[tests/selinux] pr775-checkpolicy-revdeps: add the pam_console test to upstream repository

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b164be5e551fd1a63f67b95393af8b0ac4182cbf
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-09-10T13:10:54+00:00
            Stats  : +217/-0 in 5 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b164be5e551fd1a63f67b95393af8b0ac4182cbf?branch=pr775-checkpolicy-revdeps

            Log:
            add the pam_console test to upstream repository

The pam_console_apply program is available in various Fedoras
and RHELs, so it makes sense to run the TC in upstream testing.

There are no changes in the TC functionality, only moving the
downstream TC to the upstream repo.

---
diff --git a/selinux-policy/pam_console-and-related/Makefile b/selinux-policy/pam_console-and-related/Makefile
new file mode 100644
index 0000000..95f6cce
--- /dev/null
+++ b/selinux-policy/pam_console-and-related/Makefile
@@ -0,0 +1,71 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/selinux-policy/Regression/pam_console-and-related
+#   Description: Does SELinux cooperate with pam_console_apply and pam_console.so?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/pam_console-and-related
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh ssh.exp
+	chcon -t bin_t runtest.sh ssh.exp
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Does SELinux cooperate with pam_console_apply and pam_console.so?" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          pam" >> $(METADATA)
+	@echo "RunFor:          selinux-policy" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients pam psmisc binutils shadow-utils" >> $(METADATA)
+	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6" >> $(METADATA)
+	@echo "Bug:             204986" >> $(METADATA) # Fedora 6
+	@echo "Bug:             251104" >> $(METADATA) # Fedora 7
+	@echo "Bug:             1817690" >> $(METADATA) # RHEL-8
+
+	rhts-lint $(METADATA)
+

diff --git a/selinux-policy/pam_console-and-related/PURPOSE b/selinux-policy/pam_console-and-related/PURPOSE
new file mode 100644
index 0000000..e2bb8ab
--- /dev/null
+++ b/selinux-policy/pam_console-and-related/PURPOSE
@@ -0,0 +1,10 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/pam_console-and-related
+Author: Milos Malik <mmalik@redhat.com>
+
+Does SELinux cooperate with pam_console_apply and pam_console.so?
+Confined and unconfined users are tested using SSH.
+
+This TC uses following parameters which can be overriden:
+ * ALLOWED_USERS - which SELinux users should be tested?
+ * DENIED_USERS - which SELinux users should NOT be tested?
+

diff --git a/selinux-policy/pam_console-and-related/main.fmf b/selinux-policy/pam_console-and-related/main.fmf
new file mode 100644
index 0000000..96a80b5
--- /dev/null
+++ b/selinux-policy/pam_console-and-related/main.fmf
@@ -0,0 +1,2 @@
+path: /selinux-policy/pam_console-and-related
+tier: 2

diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh
new file mode 100755
index 0000000..297d590
--- /dev/null
+++ b/selinux-policy/pam_console-and-related/runtest.sh
@@ -0,0 +1,114 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/selinux-policy/Regression/pam_console-and-related
+#   Description: Does SELinux cooperate with pam_console_apply and pam_console.so?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+ROOT_PASSWORD="redhat"
+SERVICE_PACKAGE="pam"
+if rlIsRHEL 7 ; then
+    DENIED_USERS=${DENIED_USERS:-"staff_u"}
+    ALLOWED_USERS=${ALLOWED_USERS:-"guest_u xguest_u user_u sysadm_u unconfined_u"}
+else
+    DENIED_USERS=${DENIED_USERS:-""}
+    ALLOWED_USERS=${ALLOWED_USERS:-"guest_u xguest_u user_u staff_u sysadm_u unconfined_u"}
+fi
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'"
+        rlSESatisfyRequires
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-targeted
+        rlAssertRpm ${SERVICE_PACKAGE}
+
+        rlFileBackup /etc/shadow
+
+        rlSESetEnforce
+        rlSEStatus
+        rlSESetTimestamp
+        sleep 2
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#204986"
+        rlSEMatchPathCon "/usr/sbin/pam_console_apply" "pam_console_exec_t"
+        rlSESearchRule "allow pam_console_t autofs_t : dir { read } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#251104"
+        rlSEMatchPathCon "/sbin/pam_console_apply" "pam_console_exec_t"
+        rlSESearchRule "allow pam_console_t fs_t : filesystem { getattr } [ ]"
+    rlPhaseEnd
+
+    if ! rlIsRHEL 7 ; then
+    rlPhaseStartTest "bz#1817690"
+        rlSESearchRule "allow staff_t pam_console_exec_t : file { getattr open read execute } [ ]"
+        rlSESearchRule "type_transition staff_t pam_console_exec_t : process pam_console_t"
+        rlSESearchRule "allow staff_t pam_console_t : process { transition } [ ]"
+        rlRun "seinfo -rstaff_r -x | tr ' ' '\n' | grep pam_console_t"
+    rlPhaseEnd
+    fi
+
+    rlPhaseStartTest "real scenario -- confined users"
+        rlRun "setsebool ssh_sysadm_login on"
+        rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
+        for SELINUX_USER in ${ALLOWED_USERS} ; do
+            USER_NAME="user${RANDOM}"
+            USER_SECRET="S3kr3t${RANDOM}"
+            rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}"
+            rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+            rlRun "restorecon -RvF /home/${USER_NAME}"
+            # If a user logs in via console then a file of the same name as
+            # the user appears in /run/console directory. The file exists as long
+            # as the user is logged in. The file disappears after logout of the user.
+            # Unfortunately, the use of SSH does not create such a file.
+            rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/pam_console_apply -d"
+            rlRun "ls -dZ /run/console"
+            rlRun "ls -dZ /run/console | grep :pam_var_console_t"
+            rlRun "ls -aZ /run/console"
+            rlRun "userdel -rfZ ${USER_NAME}"
+            sleep 10
+        done
+        rlRun "setsebool ssh_sysadm_login off"
+    rlPhaseEnd
+
+    rlPhaseStartTest "real scenario -- runcon under root"
+        rlRun "runcon system_u:system_r:initrc_t:s0 /bin/bash -c '/usr/sbin/pam_console_apply -r'"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        sleep 2
+        rlSECheckAVC
+
+        rlFileRestore
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+

diff --git a/selinux-policy/pam_console-and-related/ssh.exp b/selinux-policy/pam_console-and-related/ssh.exp
new file mode 100755
index 0000000..58c9647
--- /dev/null
+++ b/selinux-policy/pam_console-and-related/ssh.exp
@@ -0,0 +1,20 @@
+#!/usr/bin/expect -f
+# Expect script for SSH logging as $username to $hostname using $password and executing $command.
+# Usage:
+#   ./ssh.exp username password hostname command
+set username [lrange $argv 0 0]
+set password [lrange $argv 1 1]
+set hostname [lrange $argv 2 2]
+set command  [lrange $argv 3 10]
+set timeout 15
+# connect to remote host and execute given command
+log_user 1
+spawn ssh -t $username@$hostname $command
+expect {
+  -nocase "yes/no" { send -- "yes\r" ; exp_continue }
+  -nocase "password" { send -- "$password\r" }
+}
+log_user 1
+# send -- "\r"
+expect eof
+