[tests/selinux] main: libsemanage: add test for sort-local-fcontexts behavior in semanage.conf

[Petr Lautrbach <lautrbach@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : main
            Commit : 8452f8e3f52fc6b7cc3cc7a28d0e9d21cf2af3e8
            Author : Petr Lautrbach <lautrbach@redhat.com>
            Date   : 2026-09-10T09:36:05+00:00
            Stats  : +85/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/8452f8e3f52fc6b7cc3cc7a28d0e9d21cf2af3e8?branch=main

            Log:
            libsemanage: add test for sort-local-fcontexts behavior in semanage.conf

Add a new beakerlib sanity test that verifies how file_contexts.local
matching behaves with sort-local-fcontexts unset, false, and true.
The test also checks that the option is documented in semanage.conf(5).

Related: BZ#678577
Related: SELinuxProject/selinux#40

---
diff --git a/libsemanage/sort-local-fcontexts-in-semanage-conf/main.fmf b/libsemanage/sort-local-fcontexts-in-semanage-conf/main.fmf
new file mode 100644
index 0000000..9ac3b90
--- /dev/null
+++ b/libsemanage/sort-local-fcontexts-in-semanage-conf/main.fmf
@@ -0,0 +1,18 @@
+summary: Verify sort-local-fcontexts in semanage.conf
+description: |+
+    Verify that sort-local-fcontexts controls whether file_contexts.local
+    matching follows insertion order or specificity order.
+
+contact: Petr Lautrbach <lautrbach@redhat.com>
+component:
+  - libsemanage
+require:
+  - policycoreutils-python-utils
+duration: 10m
+enabled: true
+tag:
+  - CI-Tier-1
+tier: 1
+link:
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=678577
+  - relates: https://github.com/SELinuxProject/selinux/issues/40

diff --git a/libsemanage/sort-local-fcontexts-in-semanage-conf/runtest.sh b/libsemanage/sort-local-fcontexts-in-semanage-conf/runtest.sh
new file mode 100755
index 0000000..7d4d3d5
--- /dev/null
+++ b/libsemanage/sort-local-fcontexts-in-semanage-conf/runtest.sh
@@ -0,0 +1,67 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/libsemanage/Sanity/sort-local-fcontexts-in-semanage-conf
+#   Description: Verify sort-local-fcontexts in semanage.conf
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="libsemanage"
+SEMANAGE_CONF="/etc/selinux/semanage.conf"
+
+set_sort_local_fcontexts()
+{
+    rlRun "sed -i '/^sort-local-fcontexts=/d' ${SEMANAGE_CONF}"
+    rlRun "echo -e '\nsort-local-fcontexts=$1\n' >> ${SEMANAGE_CONF}"
+    rlRun "semodule -B"
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'" 0,1
+        rlAssertRpm ${PACKAGE}
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Create temporary directory"
+        rlRun "semanage fcontext -a -t bin_t '${TmpDir}/subdir/specific(/.*)?'"
+        rlRun "semanage fcontext -a -t etc_t '${TmpDir}/subdir(/.*)?'"
+        rlRun "semanage fcontext -a -t samba_share_t '/shared/samba(/.*)?'"
+        rlRun "semanage fcontext -a -t public_content_t '/shared(/.*)?'"
+
+    rlPhaseEnd
+
+    rlPhaseStartTest "sort-local-fcontexts is documented in semanage.conf(5)"
+        rlRun "man semanage.conf | col -b | grep -A 3 sort-local-fcontexts"
+    rlPhaseEnd
+
+    rlPhaseStartTest "default behavior keeps insertion-order matching"
+        rlSEMatchPathCon "${TmpDir}/subdir/specific/file" "etc_t"
+        rlSEMatchPathCon "/shared/samba" "public_content_t"
+    rlPhaseEnd
+    
+    rlPhaseStartTest "sort-local-fcontexts=false keeps insertion-order matching"
+        rlFileBackup ${SEMANAGE_CONF}
+        set_sort_local_fcontexts "false"
+        rlSEMatchPathCon "${TmpDir}/subdir/specific/file" "etc_t"
+        rlSEMatchPathCon "/shared/samba" "public_content_t"
+        rlFileRestore
+    rlPhaseEnd
+
+    rlPhaseStartTest "sort-local-fcontexts=true file_contexts.local file is sorted from least to most specific"
+        rlFileBackup ${SEMANAGE_CONF}
+        set_sort_local_fcontexts "true"
+        rlSEMatchPathCon "${TmpDir}/subdir/specific/file" "bin_t"
+        rlSEMatchPathCon "/shared/samba" "samba_share_t"
+        rlFileRestore
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf ${TmpDir}" 0 "Remove temporary directory"
+        rlRun "semanage fcontext -d '${TmpDir}/subdir/specific(/.*)?'"
+        rlRun "semanage fcontext -d '${TmpDir}/subdir(/.*)?'"
+        rlRun "semanage fcontext -d '/shared/samba(/.*)?'"
+        rlRun "semanage fcontext -d '/shared(/.*)?'"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd