[tests/selinux] pr775-checkpolicy-revdeps: Test semodule -l --checksum

[tests/selinux] pr775-checkpolicy-revdeps: Test semodule -l --checksum

[Petr Lautrbach]

A new commit has been pushed.

Repo   : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 4e4c91dbc4252df1769929be23883f4a70026c94
Author : Petr Lautrbach <plautrba@redhat.com>
Date   : 2021-12-02T14:54:52+01:00
Stats  : +154/-0 in 4 file(s)
URL    : https://src.fedoraproject.org/tests/selinux/c/4e4c91dbc4252df1769929be23883f4a70026c94?branch=pr775-checkpolicy-revdeps

Log:
Test semodule -l --checksum

---
diff --git a/policycoreutils/semodule-l-checksum/Makefile b/policycoreutils/semodule-l-checksum/Makefile
new file mode 100644
index 0000000..875a9b8
--- /dev/null
+++ b/policycoreutils/semodule-l-checksum/Makefile
@@ -0,0 +1,64 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum
+#   Description: Test semodule -l --checksum
+#   Author: Petr Lautrbach <plautrba@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2021 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Petr Lautrbach <plautrba@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Test semodule -l --checksum" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          policycoreutils" >> $(METADATA)
+	@echo "Requires:        policycoreutils selinux-policy-devel" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2+" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Bug:             1731501 2026680" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA)
+
+	rhts-lint $(METADATA)

diff --git a/policycoreutils/semodule-l-checksum/PURPOSE b/policycoreutils/semodule-l-checksum/PURPOSE
new file mode 100644
index 0000000..a11f95a
--- /dev/null
+++ b/policycoreutils/semodule-l-checksum/PURPOSE
@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum
+Description: Test semodule -l --checksum
+Author: Petr Lautrbach <plautrba@redhat.com>

diff --git a/policycoreutils/semodule-l-checksum/main.fmf b/policycoreutils/semodule-l-checksum/main.fmf
new file mode 100644
index 0000000..68b9946
--- /dev/null
+++ b/policycoreutils/semodule-l-checksum/main.fmf
@@ -0,0 +1,8 @@
+path: /policycoreutils/semodule-l-checksum
+summary: Test semodule -l --checksum
+description: |
+    semodule -l --checksum shows sha256 checksum of loaded modules and this test is supposed to test it
+duration: 10m
+adjust:
+-   enabled: false
+    when: distro < rhel-8

diff --git a/policycoreutils/semodule-l-checksum/runtest.sh b/policycoreutils/semodule-l-checksum/runtest.sh
new file mode 100755
index 0000000..eabd453
--- /dev/null
+++ b/policycoreutils/semodule-l-checksum/runtest.sh
@@ -0,0 +1,79 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum
+#   Description: Test semodule -l --checksum
+#   Author: Petr Lautrbach <plautrba@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2021 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="policycoreutils"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        # create new type, allow reading, do not allow writing
+        rlRun "cat << EOF >test_module.te
+module test_module 1.0;
+
+require {
+    type unconfined_t;
+    attribute filesystem_type;
+    class file { getattr ioctl lock open read relabelto write };
+    class filesystem { associate };
+}
+
+type test_t;
+
+allow test_t filesystem_type:filesystem { associate };
+allow unconfined_t test_t:file { getattr ioctl lock open read relabelto};
+dontaudit unconfined_t test_t:file { write };
+EOF"
+        # compile the module
+        rlRun "make -f /usr/share/selinux/devel/Makefile test_module.pp"
+        # load it
+        rlRun "semodule -X 500 -i test_module.pp"
+        rlRun "/usr/libexec/selinux/hll/pp test_module.pp test_module.cil"
+
+    rlPhaseEnd
+
+    rlPhaseStartTest "semodule -lfull --checksum"
+        rlRun "semodule -lfull --checksum | grep test_module"
+        module=($(semodule -lfull --checksum | grep test_module) )
+        sha256=($(sha256sum test_module.cil))
+        rlAssertEquals "Is the module name 'test_module'?" ${module[1]} "test_module"
+        rlAssertEquals "Is the module priority '500'?" ${module[0]} "500"
+        rlAssertEquals "Is the loaded module checksum same as the file checksum? " ${module[3]} ${sha256[0]}
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "semodule -X 500 -r test_module"
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd