#!/usr/bin/python3
# ----------------------------------------------------------------------
#    Copyright (C) 2015 Christian Boltz <apparmor@cboltz.de>
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License as published by the Free Software Foundation.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
# ----------------------------------------------------------------------

import unittest
from collections import namedtuple

import apparmor.severity as severity
from apparmor.common import AppArmorBug, AppArmorException, hasher
from apparmor.logparser import ReadLog
from apparmor.rule.file import FileRule, FileRuleset
from apparmor.translations import init_translation
from common_test import AATest, setup_all_loops

_ = init_translation()

exp = namedtuple(
    'exp', ('audit', 'allow_keyword', 'deny', 'comment', 'path', 'all_paths',
            'perms', 'all_perms', 'exec_perms', 'target', 'all_targets',
            'owner', 'file_keyword', 'leading_perms'))


# --- tests for single FileRule --- #

class FileTest(AATest):
    def _compare_obj(self, obj, expected):
        self.assertEqual(obj.allow_keyword, expected.allow_keyword)
        self.assertEqual(obj.audit, expected.audit)
        self.assertEqual(obj.deny, expected.deny)
        self.assertEqual(obj.comment, expected.comment)

        self._assertEqual_aare(obj.path, expected.path)
        self.assertEqual(obj.perms, expected.perms)
        self.assertEqual(obj.exec_perms, expected.exec_perms)
        self._assertEqual_aare(obj.target, expected.target)
        self.assertEqual(obj.owner, expected.owner)
        self.assertEqual(obj.file_keyword, expected.file_keyword)
        self.assertEqual(obj.leading_perms, expected.leading_perms)

        # Note: there's no all_ field for exec_perms, owner, file_keyword and leading_perms
        self.assertEqual(obj.all_paths, expected.all_paths)
        self.assertEqual(obj.all_perms, expected.all_perms)
        self.assertEqual(obj.all_targets, expected.all_targets)

    def _assertEqual_aare(self, obj, expected):
        if obj:
            self.assertEqual(obj.regex, expected)
        else:
            self.assertEqual(obj, expected)


class FileTestParse(FileTest):
    tests = (
        # FileRule object                    audit  allow  deny   comment   path               all_paths  perms               all?   exec_perms  target  all?   owner  file keyword  leading perms

        # bare file rules
        ('file,',                        exp(False, False, False, '',       None,              True,      None,               True,  None,       None,   True,  False, False,        False)),
        ('allow file,',                  exp(False, True,  False, '',       None,              True,      None,               True,  None,       None,   True,  False, False,        False)),
        ('audit deny owner file, # cmt', exp(True,  False, True,  ' # cmt', None,              True,      None,               True,  None,       None,   True,  True,  False,        False)),

        # "normal" file rules
        ('/foo r,',                      exp(False, False, False, '',       '/foo',            False,     {'r'},              False, None,       None,   True,  False, False,        False)),
        ('file /foo rwix,',              exp(False, False, False, '',       '/foo',            False,     {'r', 'w'},         False, 'ix',       None,   True,  False, True,         False)),
        ('/foo Px -> bar,',              exp(False, False, False, '',       '/foo',            False,     set(),              False, 'Px',       'bar',  False, False, False,        False)),
        ('@{PROC}/[a-z]** mr,',          exp(False, False, False, '',       '@{PROC}/[a-z]**', False,     {'r', 'm'},         False, None,       None,   True,  False, False,        False)),

        ('audit /tmp/foo r,',            exp(True,  False, False, '',       '/tmp/foo',        False,     {'r'},              False, None,       None,   True,  False, False,        False)),
        ('audit deny /tmp/foo r,',       exp(True,  False, True,  '',       '/tmp/foo',        False,     {'r'},              False, None,       None,   True,  False, False,        False)),
        ('audit deny /tmp/foo rx,',      exp(True,  False, True,  '',       '/tmp/foo',        False,     {'r'},              False, 'x',        None,   True,  False, False,        False)),
        ('allow /tmp/foo ra,',           exp(False, True,  False, '',       '/tmp/foo',        False,     {'r', 'a'},         False, None,       None,   True,  False, False,        False)),
        ('audit allow /tmp/foo ra,',     exp(True,  True,  False, '',       '/tmp/foo',        False,     {'r', 'a'},         False, None,       None,   True,  False, False,        False)),


        # file rules with leading permission
        ('r /foo,',                      exp(False, False, False, '',       '/foo',            False,     {'r'},              False, None,       None,   True,  False, False,        True)),
        ('file rwix /foo,',              exp(False, False, False, '',       '/foo',            False,     {'r', 'w'},         False, 'ix',       None,   True,  False, True,         True)),
        ('Px /foo -> bar,',              exp(False, False, False, '',       '/foo',            False,     set(),              False, 'Px',       'bar',  False, False, False,        True)),
        ('mr @{PROC}/[a-z]**,',          exp(False, False, False, '',       '@{PROC}/[a-z]**', False,     {'r', 'm'},         False, None,       None,   True,  False, False,        True)),

        ('audit r /tmp/foo,',            exp(True,  False, False, '',       '/tmp/foo',        False,     {'r'},              False, None,       None,   True,  False, False,        True)),
        ('audit deny r /tmp/foo,',       exp(True,  False, True,  '',       '/tmp/foo',        False,     {'r'},              False, None,       None,   True,  False, False,        True)),
        ('allow ra /tmp/foo,',           exp(False, True,  False, '',       '/tmp/foo',        False,     {'r', 'a'},         False, None,       None,   True,  False, False,        True)),
        ('audit allow ra /tmp/foo,',     exp(True,  True,  False, '',       '/tmp/foo',        False,     {'r', 'a'},         False, None,       None,   True,  False, False,        True)),

        # duplicated (but not conflicting) permissions
        ('/foo PxPxPxPxrwPx -> bar,',    exp(False, False, False, '',       '/foo',            False,     {'r', 'w'},         False, 'Px',       'bar',  False, False, False,        False)),
        ('/foo CixCixrwCix -> bar, ',    exp(False, False, False, '',       '/foo',            False,     {'r', 'w'},         False, 'Cix',      'bar',  False, False, False,        False)),

        # link rules
        ('link /foo -> /bar,',           exp(False, False, False, '',       '/foo',            False,     {'link'},           False, None,       '/bar', False, False, False,        True)),
        ('link subset /foo -> /bar,',    exp(False, False, False, '',       '/foo',            False,     {'link', 'subset'}, False, None,       '/bar', False, False, False,        True)),
    )

    def _run_test(self, rawrule, expected):
        self.assertTrue(FileRule.match(rawrule))
        obj = FileRule.create_instance(rawrule)
        self.assertEqual(rawrule.strip(), obj.raw_rule)
        self._compare_obj(obj, expected)


class FileTestParseInvalid(FileTest):
    tests = (
        ('/foo x,',       AppArmorException),  # should be *x
        ('/foo raw,',     AppArmorException),  # r and a conflict
        ('deny /foo ix,', AppArmorException),  # endy only allows x, but not *x
        ('deny /foo Px,', AppArmorException),  # deny only allows x, but not *x
        ('deny /foo Pi,', AppArmorException),  # missing 'x', and P not allowed
        ('allow /foo x,', AppArmorException),  # should be *x
        ('/foo Pxrix,',   AppArmorException),  # exec mode conflict
        ('/foo PixUx,',   AppArmorException),  # exec mode conflict
        ('/foo PxUx,',    AppArmorException),  # exec mode conflict
        ('/foo PUxPix,',  AppArmorException),  # exec mode conflict
        ('/foo Pi,',      AppArmorException),  # missing 'x'
    )

    def _run_test(self, rawrule, expected):
        self.assertTrue(FileRule.match(rawrule))  # the above invalid rules still match the main regex!
        with self.assertRaises(expected):
            FileRule.create_instance(rawrule)


class FileTestNonMatch(AATest):
    tests = (
        ('file /foo,',        False),
        ('file rw,',          False),
        ('file -> bar,',      False),
        ('file Px -> bar,',   False),
        ('/foo bar,',         False),
        ('dbus /foo,',        False),
        ('link /foo,',        False),  # missing '-> /target'
        ('link -> /bar,',     False),  # missing path
        ('/foo -> bar link,', False),  # link has to be leading keyword
        ('link,',             False),  # link isn't available as bare keyword
    )

    def _run_test(self, rawrule, expected):
        self.assertFalse(FileRule.match(rawrule))


class FileTestParseFromLog(FileTest):
    def test_file_from_log(self):
        parser = ReadLog('', '', '')
        event = 'Nov 11 07:33:07 myhost kernel: [50812.879558] type=1502 audit(1236774787.169:369): operation="inode_permission" requested_mask="::r" denied_mask="::r" fsuid=1000 name="/bin/dash" pid=13726 profile="/bin/foobar"'

        parsed_event = parser.parse_event(event)

        self.assertEqual(parsed_event, {
            'request_mask': '::r',
            'denied_mask': '::r',
            'error_code': 0,
            'magic_token': 0,
            'parent': 0,
            'profile': '/bin/foobar',
            'operation': 'inode_permission',
            'name': '/bin/dash',
            'name2': None,
            'resource': None,
            'info': None,
            'aamode': 'PERMITTING',
            'time': 1236774787,
            'active_hat': None,
            'pid': 13726,
            'task': 0,
            'attr': None,
            'family': None,
            'protocol': None,
            'sock_type': None,
            'class': None,
        })

        #     FileRule path,                 perms,                         exec_perms, target,       owner, file_keyword, leading_perms
        # obj = FileRule(parsed_event['name'], parsed_event['denied_mask'],   None,       FileRule.ALL, False, False,        False,)
        obj = FileRule(parsed_event['name'], 'r',                           None,       FileRule.ALL, False, False,        False,)
        # XXX handle things like '::r'
        # XXX split off exec perms?

        #              audit  allow  deny   comment  path          all_paths  perms  all?   exec_perms  target  all?   owner  file keyword  leading perms
        expected = exp(False, False, False, '',      '/bin/dash',  False,     {'r'}, False, None,       None,   True,  False, False,        False)

        self._compare_obj(obj, expected)

        self.assertEqual(obj.get_raw(1), '  /bin/dash r,')


# TODO: add logparser example for link event

class FileFromInit(FileTest):
    tests = (

        #         path,    perms, exec_perms, target,       owner, file_keyword, leading_perms
        (FileRule('/foo', 'rw',   None,       FileRule.ALL, False, False,        False,       audit=True, deny=True),
         #   audit  allow   deny  comment  path   all_paths perms       all?   exec_perms target all?  owner  file keyword  leading perms
         exp(True,  False, True, '',     '/foo', False,    {'r', 'w'}, False, None,      None,  True, False, False,        False)),

        #         path,   perms, exec_perms, target,     owner, file_keyword, leading_perms
        (FileRule('/foo', None,  'Pix',      'bar_prof', True,  True,         True,        allow_keyword=True),
         #   audit  allow  deny   comment  path     all_paths  perms  all?   exec_perms  target      all?   owner  file keyword  leading perms
         exp(False, True,  False, '',      '/foo',  False,     set(), False, 'Pix',      'bar_prof', False, True,  True,         True)),

        #         path,   perms,              exec_perms, target, owner, file_keyword, leading_perms
        (FileRule('/foo', {'link', 'subset'}, None,       '/bar', False, False,        True,        audit=True, deny=True),
         #   audit  allow  deny  comment  path    all_paths  perms               all?   exec_perms  target  all?   owner  file keyword leading perms
         exp(True,  False, True, '',      '/foo', False,     {'link', 'subset'}, False, None,       '/bar', False, False, False,       True)),

    )

    def _run_test(self, obj, expected):
        self._compare_obj(obj, expected)


class InvalidFileInit(AATest):
    tests = (
        #       path,         perms,              exec_perms, target, owner,  file_keyword, leading_perms  expected exception

        # empty fields
        (      ('',           'rw',               'ix',       '/bar', False,  False,        False),        AppArmorBug),  # noqa: E201
        #  OK  ('/foo',       '',                 'ix',       '/bar', False,  False,        False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               '',         '/bar', False,  False,        False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       '',     False,  False,        False),        AppArmorBug),  # noqa: E201

        # whitespace fields
        (      ('   ',        'rw',               'ix',       '/bar', False,  False,        False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       '   ',              'ix',       '/bar', False,  False,        False),        AppArmorException),  # noqa: E201
        (      ('/foo',       'rw',               '   ',      '/bar', False,  False,        False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       '   ',  False,  False,        False),        AppArmorBug),  # noqa: E201

        # wrong type - dict()
        (      (dict(),       'rw',               'ix',       '/bar', False,  False,        False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       dict(),             'ix',       '/bar', False,  False,        False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               dict(),     '/bar', False,  False,        False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       dict(), False,  False,        False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       '/bar', dict(), False,        False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       '/bar', False,  dict(),       False),        AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       '/bar', False,  False,        dict()),       AppArmorBug),  # noqa: E201


        # wrong type - None
        (      (None,         'rw',               'ix',       '/bar', False,  False,        False),         AppArmorBug),  # noqa: E201
        #  OK  ('/foo',       None,               'ix',       '/bar', False,  False,        False),         AppArmorBug),  # noqa: E201
        #  OK  ('/foo',       'rw',               None,       '/bar', False,  False,        False),         AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       None,   False,  False,        False),         AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       '/bar', None,   False,        False),         AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       '/bar', False,  None,         False),         AppArmorBug),  # noqa: E201
        (      ('/foo',       'rw',               'ix',       '/bar', False,  False,        None),          AppArmorBug),  # noqa: E201


        # misc
        (      ('/foo',       'rwa',              'ix',       '/bar', False,  False,        False),        AppArmorException),  # 'r' and 'a' conflict  # noqa: E201
        (      ('/foo',       None,               'rw',       '/bar', False,  False,        False),        AppArmorBug),        # file perms in exec perms parameter  # noqa: E201
        (      ('/foo',       'ix',               None,       '/bar', False,  False,        False),        AppArmorBug),        # exec perms in file perms parameter  # noqa: E201
        (      ('foo',        'rw',               'ix',       '/bar', False,  False,        False),        AppArmorException),  # path doesn't start with /  # noqa: E201
        (      ('/foo',       'rb',               'ix',       '/bar', False,  False,        False),        AppArmorException),  # invalid file mode 'b' (str)  # noqa: E201
        (      ('/foo',       {'b'},              'ix',       '/bar', False,  False,        False),        AppArmorBug),        # invalid file mode 'b' (str)  # noqa: E201
        (      ('/foo',       'rw',               'ax',       '/bar', False,  False,        False),        AppArmorBug),        # invalid exec mode 'ax'  # noqa: E201
        (      ('/foo',       'rw',               'x',        '/bar', False,  False,        False),        AppArmorException),  # plain 'x' is only allowed in deny rules  # noqa: E201
        (      (FileRule.ALL, FileRule.ALL,       None,       '/bar', False,  False,        False),        AppArmorBug),        # plain 'file,' doesn't allow exec target  # noqa: E201

        # link rules
        (      (None,         {'link'},           None,       None,   False,  False,        False),        AppArmorBug),        # missing path and target  # noqa: E201
        (      ('/foo',       {'link'},           None,       None,   False,  False,        False),        AppArmorBug),        # missing target  # noqa: E201
        (      ( None,        {'link'},           None,       '/bar', False,  False,        False),        AppArmorBug),        # missing path  # noqa: E201
        (      ('/foo',       {'subset'},         None,       '/bar', False,  False,        False),        AppArmorBug),        # subset without link  # noqa: E201
        (      ('/foo',       {'link'},           'ix',       '/bar', False,  False,        False),        AppArmorBug),        # link rule with exec perms  # noqa: E201
        (      ('/foo',       {'link', 'subset'}, 'ix',       '/bar', False,  False,        False),        AppArmorBug),        # link subset rule with exec perms  # noqa: E201
    )

    def _run_test(self, params, expected):
        with self.assertRaises(expected):
            FileRule(*params)

    def test_missing_params_1(self):
        with self.assertRaises(TypeError):
            FileRule('/foo')

    def test_missing_params_2(self):
        with self.assertRaises(TypeError):
            FileRule('/foo', 'rw')

    def test_missing_params_3(self):
        with self.assertRaises(TypeError):
            FileRule('/foo', 'rw', 'ix')

    def test_missing_params_4(self):
        with self.assertRaises(TypeError):
            FileRule('/foo', 'rw', 'ix', '/bar')

    def test_deny_ix(self):
        with self.assertRaises(AppArmorException):
            FileRule('/foo', 'rw', 'ix', '/bar', False, False, False, deny=True)


class InvalidFileTest(AATest):
    def _check_invalid_rawrule(self, rawrule):
        obj = None
        self.assertFalse(FileRule.match(rawrule))
        with self.assertRaises(AppArmorException):
            obj = FileRule.create_instance(rawrule)

        self.assertIsNone(obj, 'FileRule handed back an object unexpectedly')

    def test_invalid_file_missing_comma_1(self):
        self._check_invalid_rawrule('file')  # missing comma

    def test_invalid_non_FileRule(self):
        self._check_invalid_rawrule('signal,')  # not a file rule


class BrokenFileTest(AATest):
    def AASetup(self):
        #                   path,   perms, exec_perms, target, owner, file_keyword, leading_perms
        self.obj = FileRule('/foo', 'rw',  'ix',       '/bar', False, False,        False)

    def test_empty_data_1(self):
        self.obj.path = ''
        # no path set, and ALL not set
        with self.assertRaises(AppArmorBug):
            self.obj.get_clean(1)

    def test_empty_data_2(self):
        self.obj.perms = ''
        self.obj.exec_perms = ''
        # no perms or exec_perms set, and ALL not set
        with self.assertRaises(AppArmorBug):
            self.obj.get_clean(1)

    def test_empty_data_3(self):
        self.obj.target = ''
        # no target set, and ALL not set
        with self.assertRaises(AppArmorBug):
            self.obj.get_clean(1)

    def test_unexpected_all_1(self):
        self.obj.all_paths = FileRule.ALL
        # all_paths and all_perms must be in sync
        with self.assertRaises(AppArmorBug):
            self.obj.get_clean(1)

    def test_unexpected_all_2(self):
        self.obj.all_perms = FileRule.ALL
        # all_paths and all_perms must be in sync
        with self.assertRaises(AppArmorBug):
            self.obj.get_clean(1)


class FileGlobTest(AATest):
    def _run_test(self, params, expected):
        exp_can_glob, exp_can_glob_ext, exp_rule_glob, exp_rule_glob_ext = expected

        # test glob()
        rule_obj = FileRule.create_instance(params)
        self.assertEqual(exp_can_glob, rule_obj.can_glob)
        self.assertEqual(exp_can_glob_ext, rule_obj.can_glob_ext)

        rule_obj.glob()
        self.assertEqual(rule_obj.get_clean(), exp_rule_glob)

        # test glob_ext()
        rule_obj = FileRule.create_instance(params)
        self.assertEqual(exp_can_glob, rule_obj.can_glob)
        self.assertEqual(exp_can_glob_ext, rule_obj.can_glob_ext)

        rule_obj.glob_ext()
        self.assertEqual(rule_obj.get_clean(), exp_rule_glob_ext)

    # These tests are meant to ensure AARE integration in FileRule works as expected.
    # test-aare.py has more comprehensive globbing tests.
    tests = (
        # rule               can glob  can glob_ext  globbed rule        globbed_ext rule
        ('/foo/bar r,',      (True,    True,         '/foo/* r,',        '/foo/bar r,')),
        ('/foo/* r,',        (True,    True,         '/** r,',           '/foo/* r,')),
        ('/foo/bar.xy r,',   (True,    True,         '/foo/* r,',        '/foo/*.xy r,')),
        ('/foo/*.xy r,',     (True,    True,         '/foo/* r,',        '/**.xy r,')),
        ('file,',            (False,   False,        'file,',            'file,')),  # bare 'file,' rules can't be globbed
        ('link /a/b -> /c,', (True,    True,         'link /a/* -> /c,', 'link /a/b -> /c,')),
    )


class WriteFileTest(AATest):
    def _run_test(self, rawrule, expected):
        self.assertTrue(FileRule.match(rawrule), 'FileRule.match() failed')
        obj = FileRule.create_instance(rawrule)
        clean = obj.get_clean()
        raw = obj.get_raw()

        self.assertEqual(expected.strip(), clean, 'unexpected clean rule')
        self.assertEqual(rawrule.strip(), raw, 'unexpected raw rule')

    tests = (
        #  raw rule                                      clean rule
        ('file,',                                        'file,'),
        ('              file        ,  # foo        ',   'file, # foo'),
        ('    audit     file /foo r,',                   'audit file /foo r,'),
        ('    audit     file /foo  lwr,',                'audit file /foo rwl,'),
        ('    audit     file /foo Pxrm -> bar,',         'audit file /foo mrPx -> bar,'),
        ('    deny      file /foo r,',                   'deny file /foo r,'),
        ('    deny      file /foo  wr,',                 'deny file /foo rw,'),
        ('    allow     file /foo Pxrm -> bar,',         'allow file /foo mrPx -> bar,'),
        ('   deny owner file /foo r,',                   'deny owner file /foo r,'),
        ('   deny owner file /foo  wr,',                 'deny owner file /foo rw,'),
        ('  allow owner file /foo Pxrm -> bar,',         'allow owner file /foo mrPx -> bar,'),
        ('    deny    owner  /foo r,',                   'deny owner /foo r,'),
        ('    deny    owner  /foo  wr,',                 'deny owner /foo rw,'),
        ('    allow   owner  /foo Pxrm -> bar,',         'allow owner /foo mrPx -> bar,'),
        ('                   /foo r,',                   '/foo r,'),
        ('                   /foo  lwr,',                '/foo rwl,'),
        ('                   /foo Pxrm -> bar,',         '/foo mrPx -> bar,'),
        ('  priority=-1      /foo Pxrm -> bar,',         'priority=-1 /foo mrPx -> bar,'),
        ('  priority=0       /foo Pxrm -> bar,',         'priority=0 /foo mrPx -> bar,'),
        ('  priority=343     /foo Pxrm -> bar,',         'priority=343 /foo mrPx -> bar,'),
        ('  priority=+65     /foo Pxrm -> bar,',         'priority=65 /foo mrPx -> bar,'),

        # with leading permissions
        ('    audit     file r      /foo,',              'audit file r /foo,'),
        ('    audit     file lwr    /foo,',              'audit file rwl /foo,'),
        ('    audit     file Pxrm   /foo -> bar,',       'audit file mrPx /foo -> bar,'),
        ('    deny      file r      /foo,',              'deny file r /foo,'),
        ('    deny      file wr     /foo  ,',            'deny file rw /foo,'),
        ('    allow     file Pxmr   /foo -> bar,',       'allow file mrPx /foo -> bar,'),
        ('   deny owner file r      /foo ,',             'deny owner file r /foo,'),
        ('   deny owner file wr     /foo  ,',            'deny owner file rw /foo,'),
        ('  allow owner file Pxrm   /foo -> bar,',       'allow owner file mrPx /foo -> bar,'),
        ('    deny    owner  r      /foo ,',             'deny owner r /foo,'),
        ('    deny    owner  wr     /foo  ,',            'deny owner rw /foo,'),
        ('    allow   owner  Pxrm   /foo -> bar,',       'allow owner mrPx /foo -> bar,'),
        ('                   r      /foo ,',             'r /foo,'),
        ('                   klwr   /foo  ,',            'rwlk /foo,'),
        ('                   Pxrm   /foo -> bar,',       'mrPx /foo -> bar,'),
        ('    priority=1     Pxrm   /foo -> bar,',       'priority=1 mrPx /foo -> bar,'),
        ('    priority=0     Pxrm   /foo -> bar,',       'priority=0 mrPx /foo -> bar,'),
        ('    priority=-22   Pxrm   /foo -> bar,',       'priority=-22 mrPx /foo -> bar,'),
        ('    priority=+78   Pxrm   /foo -> bar,',       'priority=78 mrPx /foo -> bar,'),

        # link rules
        ('  link    /foo    ->  /bar,',                  'link /foo -> /bar,'),
        ('  audit deny owner link subset /foo -> /bar,', 'audit deny owner link subset /foo -> /bar,'),
        ('                   link subset /foo -> /bar,', 'link subset /foo -> /bar,'),
        ('  priority=0  link    /foo    ->  /bar,',       'priority=0 link /foo -> /bar,'),
        ('  priority=12 link    /foo    ->  /bar,',       'priority=12 link /foo -> /bar,'),
        ('  priority=-1 link    /foo    ->  /bar,',       'priority=-1 link /foo -> /bar,'),
        ('  priority=+4 link    /foo    ->  /bar,',       'priority=4 link /foo -> /bar,'),
    )

    def test_write_manually_1(self):
        #              path,   perms, exec_perms, target, owner, file_keyword, leading_perms
        obj = FileRule('/foo', 'rw',  'Px',       '/bar', False, True,         False,       allow_keyword=True)

        expected = '    allow file /foo rwPx -> /bar,'

        self.assertEqual(expected, obj.get_clean(2), 'unexpected clean rule')
        self.assertEqual(expected, obj.get_raw(2), 'unexpected raw rule')

    def test_write_manually_2(self):
        #              path,   perms, exec_perms, target,       owner, file_keyword, leading_perms
        obj = FileRule('/foo', 'rw',  'x',        FileRule.ALL, True,  False,        True,        deny=True)

        expected = '    deny owner rwx /foo,'

        self.assertEqual(expected, obj.get_clean(2), 'unexpected clean rule')
        self.assertEqual(expected, obj.get_raw(2), 'unexpected raw rule')

    def test_write_any_exec(self):
        obj = FileRule('/foo', 'rw', FileRule.ANY_EXEC, '/bar', False, False, False)
        with self.assertRaises(AppArmorBug):
            obj.get_clean()


class FileCoveredTest(AATest):
    def _run_test(self, param, expected):
        obj = FileRule.create_instance(self.rule)
        check_obj = FileRule.create_instance(param)

        self.assertTrue(FileRule.match(param))

        self.assertEqual(obj.is_equal(check_obj), expected[0], 'Mismatch in is_equal, expected {}'.format(expected[0]))
        self.assertEqual(obj.is_equal(check_obj, True), expected[1], 'Mismatch in is_equal/strict, expected {}'.format(expected[1]))

        self.assertEqual(obj.is_covered(check_obj), expected[2], 'Mismatch in is_covered, expected {}'.format(expected[2]))
        self.assertEqual(obj.is_covered(check_obj, True, True), expected[3], 'Mismatch in is_covered/exact, expected {}'.format(expected[3]))


class FileCoveredTest_01(FileCoveredTest):
    rule = 'file /foo r,'
    tests = (
        #  rule                      equal  strict equal  covered  covered exact
        ('file /foo r,',            (True,  True,         True,    True)),
        ('file /foo r ,',           (True,  False,        True,    True)),
        ('allow file /foo r,',      (True,  False,        True,    True)),
        ('allow /foo r, # comment', (True,  False,        True,    True)),
        ('allow owner /foo r,',     (False, False,        True,    True)),
        ('/foo r -> bar,',          (False, False,        True,    True)),
        ('file r /foo,',            (True,  False,        True,    True)),
        ('allow file r /foo,',      (True,  False,        True,    True)),
        ('allow r /foo, # comment', (True,  False,        True,    True)),
        ('allow owner r /foo,',     (False, False,        True,    True)),
        ('r /foo -> bar,',          (False, False,        True,    True)),
        ('file,',                   (False, False,        False,   False)),
        ('file /foo w,',            (False, False,        False,   False)),
        ('file /foo rw,',           (False, False,        False,   False)),
        ('file /bar r,',            (False, False,        False,   False)),
        ('audit /foo r,',           (False, False,        False,   False)),
        ('audit file,',             (False, False,        False,   False)),
        ('audit deny /foo r,',      (False, False,        False,   False)),
        ('deny file /foo r,',       (False, False,        False,   False)),
        ('/foo rPx,',               (False, False,        False,   False)),
        ('/foo Pxr,',               (False, False,        False,   False)),
        ('/foo Px,',                (False, False,        False,   False)),
        ('/foo ix,',                (False, False,        False,   False)),
        ('/foo ix -> bar,',         (False, False,        False,   False)),
        ('/foo rPx -> bar,',        (False, False,        False,   False)),
    )


class FileCoveredTest_02(FileCoveredTest):
    rule = 'audit /foo r,'

    tests = (
        #  rule                      equal  strict equal  covered  covered exact
        ('file /foo r,',            (False, False,        True,    False)),
        ('allow file /foo r,',      (False, False,        True,    False)),
        ('allow /foo r, # comment', (False, False,        True,    False)),
        ('allow owner /foo r,',     (False, False,        True,    False)),
        ('/foo r -> bar,',          (False, False,        True,    False)),
        ('file r /foo,',            (False, False,        True,    False)),
        ('allow file r /foo,',      (False, False,        True,    False)),
        ('allow r /foo, # comment', (False, False,        True,    False)),
        ('allow owner r /foo,',     (False, False,        True,    False)),
        ('r /foo -> bar,',          (False, False,        True,    False)),  # XXX exact
        ('file,',                   (False, False,        False,   False)),
        ('file /foo w,',            (False, False,        False,   False)),
        ('file /foo rw,',           (False, False,        False,   False)),
        ('file /bar r,',            (False, False,        False,   False)),
        ('audit /foo r,',           (True,  True,         True,    True)),
        ('audit file,',             (False, False,        False,   False)),
        ('audit deny /foo r,',      (False, False,        False,   False)),
        ('deny file /foo r,',       (False, False,        False,   False)),
        ('/foo rPx,',               (False, False,        False,   False)),
        ('/foo Pxr,',               (False, False,        False,   False)),
        ('/foo Px,',                (False, False,        False,   False)),
        ('/foo ix,',                (False, False,        False,   False)),
        ('/foo ix -> bar,',         (False, False,        False,   False)),
        ('/foo rPx -> bar,',        (False, False,        False,   False)),
    )


class FileCoveredTest_03(FileCoveredTest):
    rule = '/foo mrwPx,'

    tests = (
        #  rule                      equal  strict equal  covered  covered exact
        ('file /foo r,',            (False, False,        True,    True)),
        ('allow file /foo r,',      (False, False,        True,    True)),
        ('allow /foo r, # comment', (False, False,        True,    True)),
        ('allow owner /foo r,',     (False, False,        True,    True)),
        ('/foo r -> bar,',          (False, False,        True,    True)),
        ('file r /foo,',            (False, False,        True,    True)),
        ('allow file r /foo,',      (False, False,        True,    True)),
        ('allow r /foo, # comment', (False, False,        True,    True)),
        ('allow owner r /foo,',     (False, False,        True,    True)),
        ('r /foo -> bar,',          (False, False,        True,    True)),
        ('file,',                   (False, False,        False,   False)),
        ('file /foo w,',            (False, False,        True,    True)),
        ('file /foo rw,',           (False, False,        True,    True)),
        ('file /bar r,',            (False, False,        False,   False)),
        ('audit /foo r,',           (False, False,        False,   False)),
        ('audit file,',             (False, False,        False,   False)),
        ('audit deny /foo r,',      (False, False,        False,   False)),
        ('deny file /foo r,',       (False, False,        False,   False)),
        ('/foo mrwPx,',             (True,  True,         True,    True)),
        ('/foo wPxrm,',             (True,  False,        True,    True)),
        ('/foo rm,',                (False, False,        True,    True)),
        ('/foo Px,',                (False, False,        True,    True)),
        ('/foo ix,',                (False, False,        False,   False)),
        ('/foo ix -> bar,',         (False, False,        False,   False)),
        ('/foo mrwPx -> bar,',      (False, False,        False,   False)),
    )


class FileCoveredTest_04(FileCoveredTest):
    rule = '/foo mrwPx -> bar,'

    tests = (
        #  rule                      equal  strict equal  covered  covered exact
        ('file /foo r,',            (False, False,        True,    True)),
        ('allow file /foo r,',      (False, False,        True,    True)),
        ('allow /foo r, # comment', (False, False,        True,    True)),
        ('allow owner /foo r,',     (False, False,        True,    True)),
        ('/foo r -> bar,',          (False, False,        True,    True)),
        ('file r /foo,',            (False, False,        True,    True)),
        ('allow file r /foo,',      (False, False,        True,    True)),
        ('allow r /foo, # comment', (False, False,        True,    True)),
        ('allow owner r /foo,',     (False, False,        True,    True)),
        ('r /foo -> bar,',          (False, False,        True,    True)),
        ('file,',                   (False, False,        False,   False)),
        ('file /foo w,',            (False, False,        True,    True)),
        ('file /foo rw,',           (False, False,        True,    True)),
        ('file /bar r,',            (False, False,        False,   False)),
        ('audit /foo r,',           (False, False,        False,   False)),
        ('audit file,',             (False, False,        False,   False)),
        ('audit deny /foo r,',      (False, False,        False,   False)),
        ('deny file /foo r,',       (False, False,        False,   False)),
        ('/foo mrwPx,',             (False, False,        False,   False)),
        ('/foo wPxrm,',             (False, False,        False,   False)),
        ('/foo rm,',                (False, False,        True,    True)),
        ('/foo Px,',                (False, False,        False,   False)),
        ('/foo ix,',                (False, False,        False,   False)),
        ('/foo ix -> bar,',         (False, False,        False,   False)),
        ('/foo mrwPx -> bar,',      (True,  True,         True,    True)),
    )


class FileCoveredTest_05(FileCoveredTest):
    rule = 'file,'

    tests = (
        #   rule                     equal  strict equal  covered  covered exact
        ('file /foo r,',            (False, False,        True,    True)),
        ('allow file /foo r,',      (False, False,        True,    True)),
        ('allow /foo r, # comment', (False, False,        True,    True)),
        ('allow owner /foo r,',     (False, False,        True,    True)),
        ('/foo r -> bar,',          (False, False,        True,    True)),
        ('file r /foo,',            (False, False,        True,    True)),
        ('allow file r /foo,',      (False, False,        True,    True)),
        ('allow r /foo, # comment', (False, False,        True,    True)),
        ('allow owner r /foo,',     (False, False,        True,    True)),
        ('r /foo -> bar,',          (False, False,        True,    True)),
        ('file,',                   (True,  True,         True,    True)),
        ('file /foo w,',            (False, False,        True,    True)),
        ('file /foo rw,',           (False, False,        True,    True)),
        ('file /bar r,',            (False, False,        True,    True)),
        ('audit /foo r,',           (False, False,        False,   False)),
        ('audit file,',             (False, False,        False,   False)),
        ('audit deny /foo r,',      (False, False,        False,   False)),
        ('deny file /foo r,',       (False, False,        False,   False)),
        ('/foo mrwPx,',             (False, False,        False,   False)),
        ('/foo wPxrm,',             (False, False,        False,   False)),
        ('/foo rm,',                (False, False,        True,    True)),
        ('/foo Px,',                (False, False,        False,   False)),
        ('/foo ix,',                (False, False,        False,   False)),
        ('/foo ix -> bar,',         (False, False,        False,   False)),
        ('/foo mrwPx -> bar,',      (False, False,        False,   False)),
    )


class FileCoveredTest_06(FileCoveredTest):
    rule = 'deny /foo w,'

    tests = (
        #   rule          equal  strict equal  covered  covered exact
        ('/foo w,',      (False, False,        False,   False)),
        ('/foo a,',      (False, False,        False,   False)),
        ('deny /foo w,', (True,  True,         True,    True)),
        ('deny /foo a,', (False, False,        True,    True)),
    )


class FileCoveredTest_07(FileCoveredTest):
    rule = '/foo w,'

    tests = (
        #   rule          equal  strict equal  covered  covered exact
        ('/foo w,',      (True,  True,         True,    True)),
        ('/foo a,',      (False, False,        True,    True)),
        ('deny /foo w,', (False, False,        False,   False)),
        ('deny /foo a,', (False, False,        False,   False)),
    )


class FileCoveredTest_08(FileCoveredTest):
    rule = 'link /foo -> /bar,'

    tests = (
        #   rule                        equal  strict equal  covered  covered exact
        ('link /foo -> /bar,',        (True,  True,          True,    True)),
        ('link /asdf -> /bar,',       (False, False,         False,   False)),
        ('link /foo -> /asdf,',       (False, False,         False,   False)),
        ('deny link /foo -> /bar,',   (False, False,         False,   False)),
        ('deny link /foo -> /bar,',   (False, False,         False,   False)),
        ('link subset /foo -> /bar,', (False, False,         True,    True)),  # subset makes the rule more strict
        # ('/foo l -> /bar,',           (?,     ?,             ?,       ?)),  # TODO
        # ('l /foo -> /bar,',           (?,     ?,             ?,       ?)),  # TODO
    )


class FileCoveredTest_09(FileCoveredTest):
    rule = 'link subset /foo -> /bar,'
    tests = (
        #   rule                            equal  strict equal  covered  covered exact
        ('link subset /foo -> /bar,',      (True,  True,         True,    True)),
        ('link subset /asdf -> /bar,',     (False, False,        False,   False)),
        ('link subset /foo -> /asdf,',     (False, False,        False,   False)),
        ('deny link subset /foo -> /bar,', (False, False,        False,   False)),
        ('deny link subset /foo -> /bar,', (False, False,        False,   False)),
        ('link /foo -> /bar,',             (False, False,        False,   False)),  # no subset means more permissions
        # ('/foo l -> /bar,',                (?,     ?,            ?,       ?)),  # TODO
        # ('l /foo -> /bar,',                (?,     ?,            ?,       ?)),  # TODO
    )


class FileCoveredTest_ManualOrInvalid(AATest):
    def AASetup(self):
        #                   path,   perms, exec_perms, target, owner, file_keyword, leading_perms
        self.obj = FileRule('/foo', 'rw',  'ix',       '/bar', False, False,        False)
        self.testobj = FileRule('/foo', 'rw', 'ix', '/bar', False, False, False)

    def test_covered_owner_1(self):
        # testobj with 'owner'
        self.testobj = FileRule('/foo', 'rw', 'ix', '/bar', True, False, False)
        self.assertTrue(self.obj.is_covered(self.testobj))

    def test_covered_owner_2(self):
        # obj with 'owner'
        self.obj = FileRule('/foo', 'rw', 'ix', '/bar', True, False, False)
        self.assertFalse(self.obj.is_covered(self.testobj))

    def test_equal_all_perms(self):
        self.testobj.all_perms = True  # that makes testobj invalid, but that's the only way to survive the 'perms' comparison
        self.assertFalse(self.obj.is_equal(self.testobj))

    def test_equal_file_keyword(self):
        # testobj with file_keyword
        self.testobj = FileRule('/foo', 'rw', 'ix', '/bar', False, True, False)
        self.assertTrue(self.obj.is_equal(self.testobj, strict=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=True))

    def test_equal_file_leading_perms(self):
        # testobj with leading_perms
        self.testobj = FileRule('/foo', 'rw', 'ix', '/bar', False, False, True)
        self.assertTrue(self.obj.is_equal(self.testobj, strict=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=True))

    def test_covered_anyperm_1(self):
        self.obj = FileRule('/foo', 'rw', None, '/bar', False, False, False)
        self.testobj = FileRule('/foo', 'rw', FileRule.ANY_EXEC, '/bar', False, False, False)
        self.assertFalse(self.obj.is_covered(self.testobj))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=True))

    def test_covered_anyperm_2(self):
        self.testobj = FileRule('/foo', 'rw', FileRule.ANY_EXEC, '/bar', False, False, False)
        self.assertTrue(self.obj.is_covered(self.testobj))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=True))

    def test_covered_anyperm_3(self):
        # make sure a different exec target gets ignored with ANY_EXEC
        self.testobj = FileRule('/foo', 'rw', FileRule.ANY_EXEC, '/xyz', False, False, False)
        self.assertTrue(self.obj.is_covered(self.testobj))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=True))

    def test_covered_anyperm_4(self):
        # make sure a different exec target gets ignored with ANY_EXEC
        self.testobj = FileRule('/foo', 'rw', FileRule.ANY_EXEC, FileRule.ALL, False, False, False)
        self.assertTrue(self.obj.is_covered(self.testobj))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=True))

    def test_covered_anyperm_5(self):
        # even with ANY_EXEC, a different link target causes a mismatch
        self.testobj = FileRule('/foo', 'rwl', FileRule.ANY_EXEC, '/xyz', False, False, False)
        self.assertFalse(self.obj.is_covered(self.testobj))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=True))

    def test_covered_anyperm_6(self):
        # even with ANY_EXEC, a different link target causes a mismatch
        self.testobj = FileRule('/foo', 'rwl', FileRule.ANY_EXEC, FileRule.ALL, False, False, False)
        self.assertFalse(self.obj.is_covered(self.testobj))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=True))

    def test_covered_anyperm_7(self):
        self.obj = FileRule('/foo', 'rw', 'x', '/bar', False, False, False, deny=True)
        self.testobj = FileRule('/foo', 'rw', FileRule.ANY_EXEC, '/bar', False, False, False)
        self.assertFalse(self.obj.is_covered(self.testobj))
        self.assertTrue(self.obj.is_covered(self.testobj, check_allow_deny=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=False))
        self.assertFalse(self.obj.is_equal(self.testobj, strict=True))

    def test_borked_obj_is_covered_1(self):
        self.testobj.path = ''

        with self.assertRaises(AppArmorBug):
            self.obj.is_covered(self.testobj)

    def test_borked_obj_is_covered_2(self):
        self.testobj.perms = set()
        self.testobj.exec_perms = ''

        with self.assertRaises(AppArmorBug):
            self.obj.is_covered(self.testobj)

    def test_borked_obj_is_covered_3(self):
        self.testobj.target = ''

        with self.assertRaises(AppArmorBug):
            self.obj.is_covered(self.testobj)

    def test_invalid_is_covered(self):
        raw_rule = 'file,'

        class SomeOtherClass(FileRule):
            pass

        obj = FileRule.create_instance(raw_rule)
        testobj = SomeOtherClass.create_instance(raw_rule)  # different type
        with self.assertRaises(AppArmorBug):
            obj.is_covered(testobj)

    def test_invalid_is_equal(self):
        raw_rule = 'file,'

        class SomeOtherClass(FileRule):
            pass

        obj = FileRule.create_instance(raw_rule)
        testobj = SomeOtherClass.create_instance(raw_rule)  # different type
        with self.assertRaises(AppArmorBug):
            obj.is_equal(testobj)


class FileSeverityTest(AATest):
    tests = (
        ('/usr/bin/whatis ix,',  5),
        ('/etc ix,',             'unknown'),
        ('/dev/doublehit ix,',   0),
        ('/dev/doublehit rix,',  4),
        ('/dev/doublehit rwix,', 8),
        ('/dev/tty10 rwix,',     9),
        ('/var/adm/foo/** rix,', 3),
        ('/etc/apparmor/** r,',  6),
        ('/etc/** r,',           'unknown'),
        ('/usr/foo@bar r,',      'unknown'),  # filename containing @
        ('/home/foo@bar rw,',    6),  # filename containing @
        ('file,',                'unknown'),  # bare file rule XXX should return maximum severity
    )

    def _run_test(self, params, expected):
        sev_db = severity.Severity('../severity.db', 'unknown')
        obj = FileRule.create_instance(params)
        rank = obj.severity(sev_db)
        self.assertEqual(rank, expected)


class FileLogprofHeaderTest(AATest):
    tests = (
        # log event                        old perms ALL / owner
        (('file,',                             set(),    set()),     [                                     _('Path'), _('ALL'),                                _('New Mode'), _('ALL')]),  # noqa: E201
        (('/foo r,',                           set(),    set()),     [                                     _('Path'), '/foo',                                  _('New Mode'), 'r']),  # noqa: E201
        (('file /bar Px -> foo,',              set(),    set()),     [                                     _('Path'), '/bar',                                  _('New Mode'), 'Px -> foo']),  # noqa: E201
        (('deny file,',                        set(),    set()),     [_('Qualifier'), 'deny',              _('Path'), _('ALL'),                                _('New Mode'), _('ALL')]),
        (('allow file /baz rwk,',              set(),    set()),     [_('Qualifier'), 'allow',             _('Path'), '/baz',                                  _('New Mode'), 'rwk']),
        (('audit file /foo mr,',               set(),    set()),     [_('Qualifier'), 'audit',             _('Path'), '/foo',                                  _('New Mode'), 'mr']),
        (('audit deny /foo wk,',               set(),    set()),     [_('Qualifier'), 'audit deny',        _('Path'), '/foo',                                  _('New Mode'), 'wk']),
        (('priority=1 file,',                  set(),    set()),     [_('Qualifier'), 'priority=1',        _('Path'), _('ALL'),                                _('New Mode'), _('ALL')]),
        (('priority=-1 audit file /foo mr,',   set(),    set()),     [_('Qualifier'), 'priority=-1 audit', _('Path'), '/foo',                                  _('New Mode'), 'mr']),
        (('owner file /foo ix,',               set(),    set()),     [                                     _('Path'), '/foo',                                  _('New Mode'), 'owner ix']),  # noqa: E201
        (('audit deny file /foo rlx -> /baz,', set(),    set()),     [_('Qualifier'), 'audit deny',        _('Path'), '/foo',                                  _('New Mode'), 'rlx -> /baz']),
        (('/foo rw,',                          set('r'), set()),     [                                     _('Path'), '/foo', _('Old Mode'), _('r'),           _('New Mode'), 'rw']),  # noqa: E201
        (('/foo rw,',                          set(),    set('rw')), [                                     _('Path'), '/foo', _('Old Mode'), _('owner rw'),    _('New Mode'), 'rw']),  # noqa: E201
        (('/foo mrw,',                         set('r'), set('k')),  [                                     _('Path'), '/foo', _('Old Mode'), _('r + owner k'), _('New Mode'), 'mrw']),  # noqa: E201
        (('/foo mrw,',                         set('r'), set('rk')), [                                     _('Path'), '/foo', _('Old Mode'), _('r + owner k'), _('New Mode'), 'mrw']),  # noqa: E201
        (('link /foo -> /bar,',                set(),    set()),     [                                     _('Path'), '/foo',                                  _('New Mode'), 'link -> /bar']),  # noqa: E201
        (('link subset /foo -> /bar,',         set(),    set()),     [                                     _('Path'), '/foo',                                  _('New Mode'), 'link subset -> /bar']),  # noqa: E201
    )

    def _run_test(self, params, expected):
        obj = FileRule.create_instance(params[0])
        if params[1] or params[2]:
            obj.original_perms = {'allow': {'all': params[1], 'owner': params[2]}}
        self.assertEqual(obj.logprof_header(), expected)

    def test_empty_original_perms(self):
        obj = FileRule.create_instance('/foo rw,')
        obj.original_perms = {'allow': {'all': set(), 'owner': set()}}
        self.assertEqual(obj.logprof_header(), [_('Path'), '/foo', _('New Mode'), 'rw'])

    def test_implicit_original_perms(self):
        obj = FileRule.create_instance('/foo rw,')
        obj.original_perms = {'allow': {'all': FileRule.ALL, 'owner': set()}}
        self.assertEqual(obj.logprof_header(), [_('Path'), '/foo', _('Old Mode'), _('mrwlkix'), _('New Mode'), 'rw'])

    def test_owner_implicit_original_perms(self):
        obj = FileRule.create_instance('/foo rw,')
        obj.original_perms = {'allow': {'all': set(), 'owner': FileRule.ALL}}
        self.assertEqual(obj.logprof_header(), [_('Path'), '/foo', _('Old Mode'), _('owner mrwlkix'), _('New Mode'), 'rw'])


class FileEditHeaderTest(AATest):
    def _run_test(self, params, expected):
        rule_obj = FileRule.create_instance(params)
        self.assertEqual(rule_obj.can_edit, True)
        prompt, path_to_edit = rule_obj.edit_header()
        self.assertEqual(path_to_edit, expected)

    tests = (
        ('/foo/bar/baz r,',       '/foo/bar/baz'),
        ('/foo/**/baz r,',        '/foo/**/baz'),
        ('link /foo/** -> /bar,', '/foo/**'),
    )

    def test_edit_header_bare_file(self):
        rule_obj = FileRule.create_instance('file,')
        self.assertEqual(rule_obj.can_edit, False)
        with self.assertRaises(AppArmorBug):
            rule_obj.edit_header()


class FileValidateAndStoreEditTest(AATest):
    def _run_test(self, params, expected):
        rule_obj = FileRule('/foo/bar/baz', 'r', None, FileRule.ALL, False, False, False, log_event=True)

        self.assertEqual(rule_obj.validate_edit(params), expected)

        rule_obj.store_edit(params)
        self.assertEqual(rule_obj.get_raw(), params + ' r,')

    tests = (
        # edited path     match
        ('/foo/bar/baz',  True),
        ('/foo/bar/*',    True),
        ('/foo/bar/???',  True),
        ('/foo/xy**',     False),
        ('/foo/bar/baz/', False),
    )

    def test_validate_not_a_path(self):
        rule_obj = FileRule.create_instance('/foo/bar/baz r,')

        with self.assertRaises(AppArmorException):
            rule_obj.validate_edit('foo/bar/baz')

        with self.assertRaises(AppArmorException):
            rule_obj.store_edit('foo/bar/baz')

    def test_validate_edit_bare_file(self):
        rule_obj = FileRule.create_instance('file,')
        self.assertEqual(rule_obj.can_edit, False)

        with self.assertRaises(AppArmorBug):
            rule_obj.validate_edit('/foo/bar')

        with self.assertRaises(AppArmorBug):
            rule_obj.store_edit('/foo/bar')


# --- tests for FileRuleset --- #

class FileRulesTest(AATest):
    def test_empty_ruleset(self):
        ruleset = FileRuleset()
        ruleset_2 = FileRuleset()
        self.assertEqual([], ruleset.get_raw(2))
        self.assertEqual([], ruleset.get_clean(2))
        self.assertEqual([], ruleset_2.get_raw(2))
        self.assertEqual([], ruleset_2.get_clean(2))

    def test_ruleset_1(self):
        ruleset = FileRuleset()
        rules = [
            '         file             ,        ',
            '   file /foo rw,',
            '  file /bar r,',
        ]

        expected_raw = [
            'file             ,',
            'file /foo rw,',
            'file /bar r,',
            '',
        ]

        expected_clean = [
            'file /bar r,',
            'file /foo rw,',
            'file,',
            '',
        ]

        deleted = 0
        for rule in rules:
            deleted += ruleset.add(FileRule.create_instance(rule))

        self.assertEqual(deleted, 0)
        self.assertEqual(expected_raw, ruleset.get_raw())
        self.assertEqual(expected_clean, ruleset.get_clean())

    def test_ruleset_2(self):
        ruleset = FileRuleset()
        rules = [
            '/foo Px,',
            '/bar    Cx    ->     bar_child ,',
            'deny /asdf w,',
        ]

        expected_raw = [
            '  /foo Px,',
            '  /bar    Cx    ->     bar_child ,',
            '  deny /asdf w,',
            '',
        ]

        expected_clean = [
            '  deny /asdf w,',
            '',
            '  /bar Cx -> bar_child,',
            '  /foo Px,',
            '',
        ]

        deleted = 0
        for rule in rules:
            deleted += ruleset.add(FileRule.create_instance(rule))

        self.assertEqual(deleted, 0)
        self.assertEqual(expected_raw, ruleset.get_raw(1))
        self.assertEqual(expected_clean, ruleset.get_clean(1))

    def test_ruleset_cleanup_add_1(self):
        ruleset = FileRuleset()
        rules = [
            '/foo/bar r,',
            '/foo/baz rw,',
            '/foo/baz rwk,',
        ]

        rules_with_cleanup = [
            '/foo/* r,',
        ]

        expected_raw = [
            '  /foo/baz rw,',
            '  /foo/baz rwk,',
            '  /foo/* r,',
            '',
        ]

        expected_clean = [
            '  /foo/* r,',
            '  /foo/baz rw,',
            '  /foo/baz rwk,',
            '',
        ]

        deleted = 0
        for rule in rules:
            deleted += ruleset.add(FileRule.create_instance(rule))

        self.assertEqual(deleted, 0)  # rules[] are added without cleanup mode, so the superfluous '/foo/baz rw,' should be kept

        for rule in rules_with_cleanup:
            deleted += ruleset.add(FileRule.create_instance(rule), cleanup=True)

        self.assertEqual(deleted, 1)  # rules_with_cleanup made '/foo/bar r,' superfluous
        self.assertEqual(expected_raw, ruleset.get_raw(1))
        self.assertEqual(expected_clean, ruleset.get_clean(1))


# class FileDeleteTest(AATest):
#     pass


class FileGetRulesForPath(AATest):
    tests = (
        #  path                                 audit  deny    expected
        (('/etc/foo/dovecot.conf',              False, False), ['/etc/foo/* r,', '/etc/foo/dovecot.conf rw,',                                 '']),
        (('/etc/foo/foo.conf',                  False, False), ['/etc/foo/* r,',                                                              '']),
        (('/etc/foo/dovecot-database.conf.ext', False, False), ['/etc/foo/* r,', '/etc/foo/dovecot-database.conf.ext w,',                     '']),
        (('/etc/foo/auth.d/authfoo.conf',       False, False), ['/etc/foo/{auth,conf}.d/*.conf r,', '/etc/foo/{auth,conf}.d/authfoo.conf w,', '']),
        (('/etc/foo/dovecot-deny.conf',         False, False), ['deny /etc/foo/dovecot-deny.conf r,', '', '/etc/foo/* r,',                    '']),
        (('/foo/bar',                           False, True),  [                                                                                ]),  # noqa: E201,E202
        (('/etc/foo/dovecot-deny.conf',         False, True),  ['deny /etc/foo/dovecot-deny.conf r,',                                         '']),
        (('/etc/foo/foo.conf',                  False, True),  [                                                                                ]),  # noqa: E201,E202
        (('/etc/foo/owner.conf',                False, False), ['/etc/foo/* r,', 'owner /etc/foo/owner.conf w,',                              '']),
    )

    def _run_test(self, params, expected):
        rules = (
            '/etc/foo/* r,',
            '/etc/foo/dovecot.conf rw,',
            '/etc/foo/{auth,conf}.d/*.conf r,',
            '/etc/foo/{auth,conf}.d/authfoo.conf w,',
            '/etc/foo/dovecot-database.conf.ext w,',
            'owner /etc/foo/owner.conf w,',
            'deny /etc/foo/dovecot-deny.conf r,',
        )

        ruleset = FileRuleset()
        for rule in rules:
            ruleset.add(FileRule.create_instance(rule))

        matching = ruleset.get_rules_for_path(*params)
        self. assertEqual(matching.get_clean(), expected)


class FileGetPermsForPath_1(AATest):
    tests = (
        #  path                                 audit   deny    expected
        (('/etc/foo/dovecot.conf',              False,  False), {'allow': {'all': {'r', 'w'}, 'owner': set()}, 'deny': {'all': set(), 'owner': set()}, 'paths': {'/etc/foo/*', '/etc/foo/dovecot.conf'}}),
        (('/etc/foo/foo.conf',                  False,  False), {'allow': {'all': {'r'},      'owner': set()}, 'deny': {'all': set(), 'owner': set()}, 'paths': {'/etc/foo/*'}}),
        (('/etc/foo/dovecot-database.conf.ext', False,  False), {'allow': {'all': {'r', 'w'}, 'owner': set()}, 'deny': {'all': set(), 'owner': set()}, 'paths': {'/etc/foo/*', '/etc/foo/dovecot-database.conf.ext'}}),
        (('/etc/foo/auth.d/authfoo.conf',       False,  False), {'allow': {'all': {'r', 'w'}, 'owner': set()}, 'deny': {'all': set(), 'owner': set()}, 'paths': {'/etc/foo/{auth,conf}.d/*.conf', '/etc/foo/{auth,conf}.d/authfoo.conf'}}),
        (('/etc/foo/dovecot-deny.conf',         False,  False), {'allow': {'all': {'r'},      'owner': set()}, 'deny': {'all': {'r'}, 'owner': set()}, 'paths': {'/etc/foo/*', '/etc/foo/dovecot-deny.conf'}}),
        (('/foo/bar',                           False,  True),  {'allow': {'all': set(),      'owner': set()}, 'deny': {'all': set(), 'owner': set()}, 'paths': set()}),
        (('/etc/foo/dovecot-deny.conf',         False,  True),  {'allow': {'all': set(),      'owner': set()}, 'deny': {'all': {'r'}, 'owner': set()}, 'paths': {'/etc/foo/dovecot-deny.conf'}}),
        (('/etc/foo/foo.conf',                  False,  True),  {'allow': {'all': set(),      'owner': set()}, 'deny': {'all': set(), 'owner': set()}, 'paths': set()}),
        (('/usr/lib/dovecot/config',            False,  False), {'allow': {'all': set(),      'owner': set()}, 'deny': {'all': set(), 'owner': set()}, 'paths': set()}),  # exec perms are not honored by get_perms_for_path()
    )

    def _run_test(self, params, expected):
        rules = (
            '/etc/foo/* r,',
            '/etc/foo/dovecot.conf rw,',
            '/etc/foo/{auth,conf}.d/*.conf r,',
            '/etc/foo/{auth,conf}.d/authfoo.conf w,',
            '/etc/foo/dovecot-database.conf.ext w,',
            'deny /etc/foo/dovecot-deny.conf r,',
            '/usr/lib/dovecot/config ix,',
        )

        ruleset = FileRuleset()
        for rule in rules:
            ruleset.add(FileRule.create_instance(rule))

        perms = ruleset.get_perms_for_path(*params)
        self. assertEqual(perms, expected)


class FileGetPermsForPath_2(AATest):
    tests = (
        #  path                                 audit   deny    expected
        (('/etc/foo/dovecot.conf',              False,  False), {'allow': {'all': FileRule.ALL, 'owner': set()}, 'deny': {'all': FileRule.ALL, 'owner': set()}, 'paths': {'/etc/foo/*', '/etc/foo/dovecot.conf'}}),
        (('/etc/foo/dovecot.conf',              True,   False), {'allow': {'all': {'r', 'w'},   'owner': set()}, 'deny': {'all': set(),        'owner': set()}, 'paths': {'/etc/foo/dovecot.conf'}}),
        (('/etc/foo/foo.conf',                  False,  False), {'allow': {'all': FileRule.ALL, 'owner': set()}, 'deny': {'all': FileRule.ALL, 'owner': set()}, 'paths': {'/etc/foo/*'}}),
        (('/etc/foo/dovecot-database.conf.ext', False,  False), {'allow': {'all': FileRule.ALL, 'owner': set()}, 'deny': {'all': FileRule.ALL, 'owner': set()}, 'paths': {'/etc/foo/*', '/etc/foo/dovecot-database.conf.ext'}}),
        (('/etc/foo/auth.d/authfoo.conf',       False,  False), {'allow': {'all': FileRule.ALL, 'owner': set()}, 'deny': {'all': FileRule.ALL, 'owner': set()}, 'paths': {'/etc/foo/{auth,conf}.d/*.conf', '/etc/foo/{auth,conf}.d/authfoo.conf'}}),
        (('/etc/foo/auth.d/authfoo.conf',       True,   False), {'allow': {'all': {'w'},        'owner': set()}, 'deny': {'all': set(),        'owner': set()}, 'paths': {'/etc/foo/{auth,conf}.d/authfoo.conf'}}),
        (('/etc/foo/dovecot-deny.conf',         False,  False), {'allow': {'all': FileRule.ALL, 'owner': set()}, 'deny': {'all': FileRule.ALL, 'owner': set()}, 'paths': {'/etc/foo/*', '/etc/foo/dovecot-deny.conf'}}),
        (('/foo/bar',                           False,  True),  {'allow': {'all': set(),        'owner': set()}, 'deny': {'all': FileRule.ALL, 'owner': set()}, 'paths': set()}),
        (('/etc/foo/dovecot-deny.conf',         False,  True),  {'allow': {'all': set(),        'owner': set()}, 'deny': {'all': FileRule.ALL, 'owner': set()}, 'paths': {'/etc/foo/dovecot-deny.conf'}}),
        (('/etc/foo/foo.conf',                  False,  True),  {'allow': {'all': set(),        'owner': set()}, 'deny': {'all': FileRule.ALL, 'owner': set()}, 'paths': set()}),
        # (('/etc/foo/owner.conf',                False,  True),  {'allow': {'all': set(),        'owner': {'w'}}, 'deny': {'all': FileRule.ALL, 'owner': set()}, 'paths': {'/etc/foo/owner.conf'}}), # XXX doesn't work yet
    )

    def _run_test(self, params, expected):
        rules = (
            '/etc/foo/* r,',
            'audit /etc/foo/dovecot.conf rw,',
            '/etc/foo/{auth,conf}.d/*.conf r,',
            'audit /etc/foo/{auth,conf}.d/authfoo.conf w,',
            '/etc/foo/dovecot-database.conf.ext w,',
            'deny /etc/foo/dovecot-deny.conf r,',
            'file,',
            'owner /etc/foo/owner.conf w,',
            'deny file,',
        )

        ruleset = FileRuleset()
        for rule in rules:
            ruleset.add(FileRule.create_instance(rule))

        perms = ruleset.get_perms_for_path(*params)
        self. assertEqual(perms, expected)


class FileGetExecRulesForPath_1(AATest):
    tests = (
        ('/bin/foo', ['audit /bin/foo ix,', '']),
        ('/bin/bar', ['deny /bin/bar x,', '']),
        ('/foo', []),
    )

    def _run_test(self, params, expected):
        rules = (
            '/foo r,',
            'audit /bin/foo ix,',
            '/bin/b* Px,',
            'deny /bin/bar x,',
        )

        ruleset = FileRuleset()
        for rule in rules:
            ruleset.add(FileRule.create_instance(rule))

        perms = ruleset.get_exec_rules_for_path(params)
        matches = perms.get_clean()
        self. assertEqual(matches, expected)


class FileGetExecRulesForPath_2(AATest):
    tests = (
        ('/bin/foo', ['audit /bin/foo ix,', '']),
        ('/bin/bar', ['deny /bin/bar x,', '', '/bin/b* Px,', '']),
        ('/foo', []),
    )

    def _run_test(self, params, expected):
        rules = (
            '/foo r,',
            'audit /bin/foo ix,',
            '/bin/b* Px,',
            'deny /bin/bar x,',
        )

        ruleset = FileRuleset()
        for rule in rules:
            ruleset.add(FileRule.create_instance(rule))

        perms = ruleset.get_exec_rules_for_path(params, only_exact_matches=False)
        matches = perms.get_clean()
        self. assertEqual(matches, expected)


class FileGetExecConflictRules_1(AATest):
    tests = (
        ('/bin/foo ix,', ['/bin/foo Px,', '']),
        ('/bin/bar Px,', ['deny /bin/bar x,', '', '/bin/bar cx,', '']),
        ('/bin/bar cx,', ['deny /bin/bar x,', '']),
        ('/bin/foo r,', []),
    )

    def _run_test(self, params, expected):
        rules = (
            '/foo r,',
            'audit /bin/foo ix,',
            '/bin/foo Px,',
            '/bin/b* Px,',
            '/bin/bar cx,',
            'deny /bin/bar x,',
        )

        ruleset = FileRuleset()
        for rule in rules:
            ruleset.add(FileRule.create_instance(rule))

        rule_obj = FileRule.create_instance(params)
        conflicts = ruleset.get_exec_conflict_rules(rule_obj)
        self. assertEqual(conflicts.get_clean(), expected)


class FileCreateFromEvent(AATest):

    def test_exec_rule(self):
        parser = ReadLog('', '', '')
        raw_ev = '[258945.534540] audit: type=1400 audit(1725865139.443:401): apparmor="DENIED" operation="exec" class="file" profile="foo" name="/usr/bin/ls" pid=130888 comm="foo" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0'
        hl = hasher()
        ev = parser.parse_event(raw_ev)
        FileRule.hashlog_from_event(hl, ev)

        expected = {'/usr/bin/ls': {'': True}}
        self.assertEqual(hl, expected)

        fr = FileRule.from_hashlog(hl)

        expected = FileRule('/usr/bin/ls', None, FileRule.ANY_EXEC, FileRule.ALL, False)

        self.assertTrue(expected.is_equal(next(fr)))
        with self.assertRaises(StopIteration):
            next(fr)

    def test_filemode_write_append(self):
        parser = ReadLog('', '', '')
        events = [
            '[ 9614.885136] audit: type=1400 audit(1720429924.397:191): apparmor="DENIED" operation="open" class="file" profile="/home/user/test/a" name="/home/user/test/foo" pid=24460 comm="a" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000',
            '[ 9614.885149] audit: type=1400 audit(1720429924.397:192): apparmor="DENIED" operation="open" class="file" profile="/home/user/test/a" name="/home/user/test/foo" pid=24460 comm="a" requested_mask="a" denied_mask="a" fsuid=1000 ouid=1000'
        ]
        hl = hasher()
        for raw_ev in events:
            ev = parser.parse_event(raw_ev)
            FileRule.hashlog_from_event(hl, ev)

        expected = {'/home/user/test/foo': {True: {'w': True, 'a': True}}}
        self.assertEqual(hl, expected)

        fr = FileRule.from_hashlog(hl)

        expected = FileRule('/home/user/test/foo', 'w', None, FileRule.ALL, True)

        self.assertTrue(expected.is_equal(next(fr)))
        with self.assertRaises(StopIteration):
            next(fr)


class FileInvalidCreateFromEvent(AATest):
    def test_write_append(self):
        parser = ReadLog('', '', '')
        raw_ev = '[258145.094974] audit: type=1400 audit(1725864339.004:396): apparmor="DENIED" operation="exec" class="file" profile="foo" name="" pid=125456 comm="foo" requested_mask="x" denied_mask="x" fsuid=1000 ouid=1000'  # Name is empty
        hl = hasher()
        ev = parser.parse_event(raw_ev)
        with self.assertRaises(AppArmorException):
            FileRule.hashlog_from_event(hl, ev)


setup_all_loops(__name__)
if __name__ == '__main__':
    unittest.main(verbosity=1)