[tests/selinux] pr775-checkpolicy-revdeps: homectl: Add test coverage for homectl

[Amith Kumar <apeetham@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : eadf0887228d4d18cb7ddc22c960de2321cf00ad
            Author : Amith Kumar <apeetham@redhat.com>
            Date   : 2020-10-07T13:35:47+00:00
            Stats  : +298/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/eadf0887228d4d18cb7ddc22c960de2321cf00ad?branch=pr775-checkpolicy-revdeps

            Log:
            homectl: Add test coverage for homectl

Add test coverage for SELinux AVC issues related to systemd-homed
service. The homectl program calls the systemd-homed service, which is
not yet confined, but it triggers SELinux denials. This test suite
provides coverage for command homectl along with its subcommands and
checks for avc denials.

Signed-off-by: Amith Kumar <apeetham@redhat.com>

---
diff --git a/selinux-policy/systemd-homed/Makefile b/selinux-policy/systemd-homed/Makefile
new file mode 100644
index 0000000..5c6ffd0
--- /dev/null
+++ b/selinux-policy/systemd-homed/Makefile
@@ -0,0 +1,69 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/selinux-policy/Regression/systemd-homed
+#   Description: Test coverage for avc denials related to systemd-homed service.
+#   Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/systemd-homed
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+	test -x runtest.sh || chcon -t bin_t runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Amith Kumar <apeetham@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Tests for systemd-homed service" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        1h" >> $(METADATA)
+	@echo "RunFor:          selinux-policy" >> $(METADATA)
+	@echo "RunFor:          systemd" >> $(METADATA)
+	@echo "Requires:        audit expect initscripts systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA)
+	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5" >> $(METADATA)
+	@echo "Bug:             1809878" >> $(METADATA) # Fedora 32
+
+	rhts-lint $(METADATA)
+

diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf
new file mode 100644
index 0000000..e39d0e5
--- /dev/null
+++ b/selinux-policy/systemd-homed/main.fmf
@@ -0,0 +1,10 @@
+path: /selinux-policy/systemd-homed
+summary: Test homectl utility and its sub-commands to verify AVC denials
+description: |
+    Test coverage for SELinux AVC issues associated with systemd-homed 
+    service. The homectl program calls the systemd-homed service, which 
+    is not yet confined, but it triggers SELinux denials. This test suite
+    covers command homectl with its subcommands and checks for avc denials.
+relevancy:
+    - "distro = rhel-4, rhel-5, rhel-6, rhel-7: False"
+

diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh
new file mode 100755
index 0000000..7c0a45f
--- /dev/null
+++ b/selinux-policy/systemd-homed/runtest.sh
@@ -0,0 +1,219 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/selinux-policy/Regression/systemd-homed
+#   Description: Test coverage for SELinux AVC issues related to systemd-homed service.
+#   Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE1="selinux-policy"
+PACKAGE2="systemd"
+
+function create_u() {
+expect -f  - <<<'
+    set timeout -1
+    spawn homectl create test_u --disk-size=500M
+    expect "*: "
+    send -- "Red_123hat\r"
+    expect "*: "
+    send -- "Red_123hat\r"
+    expect eof
+    foreach {pid spawnid os_error_flag value} [wait] break
+    exit $value     
+'
+}
+
+function activate_u() {
+expect -f  - <<<'
+   set timeout -1
+   spawn homectl activate test_u
+   expect "*: "
+   send -- "Red_123hat\r"
+   expect eof
+   foreach {pid spawnid os_error_flag value} [wait] break
+   exit $value
+'
+}
+
+function unlock_u() {
+expect -f  - <<<'
+   set timeout -1
+   spawn homectl unlock test_u
+   expect "*: "
+   send -- "Red_123hat\r"
+   expect eof
+   foreach {pid spawnid os_error_flag value} [wait] break
+   exit $value
+'
+}
+
+function passwd_u() {
+expect -f  - <<<'
+   set timeout -1
+   spawn homectl passwd test_u
+   expect "*: "
+   send -- "Sim_123pl1\r"
+   expect "*: "
+   send -- "Sim_123pl1\r"
+   expect eof
+   foreach {pid spawnid os_error_flag value} [wait] break
+   exit $value
+'
+}
+
+function auth_u() {
+expect -f  - <<<'
+   set timeout -1
+   spawn homectl authenticate test_u
+   expect "*: "
+   send -- "Sim_123pl1\r"
+   expect eof
+   foreach {pid spawnid os_error_flag value} [wait] break
+   exit $value
+'
+}
+
+function resize_u() {
+expect -f  - <<<'
+   set timeout -1
+   spawn homectl resize test_u 425.0M
+   expect "*: "
+   send -- "Sim_123pl1\r"
+   expect eof
+   foreach {pid spawnid os_error_flag value} [wait] break
+   exit $value
+'
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'"
+        rlSESatisfyRequires
+        rlAssertRpm ${PACKAGE1}
+        rlAssertRpm ${PACKAGE1}-targeted
+        rlAssertRpm ${PACKAGE2}
+        rlSESetEnforce
+        rlSEStatus
+        rlSESetTimestamp
+        sleep 2
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl create"
+        rlRun "create_u"
+        rlRun "ausearch -m AVC -m USER_AVC -c systemd-homed -f mail" 1
+        rlRun "ausearch -m AVC -m USER_AVC -c systemd-homewor" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl list"
+        sleep 20
+        tst_Time="$(date '+%T')"
+        rlRun "homectl list"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl activate"
+        sleep 20
+        tst_Time="$(date '+%T')"
+        rlRun "activate_u"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl inspect"
+        sleep 20
+        tst_Time="$(date '+%T')"
+        rlRun "homectl inspect test_u"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl update"
+        sleep 20
+        tst_Time="$(date '+%T')"
+        rlRun "homectl update test_u --email-address=test_u@redhat.com"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl lock"
+        sleep 20
+        tst_Time="$(date '+%T')"
+        rlRun "homectl lock test_u"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl unlock"
+        sleep 90
+        tst_Time="$(date '+%T')"
+        rlRun "unlock_u"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl passwd"
+        sleep 20
+        tst_Time="$(date '+%T')"
+        rlRun "passwd_u"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl authenticate"
+        sleep 90
+        tst_Time="$(date '+%T')"
+        rlRun "auth_u"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl deactivate and resize"
+        sleep 90
+        tst_Time="$(date '+%T')"
+        rlRun "homectl deactivate test_u"
+        sleep 60
+        rlRun "resize_u"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "homectl remove"
+        sleep 20
+        tst_Time="$(date '+%T')"
+        rlRun "homectl remove test_u"
+        sleep 5
+        rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        sleep 2
+        rlSECheckAVC
+        rlRun "rm -f /tmp/avcfile"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd