[tests/selinux] pr775-checkpolicy-revdeps: kernel: Add selinux-testsuite test

[Ondrej Mosnacek <omosnace@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 8d561265862d3c32320e1836da90167dd6fc6f7c
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2019-12-06T13:42:36+01:00
            Stats  : +414/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/8d561265862d3c32320e1836da90167dd6fc6f7c?branch=pr775-checkpolicy-revdeps

            Log:
            kernel: Add selinux-testsuite test

Add the beakerlib wrapper for selinux-testuite so it can be used from
elsewhere.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf
new file mode 100644
index 0000000..f1f177f
--- /dev/null
+++ b/kernel/selinux-testsuite/main.fmf
@@ -0,0 +1,9 @@
+path: /kernel/selinux-testsuite
+
+summary: Wrapper for selinux-testuite
+description: |
+    This TC runs a functional test suite for the LSM-based SELinux security module.
+duration: 60m
+relevancy:
+    - "distro = rhel-4: False"
+tier: 1

diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
new file mode 100755
index 0000000..0f9151c
--- /dev/null
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -0,0 +1,402 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/selinux-policy/Sanity/serge-testsuite
+#   Description: functional test suite for the LSM-based SELinux security module
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2014 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+
+# Default commit to checkout from the repo.
+# This should be updated as needed after verifying that the new version
+# doesn't break testing and after applying all necessary tweaks in the TC.
+# Run with GIT_BRANCH=master to run the latest upstream version.
+DEFAULT_COMMIT="b03e3453786cb20a16546d7743d31e5f26bfda3d"
+# Default pull requests to merge before running the test.
+# If non-empty, then after checking out GIT_BRANCH the listed upstream pull
+# requests (by number) are merged, creating a new temporary local branch.
+DEFAULT_PULLS=""
+# Default SELinux Patchwork series to apply before running the test.
+DEFAULT_PATCHES="208221 207155"
+
+# Optional test parameter - location of testuite git.
+GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"}
+
+# Optional test parameter - branch containing tests.
+if [ -z "$GIT_BRANCH" ]; then
+    GIT_BRANCH="$DEFAULT_COMMIT"
+    # Use default cherries only if branch is default and they are not overriden
+    GIT_PULLS="${GIT_PULLS:-"$DEFAULT_PULLS"}"
+    GIT_PATCHES="${GIT_PATCHES:-"$DEFAULT_PATCHES"}"
+fi
+
+# Check if pipefail is enabled to restore original setting.
+# See: https://unix.stackexchange.com/a/73180
+if false | true; then
+    PIPEFAIL_ENABLE="set -o pipefail"
+    PIPEFAIL_DISABLE="set +o pipefail"
+else
+    PIPEFAIL_ENABLE=""
+    PIPEFAIL_DISABLE=""
+fi
+
+if rlIsRHEL 5 ; then
+    # On RHEL-5 sort -V doesn't work, so just pretend we have the oldest kernel
+    function kver_ge() { false; }
+    function kver_lt() { true;  }
+    function kver_le() { true;  }
+    function kver_gt() { false; }
+else
+    function version_le() {
+        { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2"
+    }
+
+    function kver_ge() { version_le "$1" "$(uname -r)"; }
+    function kver_lt() { ! kver_ge "$1"; }
+    function kver_le() { version_le "$(uname -r)" "$1"; }
+    function kver_gt() { ! kver_le "$1"; }
+fi
+
+function installDepsYum() {
+    local yum="$1"; shift
+
+    if "$yum" --help | grep -q -- --skip-broken; then
+        "$yum" install -y --skip-broken $*
+    else
+        for req in $*; do
+            if ! rpm -q --quiet --whatprovides "$req"; then
+                "$yum" install -y "$req" || true
+            fi
+        done
+    fi
+}
+
+function installDeps() {
+    if type yum >/dev/null; then
+        installDepsYum yum "$@"
+    elif type dnf >/dev/null; then
+        installDepsYum dnf "$@"
+    fi
+}
+
+function boolGet() {
+    getsebool "$1" | cut -d ' ' -f 3
+}
+function boolSet() {
+    getsebool -a | cut -d ' ' -f 1 | grep "^$1\$" || return 0
+    setsebool "$1" "$2" || return 1
+    [ "$(boolGet "$1")" == "$2" ]
+}
+
+
+rlJournalStart
+    rlPhaseStartSetup "Install"
+        # We need to install the kernel-* packages by ourselves, since we need
+        # the same versions as the running kernel. And since we already need a
+        # reliable package install function, let's just install all the
+        # dependencies here. Thus we don't need to maintain duplicate lists of
+        # package requirements in many places (RH repo, Fedora kernel dist-git,
+        # CKI).
+        PKG_SUFFIX=""
+        KERNEL_VERSION="$(uname -r)"
+        PKG_VERSION="${KERNEL_VERSION%+debug}"
+        if [ "$PKG_VERSION" != "$KERNEL_VERSION" ]; then
+            rlLog "Detected debug kernel running."
+            PKG_SUFFIX="-debug"
+        fi
+
+        REQUIRES="
+            kernel$PKG_SUFFIX-modules-extra-$PKG_VERSION
+            kernel-rt$PKG_SUFFIX-modules-extra-$PKG_VERSION
+            kernel$PKG_SUFFIX-devel-$PKG_VERSION
+            kernel-rt$PKG_SUFFIX-devel-$PKG_VERSION
+            /usr/bin/unbuffer
+            attr
+            audit
+            checkpolicy
+            curl
+            elfutils-libelf-devel
+            expect
+            gcc
+            git
+            grep
+            ipsec-tools
+            keyutils-libs-devel
+            libbpf-devel
+            libibverbs-devel
+            libselinux
+            libselinux-devel
+            libselinux-utils
+            libsemanage
+            libsepol-devel
+            lksctp-tools-devel
+            mktemp
+            nc
+            netlabel_tools
+            net-tools
+            nmap-ncat
+            perl-Test
+            perl-Test-Harness
+            perl-Test-Simple
+            platform-python
+            policycoreutils
+            policycoreutils-devel
+            policycoreutils-python
+            python3
+            python2-lxml
+            python3-lxml
+            rdma-core-devel
+            selinux-policy
+            selinux-policy-devel
+            setools-console
+            which
+        "
+        rlRun "installDeps \$REQUIRES" 0 "Install requires"
+    rlPhaseEnd
+
+    rlPhaseStartSetup
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm audit
+        rlAssertRpm kernel
+        rlFileBackup /etc/selinux/semanage.conf
+        # running the testsuite in /tmp causes permission denied messages
+        # rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        # rlRun "pushd $TmpDir"
+
+        if ! rlIsRHEL 5 ; then
+            # version_le() sanity check:
+            rlRun "version_le 4.10 4.10"
+            rlRun "version_le 4.10 4.10.0"
+            rlRun "version_le 4.10 4.10.1"
+            rlRun "! version_le 4.10 4.9"
+            rlRun "! version_le 4.10.0 4.10"
+        fi
+
+        # test turns this boolean off
+        rlRun "BACKUP_allow_domain_fd_use=\$(boolGet allow_domain_fd_use)"
+        rlRun "BACKUP_domain_can_mmap_files=\$(boolGet domain_can_mmap_files)"
+        # test expects that domains cannot map files by default
+        rlRun "boolSet domain_can_mmap_files off"
+
+        rlRun "setenforce 1"
+        rlRun "sestatus"
+        if grep 'expand-check' /etc/selinux/semanage.conf; then
+            rlRun "sed -i 's/^expand-check[ ]*=.*$/expand-check = 0/' /etc/selinux/semanage.conf"
+        else
+            rlRun "echo 'expand-check = 0' >>/etc/selinux/semanage.conf"
+        fi
+        if [ ! -d selinux-testsuite ] && rlRun "git clone $GIT_URL" 0; then
+            rlRun "pushd selinux-testsuite"
+            rlRun "git checkout $GIT_BRANCH" 0
+            for _ in $GIT_PULLS $GIT_PATCHES; do
+                rlRun "git config --global user.email nobody@redhat.com"
+                rlRun "git config --global user.name 'Nemo Nobody'"
+                rlRun "git checkout -b testing-cherry-picks" 0
+                break
+            done
+            for pull in $GIT_PULLS; do
+                ref="refs/pull/$pull/head"
+                if ! rlRun "git fetch origin $ref:$ref" 0; then
+                    rlRun "git checkout $GIT_BRANCH" 0
+                    rlWarn "PR merge failed, falling back to GIT_BRANCH"
+                    break
+                fi
+                if ! rlRun "git merge --no-edit $ref" 0; then
+                    rlRun "git merge --abort" 0
+                    rlRun "git checkout $GIT_BRANCH" 0
+                    rlWarn "PR merge failed, falling back to GIT_BRANCH"
+                    break
+                fi
+            done
+            for pwseries in $GIT_PATCHES; do
+                url="https://patchwork.kernel.org/series/$pwseries/mbox/"
+                if ! rlRun "curl $url | git am -"; then
+                    rlRun "git checkout $GIT_BRANCH" 0
+                    rlWarn "Applying patch failed, falling back to GIT_BRANCH"
+                    break
+                fi
+            done
+            rlRun "popd"
+        fi
+
+        if [ -d selinux-testsuite ]; then
+            rlRun "pushd selinux-testsuite"
+
+            # backup code before making tweaks
+            rlFileBackup "."
+
+            if [ "$VERBOSE" = "1" ]; then
+                rlRun "sed -i 's/\(use Test::Harness;\)/\1 \$Test::Harness::verbose = TRUE;/' tests/runtests.pl" 0 \
+                    "Enable verbose output"
+            fi
+
+            exclude_tests=""
+            for file in ./tests/nnp*/execnnp.c; do
+                rlRun "sed -i 's/3.18/3.9/' $file" 0 \
+                    "Fix up kernel version in nnp test"
+            done
+            if rlIsRHEL ; then
+                rlRun "sed -i 's/4.20.17/4.18/' tests/Makefile" 0 \
+                    "Fix up kernel version for sctp test"
+                rlRun "sed -i 's/5.2/4.18.0-80.19/' tests/Makefile" 0 \
+                    "Fix up kernel version for cgroupfs_label test"
+                # CONFIG_KEYS_DH_COMPUTE not enabled on RHEL-8 :(
+                exclude_tests+=" keys"
+            fi
+            if rlIsRHEL 5 ; then
+                rlRun "sed -i '/unconfined_devpts_t/d' policy/test_policy.if" 0
+
+                rlRun "sed -i 's/read_file_perms/r_file_perms/'  policy/*.te" 0
+                rlRun "sed -i 's/mmap_file_perms/rx_file_perms/' policy/*.te" 0
+                rlRun "sed -i 's/list_dir_perms/r_dir_perms/'    policy/*.te" 0
+                rlRun "sed -i 's/ open / /'                      policy/*.te" 0
+
+                rlRun "sed -i 's/^sysadm_bin_spec_domtrans_to/userdom_sysadm_bin_spec_domtrans_to/' policy/*.te" 0
+
+                rlRun "sed -i 's/^corecmd_exec_bin(\(.*\))$/corecmd_exec_bin(\1)\ncorecmd_exec_sbin(\1)/' policy/*.te" 0
+                rlRun "sed -i 's/^corecmd_bin_entry_type(\(.*\))$/corecmd_bin_entry_type(\1)\ncorecmd_sbin_entry_type(\1)/' policy/*.te" 0
+                rlRun "sed -i 's/^userdom_search_user_home_dirs(\(.*\))$/userdom_search_user_home_dirs(user, \1)/' policy/*.te" 0
+            fi
+            if ! [ -x /usr/bin/python3 ]; then
+                # to avoid error messages like runcon: ‘overlay/access’: No such file or directory
+                rlRun "rpm -qa | grep python | sort"
+                rlRun "sed -i 's/python3\$/python2/' tests/overlay/access" 0 \
+                    "Fix up Python shebang in overlay test"
+            fi
+
+            if kver_lt "3.10.0-349"; then
+                # c4684bbdac07 [security] selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID
+                # da74590f6501 [security] selinux: reject setexeccon() on MNT_NOSUID applications with -EACCES
+                exclude_tests+=" nnp_nosuid"
+            fi
+
+            if kver_lt "3.10.0-693"; then
+                # I don't know when exactly this test starts passing, so I'm just
+                # disabling it for anything below the RHEL-7.4 kernel...
+                exclude_tests+=" inet_socket"
+            fi
+
+            if kver_lt "3.10.0-875"; then
+                rlLog "No xperms support => disable xperms testing"
+                rlRun "sed -i '/TARGETS += test_ioctl_xperms\.te/d' policy/Makefile"
+                rlRun "sed -i 's/\$kernver >= 30/\$kernver >= 999999/' tests/ioctl/test"
+            fi
+            # workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1613056
+            # (if running kernel version sorts inside the known-bug window, then
+            # we need to apply the workaround)
+            if kver_ge "3.10.0-875" && kver_lt "3.10.0-972"; then
+                rlLog "Applying workaround for BZ 1613056..."
+                rlRun "cat >>policy/test_ipc.te <<<'allow_map(ipcdomain, tmpfs_t, file)'"
+                rlRun "cat >>policy/test_mmap.te <<<'allow_map(test_execmem_t, tmpfs_t, file)'"
+                rlRun "cat >>policy/test_mmap.te <<<'allow_map(test_no_execmem_t, tmpfs_t, file)'"
+            fi
+
+            if rlIsRHEL || [ "$(rlGetPrimaryArch)" != x86_64 ]; then
+                rlRun "sed -i '/SUBDIRS += bpf/d;/export CFLAGS += -DHAVE_BPF/d' tests/Makefile" 0 \
+                    "Disable BPF tests on RHEL and non-x86_64 Fedora"
+            fi
+
+            if [ -n "$exclude_tests" ] ; then
+                rlRun "sed -i '/^[^[:space:]]*:\(\| .*\)\$/i SUBDIRS:=\$(filter-out $exclude_tests, \$(SUBDIRS))' tests/Makefile" 0 \
+                    "Exclude not applicable tests: $exclude_tests"
+            fi
+
+            if ! modprobe sctp 2>/dev/null; then
+                script1='s/runcon -t test_sctp_socket_t/true/g'
+                script2='s/runcon -t test_no_sctp_socket_t/false/g'
+                rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \
+                    "No SCTP support => fix up extended_socket_class test"
+            fi
+
+            # on aarch64 and s390x the kernel support for Bluetooth is turned
+            # off so we disable the Bluetooth socket tests there
+            case "$(rlGetPrimaryArch)" in
+                aarch64|s390x)
+                    script1='s/runcon -t test_bluetooth_socket_t/true/g'
+                    script2='s/runcon -t test_no_bluetooth_socket_t/false/g'
+                    rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \
+                        "No Bluetooth support => fix up extended_socket_class test"
+                    ;;
+            esac
+
+            # Initialize report.
+            rlRun "echo 'Remote: $GIT_URL' >results.log" 0
+            rlRun "echo 'Branch: $GIT_BRANCH' >>results.log" 0
+            rlRun "echo 'Commit: $(git rev-parse $GIT_BRANCH)' >>results.log" 0
+            rlRun "echo 'GH PRs: ${GIT_PULLS:-"(none)"}' >>results.log" 0
+            rlRun "echo 'Series: ${GIT_PATCHES:-"(none)"}' >>results.log" 0
+            rlRun "echo 'Kernel: $(uname -r)' >>results.log" 0
+            rlRun "echo 'Policy: $(rpm -q selinux-policy)' >>results.log" 0
+            rlRun "echo '        $(rpm -q checkpolicy)' >>results.log" 0
+            rlRun "echo '        $(rpm -q libselinux)' >>results.log" 0
+            rlRun "echo '        $(rpm -q libsemanage)' >>results.log" 0
+            rlRun "echo '        $(rpm -q libsepol)' >>results.log" 0
+            rlRun "echo '        $(rpm -q policycoreutils)' >>results.log" 0
+            rlRun "echo '' >>results.log" 0
+
+            rlRun "popd"
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        if [ -d selinux-testsuite ]; then
+            rlRun "pushd selinux-testsuite"
+            rlRun "env -u ARCH make" 0
+            rlRun "cat results.log" 0
+            $PIPEFAIL_ENABLE
+            # DISTRO= needed for policy devel Makefile... (Beaker sets it to "redhat")
+            rlRun "env -u ARCH -u DISTRO LANG=C unbuffer make -s test 2>&1 | tee -a results.log" 0
+            $PIPEFAIL_DISABLE
+            rlRun "popd"
+        else
+            rlFail "GIT was unable to clone the testsuite repo"
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        # rlSEBooleanRestore
+        # rlSEBooleanRestore allow_domain_fd_use
+        # none of above-mentioned commands is able to correctly restore the value in the boolean
+        rlRun "boolSet domain_can_mmap_files $BACKUP_domain_can_mmap_files"
+        rlRun "boolSet allow_domain_fd_use $BACKUP_allow_domain_fd_use"
+
+        if [ -d selinux-testsuite ]; then
+            rlRun "pushd selinux-testsuite"
+            # Submit report to beaker.
+            rlFileSubmit "results.log" "selinux-testsuite.results.$(uname -r).txt"
+            rlRun "make clean" 0-2
+            rlRun "popd"
+        fi
+        rlRun "semodule -r test_policy" 0,1
+        rlRun "sleep 5" 0
+        rlRun "dmesg | grep -i \"rcu_sched detected stalls\"" 1
+        rlFileRestore
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+

diff --git a/main.fmf b/main.fmf
index e39a89e..2b8a07d 100644
--- a/main.fmf
+++ b/main.fmf
@@ -10,6 +10,9 @@ tags: [generic]
 /checkpolicy:
     component: checkpolicy
 
+/kernel:
+    component: kernel
+
 /libselinux:
     component: libselinux