Extend the apparmor e2e test to apply the recorded profile

Extend the e2e test to use the recorded profile and check if is properly
enforced

Change-Id: I4d91f170a2dc38582a9df25725aa66ffd780b1e4
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>

Author: ccojocar

hack/ci/e2e-apparmor.sh

@@ -29,65 +29,117 @@ check_apparmor_profile() {
 
   # clean up the variance in the recorded apparmor profile
   yq -i ".spec" $APPARMOR_PROFILE_FILE
+  local name="$(grep -o '\btest-recording_test-pod[^ ]*\b' $APPARMOR_PROFILE_FILE)"
   sed -i -e "s/\btest-recording_test-pod[^ ]*\b/test-sleep/g" $APPARMOR_PROFILE_FILE
 
   diff $APPARMOR_REFERENCE_PROFILE_FILE $APPARMOR_PROFILE_FILE
+  echo "${name}"
 }
 
-record_apparmor_profile() {
-  echo "Enable Apparmor profile"
-  k patch spod spod --type=merge -p '{"spec":{"enableAppArmor":true}}'
-  k rollout status ds spod --timeout 360s
-  k_wait spod spod
-
-  echo "Recording apparmor profile"
-
-  TMP_DIR=$(mktemp -d)
-  trap 'rm -rf $TMP_DIR' EXIT
-
-  echo "Creating profile recording"
-  k apply -f $APPARMOR_RECORDING_FILE
-
-  POD_FILE="$TMP_DIR/pod.yml"
-  cat <<EOT >"$POD_FILE"
+create_pod() {
+  local pod_name="$1"
+  local pod_file="$2"
+  local apparmor_profile="${3-}"
+  cat <<EOT >"$pod_file"
 ---
 apiVersion: v1
 kind: Pod
 metadata:
-  name: $PODNAME
+  name: $pod_name
   labels:
     app: alpine
 spec:
   restartPolicy: Never
   containers:
-  - name: $PODNAME
+  - name: $pod_name
     image: alpine:3
-    command: ["sleep", "20"]
+    command: ["sleep", "30"]
 EOT
-  echo "Creating pod:"
-  cat "$POD_FILE"
 
-  k apply -f "$POD_FILE"
+  if [[ -n "$apparmor_profile" ]]; then
+    cat <<EOT >>"$pod_file"
+    securityContext:
+      appArmorProfile:
+        type: Localhost
+        localhostProfile: $apparmor_profile
+EOT
+  fi
+  cat "$pod_file"
+  k apply -f "$pod_file"
+}
 
-  echo "Waiting for pod to be completed"
+wait_for_pod_status() {
+  local pod_name="$1"
+  local status="$2"
+  echo "Waiting for pod status: $status"
   for ((i = 0; i < 10; i++)); do
-    if k get pods $PODNAME | grep -q Completed; then
-      echo "Pod completed"
+    if k get pods $pod_name | grep -q $status; then
+      echo "Pod reached status: $status "
       break
     fi
     echo "Still waiting ($i)"
     sleep 5
   done
+}
 
-  echo "Deleting pod"
-  k delete -f "$POD_FILE"
+check_profile_enforcement() {
+  local comamnd="$1"
+  local apparmor_profile="$2"
+  local pid="$(pidof $comamnd)"
+  local enforce="$(cat /proc/${pid}/attr/current)"
+  local reference="$apparmor_profile (enforce)"
+  if [[ "$reference" != "$enforce" ]]; then
+    echo "Apparmor profile $apparmor_profile not enforced: $enforce"
+    exit 1
+  fi
+  echo "Apparmor profile successfully enforced: $enforce"
+}
 
-  wait_for apparmorprofile $APPARMOR_PROFILE_NAME
+record_apparmor_profile() {
+  echo "Enable Apparmor profile"
+  k patch spod spod --type=merge -p '{"spec":{"enableAppArmor":true}}'
+  k rollout status ds spod --timeout 360s
+  k_wait spod spod
+
+  echo "Recording apparmor profile"
+  echo "--------------------------"
+
+  echo "Creating profile recording $RECORDING_NAME"
+  k apply -f $APPARMOR_RECORDING_FILE
 
-  check_apparmor_profile
+  TMP_DIR=$(mktemp -d)
+  trap 'rm -rf $TMP_DIR' EXIT
 
-  echo "Cleaning up profile $APPARMOR_PROFILE_NAME and recording $RECORDING_NAME resources"
+  echo "Creating pod $PODNAME and start recording its apparmor profile"
+  pod_file="${TMP_DIR}/${PODNAME}.yml"
+  create_pod $PODNAME $pod_file
+  wait_for_pod_status "$PODNAME" "Completed"
+  echo "Deleting pod $PODNAME"
+  k delete -f "$pod_file"
+
+  echo "Deleting profile recoridng $RECORDING_NAME"
   k delete -f "$APPARMOR_RECORDING_FILE"
+
+  wait_for apparmorprofile $APPARMOR_PROFILE_NAME
+
+  echo "Verifing apparmor profile"
+  echo "-------------------------"
+
+  echo "Checking the recorded appamror profile matches the reference"
+  apparmor_profile=$(check_apparmor_profile)
+
+  echo "Creating pod $PODNAME with recorded profile in security context"
+  sec_pod_file="${TMP_DIR}/${PODNAME}-apparmor.yml"
+  create_pod $PODNAME $sec_pod_file $apparmor_profile
+  wait_for_pod_status "$PODNAME" "Running"
+
+  echo "Checking apparmor profile enforcement on container"
+  check_profile_enforcement "sleep" $apparmor_profile
+
+  echo "Deleting pod $PODNAME"
+  k delete -f "$sec_pod_file"
+
+  echo "Deleting apparmor profile $APPARMOR_PROFILE_NAME"
   k delete apparmorprofile $APPARMOR_PROFILE_NAME
 }