[tests/selinux] pr775-checkpolicy-revdeps: Add test for kernel deadlock via setsebool

[tests/selinux] pr775-checkpolicy-revdeps: Add test for kernel deadlock via setsebool

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : a01344bd641ad12beb7d4d2eb14d980b86af824d
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2021-02-03T18:31:03+01:00
            Stats  : +74/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/a01344bd641ad12beb7d4d2eb14d980b86af824d?branch=pr775-checkpolicy-revdeps

            Log:
            Add test for kernel deadlock via setsebool

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/setsebool-deadlock/Makefile b/kernel/setsebool-deadlock/Makefile
new file mode 100644
index 0000000..e6e0bfb
--- /dev/null
+++ b/kernel/setsebool-deadlock/Makefile
@@ -0,0 +1,7 @@
+# Minimal Makefile for standard-test-roles-beakerlib
+
+R="RhtsRequires: audit policycoreutils"
+
+run:
+	chmod +x runtest.sh
+	TEST=/SELinux/kernel/setsebool-deadlock ./runtest.sh

diff --git a/kernel/setsebool-deadlock/main.fmf b/kernel/setsebool-deadlock/main.fmf
new file mode 100644
index 0000000..5a69da9
--- /dev/null
+++ b/kernel/setsebool-deadlock/main.fmf
@@ -0,0 +1,24 @@
+summary: Regression test for deadlock when changing booleans
+description: |
+    Verify that setting booleans with SELinux audit exclude rules present
+    doesn't deadlock itself.
+    WARNING: This test will lockup the machine if the bug is present!
+    https://bugzilla.redhat.com/show_bug.cgi?id=1924230
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+- kernel
+framework: beakerlib
+require:
+- audit
+- policycoreutils
+duration: 5m
+tier: 3
+enabled: true
+adjust:
+    enabled: false
+    when: distro < fedora-34
+    because: some kernels on Fedora 33 and below don't have the fix
+adjust:
+    enabled: false
+    when: distro ~< rhel-8.4
+    because: not expected to be fixed in RHEL-8 below 8.4

diff --git a/kernel/setsebool-deadlock/runtest.sh b/kernel/setsebool-deadlock/runtest.sh
new file mode 100755
index 0000000..20239b4
--- /dev/null
+++ b/kernel/setsebool-deadlock/runtest.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2021 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+function boolGet() {
+    getsebool "$1" | cut -d ' ' -f 3
+}
+function boolSet() {
+    getsebool "$1" &>/dev/null || return 0
+    setsebool "$1" "$2" || return 1
+    [ "$(boolGet "$1")" == "$2" ]
+}
+
+TEST_BOOLEAN="domain_can_mmap_files"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "bool_default=\$(boolGet domain_can_mmap_files)" 0 \
+            "Get the initial boolean value"
+        rlRun "auditctl -a exclude,never -F subj_user=sysadm_u" 0 \
+            "Add an audit rule that triggers the bug"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "setsebool domain_can_mmap_files $(( 1 - $bool_default )) &" 0 \
+            "Start setsebool in the background (it may hang)"
+        rlRun "sleep 5s" 0 "Give it a grace period of 5 seconds"
+        rlRun "test \$(jobs -r | wc -l) -eq 0" 0 "Check that it has exited"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "auditctl -d exclude,never -F subj_user=sysadm_u" 0 \
+            "Remove the audit rule"
+        rlRun "boolSet domain_can_mmap_files $bool_default" 0 \
+            "Restore the boolean value"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd