[tests/selinux] pr775-checkpolicy-revdeps: avoid testing empty CIL modules

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 37adc8484f605fb6ec13bd0e31e932eb86cb1202
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-10-07T14:24:29+02:00
            Stats  : +20/-2 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/37adc8484f605fb6ec13bd0e31e932eb86cb1202?branch=pr775-checkpolicy-revdeps

            Log:
            avoid testing empty CIL modules

SELinux user-space of version 3.3 and higher does not support loading
of empty CIL modules. If such version is installed, one of the test
phases will be skipped.

---
diff --git a/policycoreutils/CIL-modules-without-compilation/Makefile b/policycoreutils/CIL-modules-without-compilation/Makefile
index 2d8a660..a16e88d 100644
--- a/policycoreutils/CIL-modules-without-compilation/Makefile
+++ b/policycoreutils/CIL-modules-without-compilation/Makefile
@@ -53,7 +53,7 @@ $(METADATA): Makefile
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          policycoreutils" >> $(METADATA)
-	@echo "Requires:        policycoreutils" >> $(METADATA)
+	@echo "Requires:        /usr/sbin/semodule /usr/sbin/semanage" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

diff --git a/policycoreutils/CIL-modules-without-compilation/runtest.sh b/policycoreutils/CIL-modules-without-compilation/runtest.sh
index 451461a..a121c58 100755
--- a/policycoreutils/CIL-modules-without-compilation/runtest.sh
+++ b/policycoreutils/CIL-modules-without-compilation/runtest.sh
@@ -31,14 +31,18 @@
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 PACKAGE="policycoreutils"
+PACKAGE_VERSION=`rpm -q --queryformat '%{version}' ${PACKAGE}`
 
 rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm $PACKAGE
         rlRun "echo '()' > empty.cil"
+        rlRun "echo '( auditallow init_t security_t ( security ( setsecparam )))' > valid.cil"
         rlRun "echo '(())' > invalid.cil"
     rlPhaseEnd
 
+    # version 3.3 of SELinux user-space does not accept empty CIL module
+    if echo "${PACKAGE_VERSION} < 3.3" | bc | grep -q 1 ; then
     rlPhaseStartTest "empty CIL module"
         rlRun "semodule -lfull | grep '400.*empty.*cil'" 1
         rlRun "semodule -i empty.cil"
@@ -51,6 +55,20 @@ rlJournalStart
         rlRun "semanage module -r empty"
         rlRun "semanage module -l | grep 'empty.*400.*cil'" 1
     rlPhaseEnd
+    fi
+
+    rlPhaseStartTest "valid CIL module"
+        rlRun "semodule -lfull | grep '400.*valid.*cil'" 1
+        rlRun "semodule -i valid.cil"
+        rlRun "semodule -lfull | grep '400.*valid.*cil'"
+        rlRun "semodule -r valid"
+        rlRun "semodule -lfull | grep '400.*valid.*cil'" 1
+        rlRun "semanage module -l | grep 'valid.*400.*cil'" 1
+        rlRun "semanage module -a valid.cil"
+        rlRun "semanage module -l | grep 'valid.*400.*cil'"
+        rlRun "semanage module -r valid"
+        rlRun "semanage module -l | grep 'valid.*400.*cil'" 1
+    rlPhaseEnd
 
     rlPhaseStartTest "invalid CIL module"
         rlRun "semodule -lfull | grep '400.*invalid.*cil'" 1
@@ -66,7 +84,7 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartCleanup
-        rlRun "rm -f empty.cil invalid.cil"
+        rlRun "rm -f empty.cil valid.cil invalid.cil"
     rlPhaseEnd
 rlJournalPrintText
 rlJournalEnd