[tests/selinux] pr775-checkpolicy-revdeps: add basic test for the validatetrans tool

[tests/selinux] pr775-checkpolicy-revdeps: add basic test for the validatetrans tool

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 286daff3e834617dfbe9615e7347cf32dbf02273
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-05-18T12:11:16+02:00
            Stats  : +175/-0 in 5 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/286daff3e834617dfbe9615e7347cf32dbf02273?branch=pr775-checkpolicy-revdeps

            Log:
            add basic test for the validatetrans tool

The TC checks if the validatetrans tool works as expected.
Correct and incorrect usage of the tool is tested.
The validatetrans tool was introduced in libselinux 3.0.
The TC triggers SELINUX_ERR denials to prove that validatetrans
return values are correct.

---
diff --git a/libselinux/validatetrans/Makefile b/libselinux/validatetrans/Makefile
new file mode 100644
index 0000000..b5a4d30
--- /dev/null
+++ b/libselinux/validatetrans/Makefile
@@ -0,0 +1,67 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/libselinux/Sanity/validatetrans
+#   Description: Does the validatetrans tool work as expected?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/libselinux/Sanity/validatetrans
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.cil
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+	chcon -t bin_t runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Does the validatetrans tool work as expected?" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          libselinux" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA)
+	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
+
+	rhts-lint $(METADATA)
+

diff --git a/libselinux/validatetrans/PURPOSE b/libselinux/validatetrans/PURPOSE
new file mode 100644
index 0000000..1732b31
--- /dev/null
+++ b/libselinux/validatetrans/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/libselinux/Sanity/validatetrans
+Author: Milos Malik <mmalik@redhat.com>
+
+Does the validatetrans tool work as expected?
+

diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf
new file mode 100644
index 0000000..886443b
--- /dev/null
+++ b/libselinux/validatetrans/main.fmf
@@ -0,0 +1,4 @@
+path: /libselinux/validatetrans
+relevancy:
+- "distro < fedora-32: False"
+

diff --git a/libselinux/validatetrans/runtest.sh b/libselinux/validatetrans/runtest.sh
new file mode 100755
index 0000000..fb58d69
--- /dev/null
+++ b/libselinux/validatetrans/runtest.sh
@@ -0,0 +1,95 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/libselinux/Sanity/validatetrans
+#   Description: Does the validatetrans tool work as expected?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="libselinux"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'"
+        rlAssertRpm ${PACKAGE}
+        rlRun "rpm -qf `which validatetrans`"
+        rlRun "rpm -qf `which seinfo`"
+        rlRun "rpm -qf `which semodule`"
+        rlRun "rpm -qf `which ausearch`"
+
+        rlSESetEnforce
+        rlSEStatus
+    rlPhaseEnd
+
+    rlPhaseStartTest "correct usage"
+        rlRun "seinfo --validatetrans"
+        rlRun "semodule -i testpolicy.cil"
+        rlRun "seinfo --validatetrans"
+        rlRun "mkdir -p tested-dir"
+        rlRun "touch tested-file"
+        rlRun "mkfifo tested-fifo_file"
+        for TCLASS in dir file fifo_file ; do
+            rlSESetTimestamp
+            sleep 1
+            rlRun "chcon -t bin_t tested-${TCLASS}"
+            # file context change from anything to swapfile_t should pass
+            rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 ${TCLASS} unconfined_u:object_r:swapfile_t:s0" 0
+            rlRun "chcon -t swapfile_t tested-${TCLASS}"
+            # file context change from swapfile_t to anything should fail
+            rlRun "validatetrans unconfined_u:object_r:swapfile_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 ${TCLASS} unconfined_u:object_r:bin_t:s0" 255
+            rlRun "chcon -t bin_t tested-${TCLASS}" 1
+            sleep 1
+            rlSECheckAVC --expect "type=SELINUX_ERR.*op=security_validate_transition.*:swapfile_t:.*:bin_t:.*tclass=${TCLASS}"
+            rlRun "rm -rf tested-${TCLASS}"
+        done
+        rlRun "semodule -r testpolicy"
+        rlRun "seinfo --validatetrans"
+    rlPhaseEnd
+
+    rlPhaseStartTest "incorrect number of parameters"
+        rlRun "validatetrans param1 2>&1 | grep -i usage"
+        rlRun "validatetrans param1 param2 2>&1 | grep -i usage"
+        rlRun "validatetrans param1 param2 param3 2>&1 | grep -i usage"
+        rlRun "validatetrans param1 param2 param3 param4 param5 2>&1 | grep -i usage"
+    rlPhaseEnd
+
+    rlPhaseStartTest "incomplete or invalid parameters"
+        # first context incomplete
+        rlRun "validatetrans unconfined_u:object_r:bin_t: unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'"
+        # second context incomplete
+        rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t: file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'"
+        # third context incomplete
+        rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t: 2>&1 | grep -i 'invalid argument'"
+        # invalid target class
+        rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 xyz unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid class'"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+

diff --git a/libselinux/validatetrans/testpolicy.cil b/libselinux/validatetrans/testpolicy.cil
new file mode 100644
index 0000000..d7df639
--- /dev/null
+++ b/libselinux/validatetrans/testpolicy.cil
@@ -0,0 +1,4 @@
+(validatetrans dir (neq t1 swapfile_t))
+(validatetrans file (neq t1 swapfile_t))
+(validatetrans fifo_file (neq t1 swapfile_t))
+