[tests/selinux] pr775-checkpolicy-revdeps: policycoreutils: Add test for SCTP support in semanage

[tests/selinux] pr775-checkpolicy-revdeps: policycoreutils: Add test for SCTP support in semanage

[Vit Mojzis]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 4c00d6a1368515207adc4c8abaeaa5c4ff4da849
            Author : Vit Mojzis <vmojzis@redhat.com>
            Date   : 2019-11-07T16:12:14+01:00
            Stats  : +126/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/4c00d6a1368515207adc4c8abaeaa5c4ff4da849?branch=pr775-checkpolicy-revdeps

            Log:
            policycoreutils: Add test for SCTP support in semanage

This test simulates a use case where a user wants to confine a
client-server application communicating over SCTP protocol.

A custom policy module is used to introduce a new port type, domain type
for the application and an executable file type for the application
executable as well as a minimal set of allow rules for sctp_test to work
properly.
"semanage port" is then used to define SCTP contexts for ports 1025 and
1026.
Lastly sctp_test is executed in client-server configuration.

---
diff --git a/policycoreutils/sctp_test/main.fmf b/policycoreutils/sctp_test/main.fmf
new file mode 100644
index 0000000..ac19200
--- /dev/null
+++ b/policycoreutils/sctp_test/main.fmf
@@ -0,0 +1,10 @@
+path: /policycoreutils/sctp_test
+summary: Is SCTP supported by "semanage port"?
+description: |
+    Simulates a use case where a user wants to confine a client-server application communicating over SCTP
+    Bug summary: semanage port does not support SCTP protocol
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1563742
+relevancy:
+    - "distro = rhel-4, rhel-5, rhel-6, rhel-7: False"
+
+#requires: [/usr/sbin/semanage, /usr/sbin/semodule, lksctp-tools, psmisc]

diff --git a/policycoreutils/sctp_test/runtest.sh b/policycoreutils/sctp_test/runtest.sh
new file mode 100755
index 0000000..d8f386c
--- /dev/null
+++ b/policycoreutils/sctp_test/runtest.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /selinux/policycoreutils/sctp_test
+#   Description: Is SCTP supported by "semanage port"?
+#   Author: vmojzis <vmojzis@redhat.com>
+#   Simulates a use case where a user wants to confine a client-server application communicating over SCTP
+#   Bug summary: semanage port does not support SCTP protocol
+#   Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1563742
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2019 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="policycoreutils"
+PORT_TYPE="sctp_port_t"
+CLIENT_PORT="1025"
+SERVER_PORT="1026"
+
+# This test simulates a use case where a user wants to confine a client-server
+# application communicating over SCTP protocol
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        # make sure the right version of kernel[-rt]-modules-extra is installed
+        rlRun "dnf install -y kernel-modules-extra-$(uname -r)" 0-255
+        rlRun "dnf install -y kernel-rt-modules-extra-$(uname -r)" 0-255
+        rlRun "modprobe sctp" 0 "Enabling SCTP kernel module"
+        # A custom policy module is used to introduce a new port type, domain type
+        # for the application and an executable file type for the application
+        # executable as well as a minimal set of allow rules for sctp_test to work
+        # properly.
+        rlRun "semodule -i userapp.cil" 0 "Loading custom policy module"
+        rlRun "chcon -t userapp_exec_t `which sctp_test`" 0 "Change file context of sctp_test"
+        OUTPUT_FILE=`mktemp`
+        rlRun "chcon -t tmp_t ${OUTPUT_FILE}"
+        rlRun "setenforce 1"
+        rlRun "sestatus"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "semanage port -a -t ${PORT_TYPE} -p sctp ${SERVER_PORT}" 0
+        rlRun "semanage port -a -t ${PORT_TYPE} -p sctp ${CLIENT_PORT}" 0
+        rlRun "sctp_test -H localhost -P ${SERVER_PORT} -l 2>&1 > ${OUTPUT_FILE} &" 0
+        rlRun "sctp_test -H localhost -P ${CLIENT_PORT} -h localhost -p ${SERVER_PORT} -s" 0
+        rlAssertGrep "recvmsg" ${OUTPUT_FILE} -i
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm ${OUTPUT_FILE}"
+        rlRun "killall sctp_test"
+        rlRun "semanage port -D"
+        rlRun "semodule -r userapp"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

diff --git a/policycoreutils/sctp_test/userapp.cil b/policycoreutils/sctp_test/userapp.cil
new file mode 100644
index 0000000..88e065e
--- /dev/null
+++ b/policycoreutils/sctp_test/userapp.cil
@@ -0,0 +1,40 @@
+(typeattributeset cil_gen_require sssd_t)
+(typeattributeset cil_gen_require user_devpts_t)
+(typeattributeset cil_gen_require userapp_t)
+(typeattributeset cil_gen_require net_conf_t)
+(typeattributeset cil_gen_require userapp_exec_t)
+(typeattributeset cil_gen_require sssd_var_lib_t)
+(typeattributeset cil_gen_require reserved_port_t)
+(typeattributeset cil_gen_require node_t)
+(typeattributeset cil_gen_require kernel_t)
+
+(type sctp_port_t)
+(typeattributeset port_type sctp_port_t)
+(type userapp_t)
+(typeattributeset domain userapp_t)
+(type userapp_exec_t)
+(typeattributeset file_type userapp_exec_t)
+
+(allow userapp_t sctp_port_t (sctp_socket ( name_bind name_connect )))
+(allow userapp_t userapp_t ( sctp_socket ( listen accept )))
+(typetransition unconfined_t userapp_exec_t process userapp_t)
+(allow unconfined_t userapp_exec_t ( file ( getattr open read execute )))
+(allow unconfined_t userapp_t ( process ( transition )))
+(roletype unconfined_r userapp_t)
+
+(allow userapp_t net_conf_t (file (getattr open read)))
+(allow userapp_t node_t (sctp_socket (node_bind)))
+(allow userapp_t reserved_port_t (sctp_socket (name_bind)))
+(allow userapp_t self (capability (net_bind_service)))
+(allow userapp_t self (netlink_route_socket (bind create getattr nlmsg_read read write)))
+(allow userapp_t self (sctp_socket (bind create read setopt connect write)))
+(allow userapp_t self (udp_socket (connect create getattr)))
+(allow userapp_t sssd_t (unix_stream_socket (connectto)))
+(allow userapp_t sssd_var_lib_t (dir (search)))
+(allow userapp_t sssd_var_lib_t (sock_file (write)))
+(allow userapp_t user_devpts_t (chr_file (append getattr read write)))
+(allow userapp_t userapp_exec_t (file (map)))
+(allow userapp_t userapp_exec_t (file (entrypoint execute read)))
+(allow userapp_t kernel_t (system (module_request)))
+
+