[tests/selinux] pr775-checkpolicy-revdeps: add the cups-pdf test to upstream repository

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 32c0967664f4386116ec877edc3cd64e7d6efd45
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-09-10T13:14:12+00:00
            Stats  : +240/-0 in 5 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/32c0967664f4386116ec877edc3cd64e7d6efd45?branch=pr775-checkpolicy-revdeps

            Log:
            add the cups-pdf test to upstream repository

The cups-pdf program is available in various Fedoras and RHELs,
so it makes sense to run the TC in upstream testing.

There are no changes in the TC functionality, only moving the
downstream TC to the upstream repo.

---
diff --git a/selinux-policy/cups-pdf-and-similar/Makefile b/selinux-policy/cups-pdf-and-similar/Makefile
new file mode 100644
index 0000000..b3668ab
--- /dev/null
+++ b/selinux-policy/cups-pdf-and-similar/Makefile
@@ -0,0 +1,77 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/selinux-policy/Regression/cups-pdf-and-similar
+#   Description: SELinux interferes with cups-pdf and related programs
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/cups-pdf-and-similar
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh ssh.exp
+	chcon -t bin_t runtest.sh ssh.exp
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     SELinux interferes with cups-pdf and related programs" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          cups" >> $(METADATA)
+	@echo "RunFor:          selinux-policy" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients shadow-utils cups cups-pdf cups-client cups-filters" >> $(METADATA)
+	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+	@echo "Bug:             560220" >> $(METADATA) # Fedora 12
+	@echo "Bug:             563977" >> $(METADATA) # Fedora 12
+	@echo "Bug:             570782" >> $(METADATA) # Fedora 12
+	@echo "Bug:             1516282" >> $(METADATA) # Fedora 27
+	@echo "Bug:             1517509" >> $(METADATA) # Fedora 27
+	@echo "Bug:             1532043" >> $(METADATA) # Fedora 27
+	@echo "Bug:             1594271" >> $(METADATA) # Fedora 28
+	@echo "Bug:             1700442" >> $(METADATA) # Fedora 28
+	@echo "Bug:             1832521" >> $(METADATA) # Fedora 32
+
+	rhts-lint $(METADATA)
+

diff --git a/selinux-policy/cups-pdf-and-similar/PURPOSE b/selinux-policy/cups-pdf-and-similar/PURPOSE
new file mode 100644
index 0000000..c99a634
--- /dev/null
+++ b/selinux-policy/cups-pdf-and-similar/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/cups-pdf-and-similar
+Author: Milos Malik <mmalik@redhat.com>
+
+SELinux interferes with cups-pdf and related programs.
+

diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf
new file mode 100644
index 0000000..699c0b8
--- /dev/null
+++ b/selinux-policy/cups-pdf-and-similar/main.fmf
@@ -0,0 +1,2 @@
+path: /selinux-policy/cups-pdf-and-similar
+tier: 2

diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh
new file mode 100755
index 0000000..f188799
--- /dev/null
+++ b/selinux-policy/cups-pdf-and-similar/runtest.sh
@@ -0,0 +1,136 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/selinux-policy/Regression/cups-pdf-and-similar
+#   Description: SELinux interferes with cups-pdf and related programs
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+ROOT_PASSWORD="redhat"
+FILE_PATH="/usr/lib/cups/backend/cups-pdf"
+FILE_CONTEXT="cups_pdf_exec_t"
+SERVICE_PACKAGE="cups-pdf"
+SERVICE_NAME="cups"
+PROCESS_NAME="cups-pdf"
+PROCESS_CONTEXT="cups_pdf_t"
+ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"}
+DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'"
+        rlSESatisfyRequires
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-targeted
+        rlAssertRpm ${SERVICE_PACKAGE}
+
+        rlServiceStart ${SERVICE_NAME}
+        rlFileBackup /etc/shadow
+
+        rlSESetEnforce
+        rlSEStatus
+        rlSESetTimestamp
+        sleep 2
+    rlPhaseEnd
+
+    rlPhaseStartTest "SELinux contexts and rules"
+        rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}"
+        SOURCE_TYPE="cupsd_t"
+        rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS"
+        rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS"
+        rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#560220 + bz#563977"
+        rlSESearchRule "allow cups_pdf_t cups_pdf_t : capability { fowner } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#570782"
+        rlSESearchRule "allow cups_pdf_t autofs_t : dir { search } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#1516282 + bz#1517509"
+        rlSEMatchPathCon "/etc/cups" "cupsd_etc_t"
+        rlSESearchRule "allow cups_pdf_t cupsd_etc_t : dir { read } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#1532043"
+        rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t"
+        rlSESearchRule "allow cups_pdf_t system_dbusd_var_run_t : sock_file { write } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#1594271"
+        rlSESearchRule "allow cups_pdf_t cups_pdf_t : capability { dac_override } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#1700442"
+        rlSEMatchPathCon "/var/log" "var_log_t"
+        rlSEMatchPathCon "/var/log/cups" "cupsd_log_t"
+        rlSEMatchPathCon "/var/log/cups/cups-pdf-cups-pdf_log" "cupsd_log_t"
+        rlSESearchRule "allow cups_pdf_t var_log_t : dir { add_name write } [ ]"
+        rlSESearchRule "type_transition cups_pdf_t var_log_t : dir cupsd_log_t"
+        rlSESearchRule "type_transition cups_pdf_t var_log_t : file cupsd_log_t"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#1832521"
+        rlSESearchRule "allow cups_pdf_t cups_pdf_t : unix_dgram_socket { create connect } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "real scenario -- confined users"
+        rlRun "lpadmin -x cups-pdf" 0-255
+        rlRun "lpadmin -p cups-pdf -v cups-pdf:/ -E -P /usr/share/cups/model/CUPS-PDF_opt.ppd"
+        rlRun "setsebool ssh_sysadm_login on"
+        rlRun "setsebool selinuxuser_tcp_server on"
+        rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
+        for SELINUX_USER in ${ALLOWED_USERS} ; do
+            USER_NAME="user${RANDOM}"
+            USER_SECRET="S3kr3t${RANDOM}"
+            rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}"
+            rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+            rlRun "restorecon -Rv /home/${USER_NAME}"
+            rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost lpr -P cups-pdf /usr/share/cups/data/testprint"
+            sleep 5
+            rlRun "find /home/${USER_NAME} -type f | grep testprint-job"
+            rlRun "userdel -rfZ ${USER_NAME}"
+            sleep 10
+        done
+        rlRun "setsebool selinuxuser_tcp_server off"
+        rlRun "setsebool ssh_sysadm_login off"
+        rlRun "lpadmin -x cups-pdf"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        sleep 2
+        rlSECheckAVC
+
+        rlFileRestore
+        rlServiceRestore ${SERVICE_NAME}
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+

diff --git a/selinux-policy/cups-pdf-and-similar/ssh.exp b/selinux-policy/cups-pdf-and-similar/ssh.exp
new file mode 100755
index 0000000..58c9647
--- /dev/null
+++ b/selinux-policy/cups-pdf-and-similar/ssh.exp
@@ -0,0 +1,20 @@
+#!/usr/bin/expect -f
+# Expect script for SSH logging as $username to $hostname using $password and executing $command.
+# Usage:
+#   ./ssh.exp username password hostname command
+set username [lrange $argv 0 0]
+set password [lrange $argv 1 1]
+set hostname [lrange $argv 2 2]
+set command  [lrange $argv 3 10]
+set timeout 15
+# connect to remote host and execute given command
+log_user 1
+spawn ssh -t $username@$hostname $command
+expect {
+  -nocase "yes/no" { send -- "yes\r" ; exp_continue }
+  -nocase "password" { send -- "$password\r" }
+}
+log_user 1
+# send -- "\r"
+expect eof
+