[tests/selinux] pr775-checkpolicy-revdeps: Add a basic test for SELinux AVC tracepoint

[tests/selinux] pr775-checkpolicy-revdeps: Add a basic test for SELinux AVC tracepoint

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 8ea2e4bd982f2b583496a1a63a5ea682f6845b59
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2021-04-28T15:18:14+02:00
            Stats  : +62/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/8ea2e4bd982f2b583496a1a63a5ea682f6845b59?branch=pr775-checkpolicy-revdeps

            Log:
            Add a basic test for SELinux AVC tracepoint

See the test description for more info.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/avc_tracepoint/Makefile b/kernel/avc_tracepoint/Makefile
new file mode 100644
index 0000000..e266c68
--- /dev/null
+++ b/kernel/avc_tracepoint/Makefile
@@ -0,0 +1,7 @@
+# Minimal Makefile for standard-test-roles-beakerlib
+
+R="RhtsRequires: perf"
+
+run:
+	chmod +x runtest.sh
+	./runtest.sh

diff --git a/kernel/avc_tracepoint/main.fmf b/kernel/avc_tracepoint/main.fmf
new file mode 100644
index 0000000..cfa723e
--- /dev/null
+++ b/kernel/avc_tracepoint/main.fmf
@@ -0,0 +1,25 @@
+summary: Basic test for SELinux AVC tracepoint support
+description: |
+  Tests basic functionality of the built-in kernel tracepoint for audited
+  SELinux denials that has been introduced in kernel v5.10.
+
+  See also:
+  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd8166212d9a2eca3181567c953d5687aea4d7dc
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+- kernel
+framework: beakerlib
+require:
+- perf
+duration: 5m
+tier: 2
+enabled: true
+adjust:
+- enabled: false
+  when: distro < rhel-8.5
+  because: RHEL-8.5 and below are not expected to support this
+- enabled: false
+  when: distro < fedora-35
+  because: This feature may not be available in kernels in F34 and below
+link:
+- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954024

diff --git a/kernel/avc_tracepoint/runtest.sh b/kernel/avc_tracepoint/runtest.sh
new file mode 100755
index 0000000..d5f292f
--- /dev/null
+++ b/kernel/avc_tracepoint/runtest.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2021 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "uname -r"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlAssertExists /sys/kernel/tracing/events/avc/selinux_audited/enable
+        rlRun "perf list | grep avc:selinux_audited"
+        rlRun "perf record -o perf.data -e avc:selinux_audited \
+            -g --call-graph dwarf \
+            runcon system_u:system_r:kernel_t:s0 echo" 0-255
+        rlRun "perf script -i perf.data"
+        rlAssertGreater "'perf script' output should have more than 0 lines" \
+            "$(perf script -i perf.data | wc -l)" "0"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f perf.data"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd