[tests/selinux] pr775-checkpolicy-revdeps: Add a minimal test for the recent setsebool kernel regression

[tests/selinux] pr775-checkpolicy-revdeps: Add a minimal test for the recent setsebool kernel regression

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 6fc1caeb52fc91fb3cc8d7e9551e1bcbea66d1c5
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2021-04-27T11:00:42+02:00
            Stats  : +56/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/6fc1caeb52fc91fb3cc8d7e9551e1bcbea66d1c5?branch=pr775-checkpolicy-revdeps

            Log:
            Add a minimal test for the recent setsebool kernel regression

It doesn't have a bugzilla, but better to have a regression test for it.
It's a very low-effort test, but still better than nothing :)

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/wrong-rules-after-setsebool/Makefile b/kernel/wrong-rules-after-setsebool/Makefile
new file mode 100644
index 0000000..1b54785
--- /dev/null
+++ b/kernel/wrong-rules-after-setsebool/Makefile
@@ -0,0 +1,7 @@
+# Minimal Makefile for standard-test-roles-beakerlib
+
+R="RhtsRequires: policycoreutils setools-console"
+
+run:
+	chmod +x runtest.sh
+	./runtest.sh

diff --git a/kernel/wrong-rules-after-setsebool/main.fmf b/kernel/wrong-rules-after-setsebool/main.fmf
new file mode 100644
index 0000000..d31ce1f
--- /dev/null
+++ b/kernel/wrong-rules-after-setsebool/main.fmf
@@ -0,0 +1,20 @@
+summary: Regression test for broken rules after setting booleans
+description: |
+    Test that conditional rules are not broken after changing SELinux booleans.
+
+    Originally discovered in:
+    https://src.fedoraproject.org/tests/selinux/pull-request/203#comment-71053
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+- kernel
+framework: beakerlib
+require:
+- policycoreutils
+- setools-console
+duration: 5m
+tier: 2
+enabled: true
+adjust:
+    enabled: false
+    when: distro < rhel-7
+    because: RHEL-6 and below are not worth supporting by this test

diff --git a/kernel/wrong-rules-after-setsebool/runtest.sh b/kernel/wrong-rules-after-setsebool/runtest.sh
new file mode 100755
index 0000000..6aad544
--- /dev/null
+++ b/kernel/wrong-rules-after-setsebool/runtest.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2021 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "uname -r"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \
+            tee sesearch-before.txt"
+        rlRun "setsebool ftpd_anon_write=off ftpd_connect_all_unreserved=off \
+            ftpd_connect_db=off ftpd_full_access=off"
+        rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \
+            tee sesearch-after.txt"
+        rlAssertNotDiffer "sesearch-before.txt" "sesearch-after.txt"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f sesearch-before.txt sesearch-after.txt"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd