[tests/selinux] pr775-checkpolicy-revdeps: policycoretuils: add new test for setfiles with binary policy

[tests/selinux] pr775-checkpolicy-revdeps: policycoretuils: add new test for setfiles with binary policy

[Vit Mojzis]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 99db07804ed222e1ab01001f4a847e9f1904f094
            Author : Vit Mojzis <vmojzis@redhat.com>
            Date   : 2021-07-09T17:17:41+02:00
            Stats  : +162/-0 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/99db07804ed222e1ab01001f4a847e9f1904f094?branch=pr775-checkpolicy-revdeps

            Log:
            policycoretuils: add new test for setfiles with binary policy

setfiles didn't allow using "-c" parameter (binary policy) when path was
specified. Verify that setfiles now gives the same results regardless of
weather binary policy was provided.

The TC covers BZ#1973754

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>

---
diff --git a/policycoreutils/setfiles_binary/Makefile b/policycoreutils/setfiles_binary/Makefile
new file mode 100644
index 0000000..121f784
--- /dev/null
+++ b/policycoreutils/setfiles_binary/Makefile
@@ -0,0 +1,63 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/policycoreutils/Sanity/setfiles_binary
+#   Description: setfiles should allow checking given path against binary policy
+#   Author: Vit Mojzis <vmojzis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2021 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/policycoreutils/Sanity/setfiles_binary
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Vit Mojzis <vmojzis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     setfiles should allow checking given path against binary policy" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          policycoreutils" >> $(METADATA)
+	@echo "Requires:        policycoreutils rpm cpio" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Bug:             1973754" >> $(METADATA) # RHEL-8
+	rhts-lint $(METADATA)

diff --git a/policycoreutils/setfiles_binary/PURPOSE b/policycoreutils/setfiles_binary/PURPOSE
new file mode 100644
index 0000000..7389189
--- /dev/null
+++ b/policycoreutils/setfiles_binary/PURPOSE
@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/policycoreutils/Sanity/setfiles_binary
+Description: Setfiles should allow checking given path against binary policy
+Author: Vit Mojzis <vmojzis@redhat.com>

diff --git a/policycoreutils/setfiles_binary/main.fmf b/policycoreutils/setfiles_binary/main.fmf
new file mode 100644
index 0000000..2eac0ad
--- /dev/null
+++ b/policycoreutils/setfiles_binary/main.fmf
@@ -0,0 +1,21 @@
+summary: setfiles should allow checking given path against binary policy
+description: setfiles didn't allow using "-c" parameter (binary policy)
+when path was specified. Verify that setfiles now gives the same results
+regardless of weather binary policy was provided.
+contact: Vit Mojzis <vmojzis@redhat.com>
+path: /policycoreutils/setfiles_binary
+component:
+- policycoreutils
+framework: beakerlib
+require:
+- e2fsprogs
+- policycoreutils
+- rpm
+- cpio
+duration: 5m
+tier: 1
+enabled: true
+adjust:
+    enabled: false
+    when: distro ~< rhel-8.4
+    because: not expected to be fixed in RHEL-8 below 8.4

diff --git a/policycoreutils/setfiles_binary/runtest.sh b/policycoreutils/setfiles_binary/runtest.sh
new file mode 100755
index 0000000..e7a292f
--- /dev/null
+++ b/policycoreutils/setfiles_binary/runtest.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/policycoreutils/Sanity/setfiles_binary
+#   Description: setfiles should allow checking given path against binary policy
+#   Author: Vit Mojzis <vmojzis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2021 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="policycoreutils"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        OUTPUT=`mktemp`
+        rlRun "mkdir policy"
+        rlRun "pushd policy"
+        # download and extract selinux-policy-targeted
+        rlRun "dnf download selinux-policy-targeted --downloaddir ."
+        rlRun "rpm2cpio *.rpm | cpio -idm"
+        rlRun "popd"
+        # create a mockup of root directory structure
+        DIRS="bin  boot  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  snap  srv  sys tmp  usr  var"
+        rlRun "
+mkdir testroot
+for DIR in ${DIRS}; do
+    mkdir -p testroot/\${DIR}
+done
+"
+        rlRun "ls -lZ testroot"
+    rlPhaseEnd
+
+    rlPhaseStartTest "setfiles should allow checking given path against binary policy - bz#1973754"
+        DIR=$(pwd)
+        # run setfiles using system policy
+        rlRun "setfiles -r '$DIR/testroot' -nvF /etc/selinux/targeted/contexts/files/file_contexts '$DIR/testroot' &> setfilesout"
+        POLICY=$(find "$DIR/policy/etc/selinux/targeted/policy/" -name "policy.*")
+        # run the same command using the extracted policy
+        rlRun "setfiles -r '$DIR/testroot' -nvF -c '$POLICY' '$DIR/policy/etc/selinux/targeted/contexts/files/file_contexts' '$DIR/testroot' &> setfilesout2"
+        rlRun "diff setfilesout setfilesout2" 0
+        if [ ! $? -eq 0 ] ; then
+            rlRun "cat setfilesout"
+            rlRun "cat setfilesout2"
+        fi
+    rlPhaseEnd
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd