Added more tests

.gitignore

@@ -2,13 +2,13 @@ build/*
 .clang-tidy
 .cache
 test/protected/*
-test/.pt.db
-*compile_commands.json
 test/perf*
 test/callgraph*
 test/openers
 test/opener/opener
 test/opener/opener.o
+test/.*
+*compile_commands.json
 src/gui/ui/*
 src/gui/*.o
 src/gui/icfs_dialogue

Makefile

@@ -70,7 +70,7 @@ default: $(TARGETS)
 $(BUILD_DIR)/icfs_dialogue:
 	make -C $(SOURCES_DIR)/gui TEST=$(TEST) DEBUG=$(shell realpath $(DEBUG)) SOURCES_DIR=$(shell realpath $(SOURCES_DIR)/gui) BUILD_DIR=$(shell realpath $(BUILD_DIR)) TESTS_DIR=$(shell realpath $(TESTS_DIR))
 
-$(BUILD_DIR)/icfs: $(BUILD_DIR)/main.o $(BUILD_DIR)/fuse_operations.o $(BUILD_DIR)/sourcefs.o $(BUILD_DIR)/ui-socket.o $(BUILD_DIR)/temp_permissions_table.o $(BUILD_DIR)/perm_permissions_table.o
+$(BUILD_DIR)/icfs: $(BUILD_DIR)/main.o $(BUILD_DIR)/fuse_operations.o $(BUILD_DIR)/sourcefs.o $(BUILD_DIR)/ui-socket.o $(BUILD_DIR)/temp_permissions_table.o $(BUILD_DIR)/perm_permissions_table.o $(BUILD_DIR)/proc_operations.o
 	$(CC) $(CFLAGS) $^ $(LDFLAGS) -o $(BUILD_DIR)/icfs
 
 icfs_test: $(BUILD_DIR)/icfs
@@ -97,6 +97,9 @@ $(BUILD_DIR)/temp_permissions_table.o: $(SOURCES_DIR)/temp_permissions_table.c $
 $(BUILD_DIR)/perm_permissions_table.o: $(SOURCES_DIR)/perm_permissions_table.c $(SOURCES_DIR)/perm_permissions_table.h
 	$(CC) $(CFLAGS) -c $< $(LDFLAGS) -o $@
 
+$(BUILD_DIR)/proc_operations.o: $(SOURCES_DIR)/proc_operations.c $(SOURCES_DIR)/proc_operations.h
+	$(CC) $(CFLAGS) -c $< $(LDFLAGS) -o $@
+
 CLEAN_TARGETS=clean-icfs
 
 ifneq ($(DIALOGUE), 0)

src/fuse_operations.c

@@ -39,63 +39,10 @@
 #include <sys/file.h> /* flock(2) */
 
 #include "fuse_operations.h"
+#include "proc_operations.h"
 #include "sourcefs.h"
 #include "ui-socket.h"
 
-char *get_process_name_by_pid(const int pid) {
-  char path[1024];
-  sprintf(path, "/proc/%d/exe", pid);
-
-  char *name = realpath(path, NULL);
-  if (name == NULL) {
-    fprintf(stderr, "Could not get process name by pid %d", pid);
-    perror("");
-  }
-
-  /*
-  size_t namelen = 32;
-  ssize_t readret = 0;
-  char *name = NULL;
-  while (namelen >= (size_t)readret && readret > 0) {
-    namelen *= 2;
-    name = calloc(namelen, sizeof(char));
-    if (name == NULL) {
-      free(path);
-      fprintf(stderr, "Could not get get process name by pid %d", pid);
-      perror("");
-      return NULL;
-    }
-    readret = readlink(path, name, namelen);
-    if (readret < 0) {
-      free(name);
-      free(path);
-      fprintf(stderr, "Couldn't get process name by pid %d", pid);
-      perror("");
-      return NULL;
-    }
-    if (namelen >= (size_t)readret) {
-      free(name);
-    }
-  }
-  */
-
-  return name;
-
-  /*
-  FILE *file = fopen(path, "r");
-  if (file) {
-    size_t size = 0;
-    size = fread(path, sizeof(char), 1024, file);
-    if (size > 0) {
-      if ('\n' == path[size - 1]) {
-        path[size - 1] = '\0';
-      }
-    }
-    fclose(file);
-  }
-  */
-}
-
 static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
   (void)conn;
   cfg->use_ino = 1;

src/perm_permissions_table.c

@@ -8,6 +8,7 @@
 
 #include "perm_permissions_table.h"
 #include "access_t.h"
+#include "proc_operations.h"
 #include "process_info.h"
 #include "set_mode_t.h"
 #include <fcntl.h>
@@ -204,13 +205,16 @@ void destroy_perm_permissions_table(void) { sqlite3_close(perm_database); }
  * @return: access status - ALLOW, DENY or NDEF in case if no information was
  * found
  */
-access_t check_perm_access(const char *filename, struct process_info pi) {
+access_t check_perm_access_noparent(const char *filename,
+                                    struct process_info pi) {
 
   char *query = NULL;
   int ret = asprintf(&query,
                      "SELECT * FROM %s WHERE executable = \'%s\' "
-                     "AND filename = \'%s\';",
-                     table_name, pi.name, filename);
+                     "AND ((\'%s\' LIKE CONCAT(filename, \'%%\') AND filename "
+                     "GLOB \'*/\') OR filename = \'%s\');",
+                     table_name, pi.name, filename, filename);
+  fprintf(stderr, "query: %s\n", query);
 
   if (ret < 0) {
     // If asprintf fails, the contents of query are undefined (see man
@@ -241,6 +245,45 @@ access_t check_perm_access(const char *filename, struct process_info pi) {
   return NDEF;
 }
 
+/**
+ * Checks if the process or any of it's parents have permanent access to the
+ * file.
+ *
+ * @param filename: The file that the process is trying to access
+ * @pram pi: The process information
+ * @return: access status - ALLOW, DENY or NDEF in case if no information was
+ * found. Does not return ALLOW_TEMP or DENY_TEMP.
+ * @note: In case one of the parent processes is killed while this function
+ * execution the result is not guranteed to be correct. It should only lead to
+ * false negatives, though.
+ */
+access_t check_perm_access(const char *filename, struct process_info pi) {
+  if (pi.PID == 0) {
+    return NDEF;
+  }
+
+  struct process_info current_pi = pi;
+  current_pi.name = strdup(current_pi.name);
+  while (current_pi.PID != 0) {
+    access_t access = check_perm_access_noparent(filename, current_pi);
+    free(current_pi.name);
+    if (access != NDEF) {
+      return access;
+    }
+    current_pi.name = NULL;
+    while (current_pi.name == NULL) {
+      current_pi.PID = get_parent_pid(current_pi.PID);
+      if (current_pi.PID != 0) {
+        current_pi.name = get_process_name_by_pid(current_pi.PID);
+      } else {
+        break;
+      }
+    }
+  }
+
+  return NDEF;
+}
+
 /**
  * Gives permanent access to the process to the file.
  *

src/proc_operations.c

@@ -0,0 +1,45 @@
+#include "proc_operations.h"
+#include <stdio.h>
+#include <stdlib.h>
+
+char *get_process_name_by_pid(const int pid) {
+  char path[1024];
+  sprintf(path, "/proc/%d/exe", pid);
+
+  char *name = realpath(path, NULL);
+  if (name == NULL) {
+    fprintf(stderr, "Could not get process name by pid %d", pid);
+    perror("");
+  }
+  return name;
+}
+
+/**
+ * Finds the parent process ID of a given process.
+ *
+ * @param pid: The process ID of the process to find the parent of
+ * @return: The parent process ID, or 0 if the parent process ID could not be
+ * found
+ */
+pid_t get_parent_pid(pid_t pid) {
+  pid_t ppid = 0;
+  char path[256];
+  snprintf(path, sizeof(path), "/proc/%u/status", pid);
+
+  FILE *file = fopen(path, "r");
+  if (file == NULL) {
+    perror("Failed to open /proc/<pid>/status");
+    return 0;
+  }
+
+  char line[256];
+  while (fgets(line, sizeof(line), file)) {
+    if (sscanf(line, "PPid:\t%d", &ppid) == 1) {
+      fclose(file);
+      return ppid;
+    }
+  }
+
+  fclose(file);
+  return 0; // Parent PID not found
+}

src/proc_operations.h

@@ -0,0 +1,17 @@
+#ifndef PROC_OPERATIONS
+#define PROC_OPERATIONS
+
+#include <time.h>
+
+char *get_process_name_by_pid(const int pid);
+
+/**
+ * Finds the parent process ID of a given process.
+ *
+ * @param pid: The process ID of the process to find the parent of
+ * @return: The parent process ID, or 0 if the parent process ID could not be
+ * found
+ */
+pid_t get_parent_pid(pid_t pid);
+
+#endif // !PROC_OPERATIONS

src/temp_permissions_table.c

@@ -9,9 +9,12 @@
 #include "temp_permissions_table.h"
 #include "access_t.h"
 #include "cc.h"
+#include "proc_operations.h"
 #include "process_info.h"
 #include <pthread.h>
+#include <stddef.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/types.h>
 
 struct temp_process_permissions {
@@ -126,14 +129,23 @@ access_t check_temp_access_noparent(const char *filename, pid_t pid) {
     if (process_creation_time == permission_entry->creation_time) {
       // the process is the same as the one that was granted temporary access
       // to the file
+      size_t filename_len = strlen(filename);
       for_each(&permission_entry->denied_files, denied_file) {
-        if (strncmp(*denied_file, filename, strlen(filename)) == 0) {
+        size_t denied_file_len = strlen(*denied_file);
+        if (strncmp(*denied_file, filename, denied_file_len) == 0 &&
+            ((denied_file_len < filename_len &&
+              (*denied_file)[denied_file_len - 1] == '/') ||
+             (denied_file_len == filename_len))) {
           pthread_mutex_unlock(&temp_permissions_table_lock);
           return DENY;
         }
       }
       for_each(&permission_entry->allowed_files, allowed_file) {
-        if (strncmp(*allowed_file, filename, strlen(filename)) == 0) {
+        size_t allowed_file_len = strlen(*allowed_file);
+        if (strncmp(*allowed_file, filename, allowed_file_len) == 0 &&
+            ((allowed_file_len < filename_len &&
+              (*allowed_file)[allowed_file_len - 1] == '/') ||
+             (allowed_file_len == filename_len))) {
           pthread_mutex_unlock(&temp_permissions_table_lock);
           return ALLOW;
         }
@@ -144,36 +156,6 @@ access_t check_temp_access_noparent(const char *filename, pid_t pid) {
   return NDEF;
 }
 
-/**
- * Finds the parent process ID of a given process.
- *
- * @param pid: The process ID of the process to find the parent of
- * @return: The parent process ID, or 0 if the parent process ID could not be
- * found
- */
-pid_t get_parent_pid(pid_t pid) {
-  pid_t ppid = 0;
-  char path[256];
-  snprintf(path, sizeof(path), "/proc/%u/status", pid);
-
-  FILE *file = fopen(path, "r");
-  if (file == NULL) {
-    perror("Failed to open /proc/<pid>/status");
-    return 0;
-  }
-
-  char line[256];
-  while (fgets(line, sizeof(line), file)) {
-    if (sscanf(line, "PPid:\t%d", &ppid) == 1) {
-      fclose(file);
-      return ppid;
-    }
-  }
-
-  fclose(file);
-  return 0; // Parent PID not found
-}
-
 /**
  * Checks if the process or any of it's parents have temporary access to the
  * file.

src/ui-socket.c

@@ -26,9 +26,9 @@
 #include <sys/un.h>
 #include <unistd.h>
 
-#define ZENITY_YES 0
-#define ZENITY_NO 1
-#define ZENITY_PERM 2
+#define DIALOGUE_YES 0
+#define DIALOGUE_NO 1
+#define DIALOGUE_PERM 2
 
 struct dialogue_response {
   access_t decision;
@@ -48,7 +48,7 @@ int init_ui_socket(const char *perm_permissions_db_filename) {
     return 1;
   }
 
-  // Test if Zenity is installed (get version)
+  // Test if dialogue is installed (get version)
   fp = popen("icfs_dialogue --version", "r");
   if (fp == NULL) {
     perror("Pipe returned an error");
@@ -93,12 +93,12 @@ struct dialogue_response ask_access(const char *filename,
     perror("");
     response.decision = DENY;
     response.filename = malloc(2);
-    response.filename[0] = '.';
+    response.filename[0] = '/';
     response.filename[1] = 0;
     return response;
   }
 
-  // Zenity Question Message Popup
+  // dialogue Question Message Popup
   fp = popen(command, "r");
   free(command);
 
@@ -106,43 +106,43 @@ struct dialogue_response ask_access(const char *filename,
     perror("Pipe returned a error");
     response.decision = DENY;
     response.filename = malloc(2);
-    response.filename[0] = '.';
+    response.filename[0] = '/';
     response.filename[1] = 0;
     return response;
   }
 
-  str(char) zenity_output;
-  init(&zenity_output);
+  str(char) dialogue_output;
+  init(&dialogue_output);
 
   char line[1024]; // Buffer to read individual lines
 
   // Read the command output line by line
   while (fgets(line, sizeof(line), fp)) {
-    push_fmt(&zenity_output, line);
+    push_fmt(&dialogue_output, line);
   }
 
-  int zenity_exit_code = WEXITSTATUS(pclose(fp));
-  fprintf(stderr, "zenity wrote out %s\n", first(&zenity_output));
-  fprintf(stderr, "zenity returned %d\n", zenity_exit_code);
+  int dialogue_exit_code = WEXITSTATUS(pclose(fp));
+  fprintf(stderr, "dialogue wrote out %s\n", first(&dialogue_output));
+  fprintf(stderr, "dialogue returned %d\n", dialogue_exit_code);
 
-  // if (size(&zenity_output) == 0) {
-  //   push(&zenity_output, '.');
-  // }
+  if (size(&dialogue_output) == 0) {
+    push(&dialogue_output, '/');
+  }
 
-  assert(strlen(first(&zenity_output)) == size(&zenity_output));
+  assert(strlen(first(&dialogue_output)) == size(&dialogue_output));
 
-  response.filename = malloc(size(&zenity_output) + 1);
-  strcpy(response.filename, first(&zenity_output));
-  // response.filename[size(&zenity_output)] = 0;
+  response.filename = malloc(size(&dialogue_output) + 1);
+  strcpy(response.filename, first(&dialogue_output));
+  // response.filename[size(&dialogue_output)] = 0;
 
-  // assert(0 == strcmp(response.filename, first(&zenity_output)));
-  cleanup(&zenity_output);
+  // assert(0 == strcmp(response.filename, first(&dialogue_output)));
+  cleanup(&dialogue_output);
 
-  if (zenity_exit_code == (ZENITY_YES | ZENITY_PERM)) {
+  if (dialogue_exit_code == (DIALOGUE_YES | DIALOGUE_PERM)) {
     response.decision = ALLOW;
-  } else if (zenity_exit_code == ZENITY_YES) {
+  } else if (dialogue_exit_code == DIALOGUE_YES) {
     response.decision = ALLOW_TEMP;
-  } else if (zenity_exit_code == (ZENITY_NO | ZENITY_PERM)) {
+  } else if (dialogue_exit_code == (DIALOGUE_NO | DIALOGUE_PERM)) {
     response.decision = DENY;
   } else {
     response.decision = DENY_TEMP;
@@ -225,7 +225,6 @@ int interactive_access(const char *filename, struct process_info proc_info,
   // the user might specify a different file in the dialogue, so we need to
   // check if it is valid
 
-  /*
   while (source_access(response.filename, F_OK)) {
     // if it is invalid, just ask again.
     fprintf(stderr, "Filename returned by zenty wasn't correct: %s\n",
@@ -233,7 +232,7 @@ int interactive_access(const char *filename, struct process_info proc_info,
     free(response.filename);
     response = ask_access(filename, proc_info);
   }
-  */
+
   free(real_path);
 
   real_path = real_filename(response.filename);

test/mock/icfs_dialogue

@@ -1,29 +1,41 @@
 #!/bin/bash
 
-# fake-zenity: script that mocks the behavior of zenity based on the ./.fake-zenity-response file
+# fake-icfs_dialogue: script that mocks the behavior of icfs_dialogue based on the ./.fake-icfs_dialogue-response file
 
-ZENITY_YES=0
-ZENITY_NO=1
-ZENITY_PERM=2
+ICFS_DIALOGUE_YES=0
+ICFS_DIALOGUE_NO=1
+ICFS_DIALOGUE_PERM=2
 
 if [[ $1 == "--set-fake-response" ]]; then
   #someone knows we are fake :)
-  echo "$2" >~/.fake_zenity_response
+  echo "$2" >~/.fake_icfs_dialogue_response
+elif [[ $1 == "--set-fake-response-filename" ]]; then
+  echo "$2" >~/.fake_icfs_dialogue_response_filename
+elif [[ $1 == "--reset-fake-response" ]]; then
+  rm ~/.fake_icfs_dialogue_response ~/.fake_icfs_dialogue_response_filename
 else
-  if [ -f ~/.fake_zenity_response ]; then
-    FAKE_ZENITY_RESPONSE=$(cat ~/.fake_zenity_response)
+  if [ -f ~/.fake_icfs_dialogue_response ]; then
+    FAKE_ICFS_DIALOGUE_RESPONSE=$(cat ~/.fake_icfs_dialogue_response)
 
-    printf "%s" "$4"
-    if [[ $FAKE_ZENITY_RESPONSE == "yes" ]]; then
-      exit "$ZENITY_YES"
-    elif [[ $FAKE_ZENITY_RESPONSE == "no" ]]; then
-      exit "$ZENITY_NO"
-    elif [[ $FAKE_ZENITY_RESPONSE == "yes_perm" ]]; then
-      exit "$((ZENITY_YES | ZENITY_PERM))"
-    elif [[ $FAKE_ZENITY_RESPONSE == "no_perm" ]]; then
-      exit "$((ZENITY_NO | ZENITY_PERM))"
+    if [[ -f ~/.fake_icfs_dialogue_response_filename ]]; then
+      FAKE_ICFS_DIALOGUE_RESPONSE_FILENAME=$(cat ~/.fake_icfs_dialogue_response_filename)
+      if [[ $FAKE_ICFS_DIALOGUE_RESPONSE_FILENAME == "" ]]; then
+        printf "%s" "$4"
+      else
+        printf "%s" "$(cat ~/.fake_icfs_dialogue_response_filename)"
+      fi
+    fi
+
+    if [[ $FAKE_ICFS_DIALOGUE_RESPONSE == "yes" ]]; then
+      exit "$ICFS_DIALOGUE_YES"
+    elif [[ $FAKE_ICFS_DIALOGUE_RESPONSE == "no" ]]; then
+      exit "$ICFS_DIALOGUE_NO"
+    elif [[ $FAKE_ICFS_DIALOGUE_RESPONSE == "yes_perm" ]]; then
+      exit "$((ICFS_DIALOGUE_YES | ICFS_DIALOGUE_PERM))"
+    elif [[ $FAKE_ICFS_DIALOGUE_RESPONSE == "no_perm" ]]; then
+      exit "$((ICFS_DIALOGUE_NO | ICFS_DIALOGUE_PERM))"
     fi
   fi
 fi
 
-exit 255 # TODO: call actual zenity here
+exit 255 # TODO: call actual icfs_dialogue here

test/opener/opener.c

@@ -1,20 +1,86 @@
-
-
+#include <dirent.h>
+#include <errno.h>
 #include <fcntl.h>
 #include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
+
+#define PATH_MAX 4096
+
 int main(int argc, char *argv[]) {
+  // Check for correct usage
   if (argc != 2) {
-    fprintf(stderr, "Usage: ./opener [FILENAME]");
+    fprintf(stderr, "Usage: %s <pathname>\n", argv[0]);
     return 1;
   }
 
-  int fd = open(argv[1], O_RDWR | O_CREAT);
-  if (fd == -1) {
-    perror("Cannot open file");
+  const char *path = argv[1];
+  struct stat statbuf;
+
+  // Stat the given path to determine if it's a directory
+  if (lstat(path, &statbuf) == -1) {
+    perror("lstat");
     return 1;
   }
-  close(fd);
 
-  return 0;
+  // Case 1: The path is not a directory
+  if (!S_ISDIR(statbuf.st_mode)) {
+    int fd = open(path, O_RDONLY);
+    if (fd == -1) {
+      perror("open");
+      return 1;
+    }
+    close(fd);
+    return 0;
+  }
+
+  // Case 2: The path is a directory
+  DIR *dirp = opendir(path);
+  if (dirp == NULL) {
+    perror("opendir");
+    return 1;
+  }
+
+  struct dirent *entry;
+  int success = 1;
+
+  while ((entry = readdir(dirp)) != NULL) {
+    // Skip . and ..
+    if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) {
+      continue;
+    }
+
+    // Construct the full path
+    char fullpath[PATH_MAX];
+    snprintf(fullpath, PATH_MAX, "%s/%s", path, entry->d_name);
+
+    // Stat the entry to check if it's a regular file
+    struct stat entry_stat;
+    if (lstat(fullpath, &entry_stat) == -1) {
+      perror("lstat");
+      success = 0;
+      break;
+    }
+
+    // Only process regular files
+    if (!S_ISREG(entry_stat.st_mode)) {
+      continue;
+    }
+
+    // Try to open and immediately close the file
+    int fd = open(fullpath, O_RDONLY);
+    if (fd == -1) {
+      perror("open");
+      success = 0;
+      break;
+    }
+    close(fd);
+  }
+
+  closedir(dirp);
+
+  return (success ? 0 : 1);
 }

test/test.bash

@@ -9,6 +9,13 @@ touch ./protected/do-not-remove ./protected/should-be-removed ./protected/truth
 chmod 777 ./protected/perm777 ./protected/perm000
 echo "Free code, free world." >./protected/motto
 
+mkdir protected/haystack
+for i in {1..10}; do
+  touch "./protected/haystack/hay$i"
+done
+touch ./protected/haystack/needle
+echo "Liberty in every line." >./protected/haystack/needle
+
 rm -rf ./openers
 mkdir openers
 make -C ./opener || (
@@ -151,16 +158,56 @@ openers/symlinked_opener2 ./protected/motto >/dev/null 2>/dev/null &&
   echo "[ICFS-TEST]: openers/symlinked_opener2 can read protected/motto despite access being denied!" ||
   echo "[ICFS-TEST]: OK" # EACCESS
 
+# test permission globbing
+
+icfs_dialogue --set-fake-response yes
+icfs_dialogue --set-fake-response-filename "/"
+openers/opener3 ./protected/haystack >/dev/null 2>/dev/null &&
+  echo "[ICFS-TEST]: OK" ||
+  echo "[ICFS-TEST]: openers/opener3 cannot read protected/haystack/needle despite access being permitted!" # OK
+
+icfs_dialogue --set-fake-response no
+icfs_dialogue --set-fake-response-filename "/"
+openers/opener4 ./protected/haystack >/dev/null 2>/dev/null &&
+  echo "[ICFS-TEST]: openers/opener4 can read files in protected/haystack despite access being denied!" ||
+  echo "[ICFS-TEST]: OK" # EACCESS
+
+icfs_dialogue --set-fake-response yes_perm
+icfs_dialogue --set-fake-response-filename "/"
+openers/opener5 ./protected/haystack/needle >/dev/null 2>/dev/null &&
+  echo "[ICFS-TEST]: OK" ||
+  echo "[ICFS-TEST]: openers/opener5 cannot read protected/haystack/needle despite access being permitted!" # OK
+
+icfs_dialogue --set-fake-response no # this should be ignored
+openers/opener5 ./protected/haystack >/dev/null 2>/dev/null &&
+  echo "[ICFS-TEST]: OK" ||
+  echo "[ICFS-TEST]: openers/opener5 cannot read files in protected/haystack despite access being permitted!" # OK
+
+icfs_dialogue --set-fake-response no_perm
+icfs_dialogue --set-fake-response-filename "/"
+openers/opener6 ./protected/haystack/needle >/dev/null 2>/dev/null &&
+  echo "[ICFS-TEST]: openers/opener6 can read protected/haystack/needle despite access being denied!" ||
+  echo "[ICFS-TEST]: OK" # EACCESS
+
+icfs_dialogue --set-fake-response yes # this should be ignored
+openers/opener6 ./protected/haystack >/dev/null 2>/dev/null &&
+  echo "[ICFS-TEST]: openers/opener6 can read files in protected/haystack despite access being denied!" ||
+  echo "[ICFS-TEST]: OK" # EACCESS
+
 # test database access
-if [[ -r "./.pt.db" || -w "./.pt.db" ]]; then
-  echo "[ICFS-TEST]: permanent permissions is accessible!"
+if [[ $1 == '--setuid' ]]; then
+  if [[ -r "./.pt.db" || -w "./.pt.db" ]]; then
+    echo "[ICFS-TEST]: permanent permissions database is accessible!"
+  else
+    echo "[ICFS-TEST]: OK"
+  fi
 else
-  echo "[ICFS-TEST]: OK"
+  echo "[ICFS-TEST]: permanent permissions database access was not tested due to the lack of seuid bit setting capabilites. To test this, run the script with '--setuid' flag"
 fi
 
 # unmount
 
 sleep 0.5
 #lsof +f -- $(realpath ./protected)
-umount $(realpath ./protected)
+umount "$(realpath ./protected)"
 sleep 0.5