc/\d+/status' and so on.`
check-file-access: Allow specifying action The check-file-access.pl script is used to match access list generated by virtestmock against whitelisted rules stored in file_access_whitelist.txt. So far the rules are in form: $path: $progname: $testname This is not sufficient because the rule does not take into account 'action' that caused $path to appear in the list of accessed files. After this commit the rule can be in new form: $path: $action: $progname: $testname where $action is one from ("open", "fopen", "access", "stat", "lstat", "connect"). This way the white list can be fine tuned to allow say access() but not connect(). Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: John Ferlan <jferlan@redhat.com> 2018-07-09 11:53:17 +03:00			`# Moreover, $action, $progname and $testname can be empty, in which`
			`# which case $path is allowed for all tests. However, $action (if`
			`# specified) must be one of "open", "fopen", "access", "stat",`
			`# "lstat", "connect".`
tests: Introduce check-file-access.pl This script will check output generated by virtestmock against a white list. All non matching records found are printed out. So far, the white list is rather sparse at the moment. This test should be ran only after all other tests finished, and should cleanup the temporary file before their execution. Because I'm unable to reflect these requirements in Makefile.am correctly, I've introduced new target 'check-access' under which this test is available. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> 2016-04-18 17:15:35 +03:00
			`/bin/cat: sysinfotest`
			`/bin/dirname: sysinfotest: x86 sysinfo`
			`/bin/sleep: commandtest`
			`/bin/true: commandtest`
			`/dev/null`
			`/dev/urandom`
			`/etc/hosts`
			`/proc/\d+/status`

check-file-access: Allow specifying action The check-file-access.pl script is used to match access list generated by virtestmock against whitelisted rules stored in file_access_whitelist.txt. So far the rules are in form: $path: $progname: $testname This is not sufficient because the rule does not take into account 'action' that caused $path to appear in the list of accessed files. After this commit the rule can be in new form: $path: $action: $progname: $testname where $action is one from ("open", "fopen", "access", "stat", "lstat", "connect"). This way the white list can be fine tuned to allow say access() but not connect(). Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: John Ferlan <jferlan@redhat.com> 2018-07-09 11:53:17 +03:00			`/etc/passwd: fopen`

tests: Introduce check-file-access.pl This script will check output generated by virtestmock against a white list. All non matching records found are printed out. So far, the white list is rather sparse at the moment. This test should be ran only after all other tests finished, and should cleanup the temporary file before their execution. Because I'm unable to reflect these requirements in Makefile.am correctly, I've introduced new target 'check-access' under which this test is available. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> 2016-04-18 17:15:35 +03:00			`# This is just a dummy example, DO NOT USE IT LIKE THAT!`
			`.*: nonexistent-test-touching-everything`