[tests/selinux] pr775-checkpolicy-revdeps: Add a test for semodule --rebuild-if-modules-changed

[Ondrej Mosnacek <omosnace@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 8b7e684a0d514c5fe0046ea145ee8ea7d4345144
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2022-03-01T12:58:06+01:00
            Stats  : +117/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/8b7e684a0d514c5fe0046ea145ee8ea7d4345144?branch=pr775-checkpolicy-revdeps

            Log:
            Add a test for semodule --rebuild-if-modules-changed

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/Makefile b/policycoreutils/semodule-rebuild-if-modules-changed/Makefile
new file mode 100644
index 0000000..313928c
--- /dev/null
+++ b/policycoreutils/semodule-rebuild-if-modules-changed/Makefile
@@ -0,0 +1,7 @@
+# Minimal Makefile for standard-test-roles-beakerlib
+
+R="RhtsRequires: policycoreutils checkpolicy setools-console selinux-policy-targeted"
+
+run:
+	chmod +x runtest.sh
+	./runtest.sh

diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf
new file mode 100644
index 0000000..1a8db10
--- /dev/null
+++ b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf
@@ -0,0 +1,28 @@
+summary: Test rebuild-on-change support in semodule
+description: |
+  Verifies that semodule --rebuild-if-modules-changed command-line option
+  works as it should.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+  - policycoreutils
+framework: beakerlib
+require:
+  - policycoreutils
+  - checkpolicy
+  - setools-console
+  - selinux-policy-targeted
+duration: 15m
+tier: 2
+enabled: true
+adjust:
+  - enabled: false
+    when: distro < rhel-8
+    because: RHEL-7 and below are not expected to support this
+  - enabled: false
+    when: distro < fedora-36
+    because: This feature may not be available in F35 and below
+link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049186
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049189
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049191
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049193

diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
new file mode 100755
index 0000000..8f55dda
--- /dev/null
+++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2021 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+STORE_ROOT=/var/lib/selinux
+STORE_TYPE=targeted
+MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules"
+STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern"
+TEST_MODULE_DIR="$MODULES_ROOT/400/test_module"
+
+CHECKSUM_CMD=sha256sum
+
+function policy_checksum() {
+    local policyvers="$1"
+
+    "$CHECKSUM_CMD" "/etc/selinux/$STORE_TYPE/policy/policy.$policyvers"
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm "libsemanage"
+        rlAssertRpm "policycoreutils"
+
+        policyvers="$(checkpolicy -V | cut -f 1 -d ' ')"
+        policyvers_kernel="$(cat /sys/fs/selinux/policyvers)"
+        if [ "$policyvers" -lt "$policyvers_kernel" ]; then
+            policyvers="$policyvers_kernel"
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        if semodule --help | grep -q -- --rebuild-if-modules-changed; then
+            rlRun "semodule -N -B" 0 \
+                "Make sure policy store is in a consistent state initially"
+
+            checksum_before="$(policy_checksum "$policyvers")"
+            rlRun "semodule -N --rebuild-if-modules-changed"
+            checksum_after="$(policy_checksum "$policyvers")"
+            rlAssertEquals "Binary policy must not change after rebuild" \
+                "$checksum_before" "$checksum_after"
+
+            rlRun "semodule -N -B" 0 \
+                "Make sure policy store is in a consistent state initially"
+
+            rlLog "Inject a new module into the store"
+            rlRun "mkdir -p \"\$TEST_MODULE_DIR\""
+            rlRun "echo -n cil >\"\$TEST_MODULE_DIR/lang_ext\""
+            rlRun "echo '(type test_module_type_t)' >\"\$TEST_MODULE_DIR/cil\""
+            rlRun "semodule -N --rebuild-if-modules-changed" 0 \
+                "Do a conditional rebuild"
+            rlRun "semodule -l | grep test_module" 0 \
+                "Verify that the module has been picked up"
+            rlRun "seinfo -t test_module_type_t \"\$STORE_POLICY\" | grep test_module_type_t" 0 \
+                "Verify that the new type is included in the built policy"
+
+            rlLog "Now remove the module"
+            rlRun "rm -rf \"\$TEST_MODULE_DIR\""
+            rlRun "semodule -N --rebuild-if-modules-changed"
+            rlRun "semodule -l | grep test_module" 1 \
+                "Verify that the module has been removed"
+            rlRun "seinfo -t test_module_type_t \"\$STORE_POLICY\" | grep test_module_type_t" 1 \
+                "Verify that the new type is NOT included in the built policy"
+
+            # Make sure policy is restored regardless of any previous failures
+            rlRun "semodule -N -B" 0 \
+                "Force a rebuild to clean things up"
+            #rlRun "setsebool -NP daemons_use_tty=on"
+            # TODO test changing booleans (persistently)
+        else
+            rlLog "--rebuild-if-modules-changed command-line option not supported; skipping tests..."
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd