[tests/selinux] pr775-checkpolicy-revdeps: add the usbguard test to upstream repository

[tests/selinux] pr775-checkpolicy-revdeps: add the usbguard test to upstream repository

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 78a0d262033f21c5168f31dfe5655a0a4994a1d2
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-09-08T13:29:22+00:00
            Stats  : +179/-0 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/78a0d262033f21c5168f31dfe5655a0a4994a1d2?branch=pr775-checkpolicy-revdeps

            Log:
            add the usbguard test to upstream repository

The usbguard service is available in various Fedoras and RHELs,
so it makes sense to run the TC in upstream testing too.

There are no changes in the TC functionality, only moving the
downstream TC to the upstream repo.

---
diff --git a/selinux-policy/usbguard-daemon-and-similar/Makefile b/selinux-policy/usbguard-daemon-and-similar/Makefile
new file mode 100644
index 0000000..d75c372
--- /dev/null
+++ b/selinux-policy/usbguard-daemon-and-similar/Makefile
@@ -0,0 +1,70 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar
+#   Description: SELinux interferes with usbguard and related programs
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+	chcon -t bin_t runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     SELinux interferes with usbguard and related programs" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          usbguard" >> $(METADATA)
+	@echo "RunFor:          selinux-policy" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts usbguard usbguard-selinux" >> $(METADATA)
+	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+	@echo "Bug:             1808527" >> $(METADATA) # Fedora 32
+	@echo "Bug:             1840265" >> $(METADATA) # RHEL-8
+
+	rhts-lint $(METADATA)
+

diff --git a/selinux-policy/usbguard-daemon-and-similar/PURPOSE b/selinux-policy/usbguard-daemon-and-similar/PURPOSE
new file mode 100644
index 0000000..926aa44
--- /dev/null
+++ b/selinux-policy/usbguard-daemon-and-similar/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar
+Author: Milos Malik <mmalik@redhat.com>
+
+SELinux interferes with usbguard and related programs.
+

diff --git a/selinux-policy/usbguard-daemon-and-similar/main.fmf b/selinux-policy/usbguard-daemon-and-similar/main.fmf
new file mode 100644
index 0000000..a2efdf1
--- /dev/null
+++ b/selinux-policy/usbguard-daemon-and-similar/main.fmf
@@ -0,0 +1,2 @@
+path: /selinux-policy/usbguard-daemon-and-similar
+tier: 2

diff --git a/selinux-policy/usbguard-daemon-and-similar/runtest.sh b/selinux-policy/usbguard-daemon-and-similar/runtest.sh
new file mode 100755
index 0000000..ea2c953
--- /dev/null
+++ b/selinux-policy/usbguard-daemon-and-similar/runtest.sh
@@ -0,0 +1,102 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar
+#   Description: SELinux interferes with usbguard and related programs
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+ROOT_PASSWORD="redhat"
+FILE_PATH="/usr/sbin/usbguard-daemon"
+FILE_CONTEXT="usbguard_exec_t"
+SERVICE_PACKAGE="usbguard"
+SERVICE_NAME="usbguard"
+PROCESS_NAME="usbguard-daemon"
+PROCESS_CONTEXT="usbguard_t"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'"
+        rlSESatisfyRequires
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-targeted
+        rlRun "rpm -qa ${SERVICE_PACKAGE}\*"
+
+        rlServiceStop ${SERVICE_NAME}
+        rlFileBackup /etc/shadow
+        rlFileBackup /etc/usbguard/usbguard-daemon.conf
+
+        rlSESetEnforce
+        rlSEStatus
+        rlSESetTimestamp
+        sleep 2
+    rlPhaseEnd
+
+    if rlSEDefined ${PROCESS_CONTEXT} ; then
+    rlPhaseStartTest "bz#1808527"
+        rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}"
+        rlSESearchRule "allow init_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
+        rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]"
+        rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
+        rlSESearchRule "allow usbguard_t usbguard_t : netlink_audit_socket { create nlmsg_relay } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#1840265"
+        # according to logged AVCs, target class is file instead of chr_file
+        # all these files are created by systemd under /tmp/namespace-dev-*/
+        rlSESearchRule "allow init_t ptmx_t : file { create mounton } [ ]"
+        rlSESearchRule "allow init_t null_device_t : file { create mounton } [ ]"
+        rlSESearchRule "allow init_t zero_device_t : file { create mounton } [ ]"
+        rlSESearchRule "allow init_t random_device_t : file { create mounton } [ ]"
+        rlSESearchRule "allow init_t urandom_device_t : file { create mounton } [ ]"
+        rlSESearchRule "allow init_t devtty_t : file { create mounton } [ ]"
+    rlPhaseEnd
+    fi
+
+    rlPhaseStartTest "real scenario -- standalone service"
+        rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
+        rlRun "semodule -lfull | grep usbguard"
+        rlRun "sed -i \"s/^AuditBackend=.*$/AuditBackend=LinuxAudit/\" /etc/usbguard/usbguard-daemon.conf"
+        if ! rlSEDefined ${PROCESS_CONTEXT} ; then
+            PROCESS_CONTEXT="unconfined_service_t"
+        fi
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+        rlRun "restorecon -Rv /run /var"
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        sleep 2
+        rlSECheckAVC
+
+        rlFileRestore
+        rlServiceRestore ${SERVICE_NAME}
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+