[tests/selinux] pr775-checkpolicy-revdeps: unset the default context for /var/ARTIFACTS

[tests/selinux] pr775-checkpolicy-revdeps: unset the default context for /var/ARTIFACTS

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 58ae65cd1e7916c33ef061d73abca1636a61d7bc
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-04-26T13:18:49+00:00
            Stats  : +7/-0 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/58ae65cd1e7916c33ef061d73abca1636a61d7bc?branch=pr775-checkpolicy-revdeps

            Log:
            unset the default context for /var/ARTIFACTS

Many automated tests run the "restorecon -Rv /run /var" command
to ensure that file-system objects stored in these locations are
labeled correctly. Unfortunately, the command affects SELinux
contexts of files/directories stored under /var/ARTIFACTS/. For
example: the rlFileBackup function uses this location as well.
To avoid such unpleasant effects, the default SELinux context for
/var/ARTIFACTS directory is now set to /proc equivalent (meaning:
no default context).

---
diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh
index 149e1a2..22a7b31 100644
--- a/selinux-policy/Library/common/lib.sh
+++ b/selinux-policy/Library/common/lib.sh
@@ -1995,6 +1995,13 @@ rlSELibraryLoaded() {
     else
         rlRun "dnf -y --skip-broken install $rlSE_REQUIRES"
     fi
+
+    # make sure that restorecon does not change SELinux contexts under /var/ARTIFACTS
+    # otherwise SELinux context of backed up files/directories will be affected
+    if matchpathcon /var/ARTIFACTS/something | grep -q :var_t: ; then
+        semanage fcontext -a -e /proc /var/ARTIFACTS
+    fi
+
     if rlCheckRequirements $rlSE_REQUIRES; then
         SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'`
         rlLogDebug "FUNCNAME(): sesearch --version: $(sesearch --version 2>&1)"