[tests/selinux] pr775-checkpolicy-revdeps: test if confined root is allowed to use perf_event

[tests/selinux] pr775-checkpolicy-revdeps: test if confined root is allowed to use perf_event

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 2d3332a5e1a5c6726b1908b1e7d257541cb3f158
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-12-14T11:14:32+00:00
            Stats  : +35/-4 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/2d3332a5e1a5c6726b1908b1e7d257541cb3f158?branch=pr775-checkpolicy-revdeps

            Log:
            test if confined root is allowed to use perf_event

Not only unconfined root (unconfined_t) should be able to run the
perf tool, but also the confined root (sysadm_t) should be able to
do that.
The TC now contains a new test phase which tests the scenario.

---
diff --git a/selinux-policy/perf_event-and-related/Makefile b/selinux-policy/perf_event-and-related/Makefile
index 16213ab..7f91f88 100644
--- a/selinux-policy/perf_event-and-related/Makefile
+++ b/selinux-policy/perf_event-and-related/Makefile
@@ -29,7 +29,7 @@ export TESTVERSION=1.0
 
 BUILT_FILES=
 
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
+FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp
 
 .PHONY: all install download clean
 
@@ -37,8 +37,8 @@ run: $(FILES) build
 	./runtest.sh
 
 build: $(BUILT_FILES)
-	chmod a+x runtest.sh
-	chcon -t bin_t runtest.sh
+	chmod a+x runtest.sh ssh.exp
+	chcon -t bin_t runtest.sh ssh.exp
 
 clean:
 	rm -f *~ $(BUILT_FILES)
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf expect openssh-clients" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)

diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh
index 74c687f..ab2b723 100755
--- a/selinux-policy/perf_event-and-related/runtest.sh
+++ b/selinux-policy/perf_event-and-related/runtest.sh
@@ -69,6 +69,17 @@ rlJournalStart
         rlRun "sesearch -c perf_event -A --dontaudit"
     rlPhaseEnd
 
+    rlPhaseStartTest "real scenario -- confined root sysadm_u"
+        rlRun "setsebool ssh_sysadm_login on"
+        USER_NAME="toor"
+        USER_SECRET="S3kr3t${RANDOM}"
+        rlRun "useradd -o -u 0 -g 0 -Z sysadm_u ${USER_NAME}"
+        rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+        rlRun "./ssh.exp ${USER_NAME}/sysadm_r ${USER_SECRET} localhost perf record -o /dev/null echo test"
+        rlRun "userdel -Z ${USER_NAME}"
+        rlRun "setsebool ssh_sysadm_login off"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC

diff --git a/selinux-policy/perf_event-and-related/ssh.exp b/selinux-policy/perf_event-and-related/ssh.exp
new file mode 100755
index 0000000..58c9647
--- /dev/null
+++ b/selinux-policy/perf_event-and-related/ssh.exp
@@ -0,0 +1,20 @@
+#!/usr/bin/expect -f
+# Expect script for SSH logging as $username to $hostname using $password and executing $command.
+# Usage:
+#   ./ssh.exp username password hostname command
+set username [lrange $argv 0 0]
+set password [lrange $argv 1 1]
+set hostname [lrange $argv 2 2]
+set command  [lrange $argv 3 10]
+set timeout 15
+# connect to remote host and execute given command
+log_user 1
+spawn ssh -t $username@$hostname $command
+expect {
+  -nocase "yes/no" { send -- "yes\r" ; exp_continue }
+  -nocase "password" { send -- "$password\r" }
+}
+log_user 1
+# send -- "\r"
+expect eof
+