In this lesson, you will learn how to create a structured test suite to verify that your security policy updates do not inadvertently break the core functionality of your applications.
The Necessity of Regression Testing
When hardening a system with AppArmor, it is easy to accidentally restrict a file path or capability that an application requires for background tasks or error logging. Because these "hidden" features may not trigger during standard manual usage, they often remain broken until a critical moment. To prevent this, you must treat your security profiles like source code: if you change the policy, you must run an automated test suite to verify "normal" operation.
Building a Functional Test Suite
A regression test suite should focus on the "Happy Path"—the set of actions your application must perform to be considered healthy. Instead of testing for security denials, you are testing for functional availability.
Create a simple shell script (e.g., test_app_functionality.sh) that triggers your application’s core features. For a web server, this might look like:
#!/bin/bash
# Functional test for web-server profile
set -e
# 1. Verify index page loads
curl -s http://localhost/ | grep "Welcome" > /dev/null
# 2. Verify write access to log directory
echo "Test log entry" >> /var/log/myapp/test.log
# 3. Verify capability (if required)
# e.g., checking if the app can still bind to port 80
ss -tulpn | grep ":80"
echo "All core features passed!"
Integrating into the Maintenance Cycle
The goal is to run this script every time you modify an AppArmor profile. If the test fails, you know immediately that your "hardened" policy is too aggressive.
By defining this suite, you create a safety net. If you later apply a new constraint—such as restricting ptrace or further limiting file system access—you simply run your suite. If the script exits with a non-zero code, you have a baseline to compare against your audit.log entries, allowing you to quickly identify whether the regression was caused by the new rule or a pre-existing configuration drift.
Key Takeaway: A security profile is only as reliable as the tests that verify it; always pair policy updates with a functional test suite to ensure that "hardened" does not mean "broken."