[tests/selinux] pr775-checkpolicy-revdeps: ladvd : Add coverage for ladvd service

[Amith Kumar <apeetham@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : c109e465d3d034447fc9e32b93ce16389c084b72
            Author : Amith Kumar <apeetham@redhat.com>
            Date   : 2020-09-08T13:55:27+00:00
            Stats  : +177/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/c109e465d3d034447fc9e32b93ce16389c084b72?branch=pr775-checkpolicy-revdeps

            Log:
            ladvd : Add coverage for ladvd service

Add test cases which provide coverage for ladvd service and also
verifies bug 1834325 and bug 1855163.

Signed-off-by: Amith Kumar <apeetham@redhat.com>

---
diff --git a/other/ladvd/Makefile b/other/ladvd/Makefile
new file mode 100644
index 0000000..8572b36
--- /dev/null
+++ b/other/ladvd/Makefile
@@ -0,0 +1,81 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/selinux-policy/Regression/ladvd
+#   Description: Test coverage for avc denials related to ladvd service.
+#   Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/ladvd
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+	test -x runtest.sh || chcon -t bin_t runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Amith Kumar <apeetham@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Tests for ladvd service" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        1h" >> $(METADATA)
+	@echo "RunFor:          selinux-policy" >> $(METADATA)
+	@echo "RunFor:          ladvd" >> $(METADATA)
+	@echo "Requires:        audit" >> $(METADATA)
+	@echo "Requires:        initscripts" >> $(METADATA)
+	@echo "Requires:        kernel-headers" >> $(METADATA)
+	@echo "Requires:        ladvd" >> $(METADATA)
+	@echo "Requires:        ladvd-selinux" >> $(METADATA)
+	@echo "Requires:        libpcap" >> $(METADATA)
+	@echo "Requires:        libselinux" >> $(METADATA)
+	@echo "Requires:        libselinux-utils" >> $(METADATA)
+	@echo "Requires:        policycoreutils" >> $(METADATA)
+	@echo "Requires:        selinux-policy" >> $(METADATA)
+	@echo "Requires:        selinux-policy-targeted" >> $(METADATA)
+	@echo "Requires:        setools-console" >> $(METADATA)
+	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5" >> $(METADATA)
+	@echo "Bug:             1834325" >> $(METADATA) # Fedora 32
+	@echo "Bug:             1855163" >> $(METADATA) # Fedora 32
+
+	rhts-lint $(METADATA)
+

diff --git a/other/ladvd/PURPOSE b/other/ladvd/PURPOSE
new file mode 100644
index 0000000..556576a
--- /dev/null
+++ b/other/ladvd/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/ladvd
+Author: Amith Kumar <apeetham@redhat.com>
+
+Test coverage for SELinux AVC issues related to ladvd service.
+

diff --git a/other/ladvd/runtest.sh b/other/ladvd/runtest.sh
new file mode 100755
index 0000000..682f8da
--- /dev/null
+++ b/other/ladvd/runtest.sh
@@ -0,0 +1,91 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/selinux-policy/Regression/ladvd
+#   Description: Test coverage for SELinux AVC issues related to ladvd service.
+#   Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'"
+        rlSESatisfyRequires
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-targeted
+        rlAssertRpm ladvd
+        rlAssertRpm ladvd-selinux
+        rlServiceStop ladvd
+        rlSESetEnforce
+        rlSEStatus
+    rlPhaseEnd
+
+    rlPhaseStartTest "ladvd service selinux denials, bz#1834325"
+        rlServiceStart ladvd
+        sleep 2
+        rlRun "ausearch -m AVC -c ladvd --raw > /tmp/avcfile"
+        if grep "tclass=process2" /tmp/avcfile; then
+            grep "tclass=process2" /tmp/avcfile > /tmp/avc_class_file
+            rlAssertNotGrep "denied  { nnp_transition }" /tmp/avc_class_file
+        else
+            rlLog "AVCs related to tclass process2 not found."
+        fi
+        if grep "tclass=packet_socket" /tmp/avcfile; then
+            grep "tclass=packet_socket" /tmp/avcfile > /tmp/avc_class_file
+            rlAssertNotGrep "denied  { map }" /tmp/avc_class_file
+        else
+            rlLog "AVCs related to tclass packet_socket not found."
+        fi
+        rlSESearchRule "allow init_t ladvd_t : process2 { nnp_transition }"
+        rlSESearchRule "allow ladvd_t ladvd_t : packet_socket { map }"
+        rlSESearchRule "allow ladvd_t ladvd_t : capability { kill }"
+        rlServiceStop ladvd
+    rlPhaseEnd
+
+    rlPhaseStartTest "ladvd selinux denials due to libpcap, bz#1855163"
+        rlServiceStart ladvd
+        sleep 2
+        rlRun "ausearch -m AVC -c 'ladvd' --raw > /tmp/avcfile"
+        if grep "tclass=netlink_rdma_socket" /tmp/avcfile; then
+            grep "tclass=netlink_rdma_socket" /tmp/avcfile > /tmp/avc_class_file
+            rlAssertNotGrep "denied  { create }" /tmp/avc_class_file
+            rlAssertNotGrep "denied  { setopt }" /tmp/avc_class_file
+            rlAssertNotGrep "denied  { bind }" /tmp/avc_class_file
+            rlAssertNotGrep "denied  { getattr }" /tmp/avc_class_file
+        else
+            rlLog "AVCs related to tclass netlink_rdma_socket not found."
+        fi
+        rlSESearchRule "allow ladvd_t self : netlink_rdma_socket { bind create getattr setopt }"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f /tmp/avcfile"
+        rlRun "rm -f /tmp/avc_class_file"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd