[tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: handle BPF restrictions better

[tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: handle BPF restrictions better

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : a3e35f88ec4e57f7afc5f267e465ddcb8e83d198
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2020-03-09T14:29:00+01:00
            Stats  : +10/-3 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/a3e35f88ec4e57f7afc5f267e465ddcb8e83d198?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/selinux-testsuite: handle BPF restrictions better

On RHEL and non-x86_64 Fedora kernels, the kernel.unprivileged_bpf_disabled
sysctl is enabled by default (and at least on RHEL/ARK it cannot be
changed). Instead of trying to disable the BPF subtest completely on
these kernels (which is incomplete since CKI tests ARK kernels on
Fedora), add the sys_admin capability to the BPF test domains to make
the test work on these kernels as well.

We also need to install libbpf-devel separately from CRB on RHEL, since
it's not shipped in BaseOS.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
index bc843c8..4627405 100755
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -184,6 +184,9 @@ rlJournalStart
             which
         "
         rlRun "installDeps \$REQUIRES" 0 "Install requires"
+        if rlIsRHEL '>=8'; then
+            rlRun "dnf install --enablerepo rhel-CRB -y libbpf-devel"
+        fi
     rlPhaseEnd
 
     rlPhaseStartSetup
@@ -346,9 +349,13 @@ rlJournalStart
                 rlRun "cat >>policy/test_mmap.te <<<'allow_map(test_no_execmem_t, tmpfs_t, file)'"
             fi
 
-            if rlIsRHEL || [ "$(rlGetPrimaryArch)" != x86_64 ]; then
-                rlRun "sed -i '/SUBDIRS += bpf/d;/export CFLAGS += -DHAVE_BPF/d' tests/Makefile" 0 \
-                    "Disable BPF tests on RHEL and non-x86_64 Fedora"
+            if [ -f /proc/sys/kernel/unprivileged_bpf_disabled ] &&
+               [ "$(cat /proc/sys/kernel/unprivileged_bpf_disabled)" -eq 1 ] ||
+               [ "$(rlGetPrimaryArch)" != x86_64 ]
+            then
+                rlLog "Unprivileged BPF disabled => add CAP_SYS_ADMIN to BPF domains"
+                rlRun "echo 'allow bpfdomain self:capability { sys_admin };' >>policy/test_bpf.te"
+                rlRun "echo 'allow fdreceivebpfdomain self:capability { sys_admin };' >>policy/test_fdreceive_bpf.te"
             fi
 
             # CKI mainline kernels don't ship with module build infrastructure