[tests/selinux] pr775-checkpolicy-revdeps: update the rngd test to the latest version

[tests/selinux] pr775-checkpolicy-revdeps: update the rngd test to the latest version

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : a575a54b9a6b738fcb855e490a40bef61085780d
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-04-28T15:07:07+02:00
            Stats  : +32/-3 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/a575a54b9a6b738fcb855e490a40bef61085780d?branch=pr775-checkpolicy-revdeps

            Log:
            update the rngd test to the latest version

TBA

---
diff --git a/selinux-policy/rngd-and-similar/Makefile b/selinux-policy/rngd-and-similar/Makefile
index 43f6ad4..e4d0031 100644
--- a/selinux-policy/rngd-and-similar/Makefile
+++ b/selinux-policy/rngd-and-similar/Makefile
@@ -55,7 +55,7 @@ $(METADATA): Makefile
 	@echo "TestTime:        15m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "RunFor:          rng-tools" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console rng-tools initscripts" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console rng-tools /usr/sbin/service" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
@@ -85,6 +85,9 @@ $(METADATA): Makefile
 	@echo "Bug:             1928572" >> $(METADATA) # Fedora 33
 	@echo "Bug:             1929360" >> $(METADATA) # Fedora 33
 	@echo "Bug:             1929366" >> $(METADATA) # Fedora 33
+	@echo "Bug:             2058914" >> $(METADATA) # Fedora 36
+	@echo "Bug:             2076641" >> $(METADATA) # RHEL-8
+	@echo "Bug:             2076642" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf
index c42e941..b599860 100644
--- a/selinux-policy/rngd-and-similar/main.fmf
+++ b/selinux-policy/rngd-and-similar/main.fmf
@@ -5,6 +5,8 @@ description: |+
 contact: Milos Malik <mmalik@redhat.com>
 component:
   - selinux-policy
+test: ./runtest.sh
+framework: beakerlib
 require:
   - library(selinux-policy/common)
 recommend:
@@ -16,7 +18,7 @@ recommend:
   - selinux-policy-targeted
   - setools-console
   - rng-tools
-  - initscripts
+  - /usr/sbin/service
 environment:
     AVC_ERROR: +no_avc_check
 duration: 15m
@@ -58,6 +60,9 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929360
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929366
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1931450
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2058914
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076641
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076642
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6

diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh
index 884cbdf..9007917 100755
--- a/selinux-policy/rngd-and-similar/runtest.sh
+++ b/selinux-policy/rngd-and-similar/runtest.sh
@@ -48,6 +48,7 @@ rlJournalStart
 
         rlServiceStop ${SERVICE_NAME}
         rlFileBackup /etc/shadow
+        rlFileBackup /etc/sysconfig/rngd
 
         rlSESetEnforce
         rlSEStatus
@@ -145,6 +146,15 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    DROP_PRIV=false
+    if rngd --help | grep -qi 'drop.*priv' ; then
+        DROP_PRIV=true
+        rlPhaseStartTest "bz#2076641 + bz#2076642"
+            rlSESearchRule "allow rngd_t rngd_t : capability { setgid setuid } [ ]"
+            rlSESearchRule "allow rngd_t rngd_t : process { setcap } [ ]"
+        rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         rlRun "modprobe tpm-rng" 0,1
@@ -159,7 +169,18 @@ rlJournalStart
         rlRun "setsebool daemons_use_tty on"
         rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rngd -l'" 0-255
         rlRun "setsebool daemons_use_tty off"
-        rlRun "restorecon -Rv /run /var"
+        rlRun "restorecon -Rv /run /var" 0-255
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
+        if ${DROP_PRIV} ; then
+            rlLog "modifying the /etc/sysconfig/rngd file"
+            if ! grep -q '^RNGD_ARGS.*daemon:daemon' /etc/sysconfig/rngd ; then
+                sed -i 's/^\(RNGD_ARGS=.*\)"$/\1 -D daemon:daemon"/' /etc/sysconfig/rngd
+            fi
+            if ! grep -q '^RNGD_ARGS.*jitter' /etc/sysconfig/rngd ; then
+                sed -i 's/^\(RNGD_ARGS=.*\)"$/\1 -x jitter"/' /etc/sysconfig/rngd
+            fi
+        fi
+        rlRun "grep ^RNGD_ARGS= /etc/sysconfig/rngd"
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd