tests: add support for sessionID_set user filter.

Signed-off-by: Richard Guy Briggs <[email protected]>

Author: rgbriggs

tests/sessionid_filter/test

@@ -28,9 +28,13 @@ system("auditctl -D >& /dev/null");
 				    UNLINK => 1);
 (my $fh_err, my $stderr) = tempfile(TEMPLATE => '/tmp/audit-testsuite-err-XXXX',
 				    UNLINK => 1);
-(my $fh_ses, my $sesout) = tempfile(TEMPLATE => '/tmp/audit-testsuite-tmp-XXXX',
+(my $fh_out_set, my $stdout_set) = tempfile(TEMPLATE => '/tmp/audit-testsuite-out-set-XXXX',
+				    UNLINK => 1);
+(my $fh_err_set, my $stderr_set) = tempfile(TEMPLATE => '/tmp/audit-testsuite-err-set-XXXX',
+				    UNLINK => 1);
+(my $fh_ses, my $sesout) = tempfile(TEMPLATE => '/tmp/audit-testsuite-ses-XXXX',
                                     UNLINK => 1);
-(my $fh_pid, my $pidout) = tempfile(TEMPLATE => '/tmp/audit-testsuite-tmp-XXXX',
+(my $fh_pid, my $pidout) = tempfile(TEMPLATE => '/tmp/audit-testsuite-pid-XXXX',
                                     UNLINK => 1);
 
 ###
@@ -47,19 +51,24 @@ chomp($sessionid);
 my $key = key_gen();
 $result = system("auditctl -a always,exit -F arch=b64 -F path=/tmp/$key -F sessionid=$sessionid -k $key");
 ok($result, 0);
+$result = system("auditctl -a always,exit -F arch=b64 -F path=/tmp/${key}_set -F sessionid_set=1 -k ${key}_set");
+ok($result, 0);
 
 # send the userspace message (NOTE: requires bash)
-system("echo \$\$ > $pidout; exec touch /tmp/$key");
+system("echo \$\$ > $pidout; exec touch /tmp/$key /tmp/${key}_set");
 my $pid = <$fh_pid>;
 chomp($pid);
 
 # test for the SYSCALL message
 $result = system("ausearch -i -m SYSCALL -sc open -p $pid --session $sessionid -k $key > $stdout 2> $stderr");
 ok($result, 0);
+$result = system("ausearch -i -m SYSCALL -sc open -p $pid --sessionid_set 1 -k ${key}_set > $stdout_set 2> $stderr_set");
+ok($result, 0);
 
 # test if we generate the SYSCALL record correctly
 my $line;
 my $syscall_msg_match = 0;
+my $syscall_msg_match_set = 0;
 while ($line = <$fh_out>) {
 	# test if SYSCALL record matches
 	if ($line =~ m?^type=SYSCALL ? and
@@ -71,6 +80,17 @@ while ($line = <$fh_out>) {
 	}
 }
 ok($syscall_msg_match);
+while ($line = <$fh_out_set>) {
+	# test if SYSCALL record matches
+	if ($line =~ m?^type=SYSCALL ? and
+	    $line =~ m? pid=$pid ? and
+	    $line =~ m? ses=$sessionid ? and
+	    $line =~ m? key=${key}_set ?) {
+		$syscall_msg_match_set = 1;
+		last;
+	}
+}
+ok($syscall_msg_match_set);
 
 ###
 # cleanup