36 lines
1.1 KiB
C
36 lines
1.1 KiB
C
#define _GNU_SOURCE
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
|
|
int main(void)
|
|
{
|
|
/* 探针1: 白名单文件 —— profile 中 /tmp/demo_elf.log rw, 应当成功 */
|
|
FILE* fp = fopen("/tmp/demo_elf.log","w");
|
|
if(fp){
|
|
fprintf(fp,"elf write ok\n");
|
|
fclose(fp);
|
|
printf("[probe1] write /tmp/demo_elf.log: ALLOWED\n");
|
|
}else{
|
|
perror("[probe1] open /tmp/demo_elf.log");
|
|
}
|
|
|
|
/* 探针2: 显式 deny 规则 —— deny /etc/shadow r, 静默拒绝, 不产生审计日志 */
|
|
fp = fopen("/etc/shadow","r");
|
|
if(fp){
|
|
printf("[probe2] read /etc/shadow: ALLOWED (unexpected!)\n");
|
|
fclose(fp);
|
|
}else{
|
|
perror("[probe2] open /etc/shadow");
|
|
}
|
|
|
|
/* 探针3: 未在 profile 中列出的路径 —— 隐式默认拒绝(enforce), 拒绝并记录 DENIED 日志 */
|
|
fp = fopen("/tmp/demo_forbidden.log","w");
|
|
if(fp){
|
|
fprintf(fp,"should not be here\n");
|
|
fclose(fp);
|
|
printf("[probe3] write /tmp/demo_forbidden.log: ALLOWED (unexpected!)\n");
|
|
}else{
|
|
perror("[probe3] open /tmp/demo_forbidden.log");
|
|
}
|
|
return 0;
|
|
}
|