[tests/selinux] pr775-checkpolicy-revdeps: Add a test for self keyword support in type rules

[tests/selinux] pr775-checkpolicy-revdeps: Add a test for self keyword support in type rules

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : f24d1087c7ce09d551e3bd76ed328992d2499026
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2022-06-03T14:44:51+00:00
            Stats  : +420/-0 in 21 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/f24d1087c7ce09d551e3bd76ed328992d2499026?branch=pr775-checkpolicy-revdeps

            Log:
            Add a test for self keyword support in type rules

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/libsepol/self-keyword-in-type-rules/main.fmf b/libsepol/self-keyword-in-type-rules/main.fmf
new file mode 100644
index 0000000..f54e8a6
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/main.fmf
@@ -0,0 +1,27 @@
+summary: Test support for self keyword in type rules
+description: |
+  Verifies that libsepol/checkmodule supports the self keyword in type rules.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+  - libsepol
+  - checkpolicy
+framework: beakerlib
+require:
+  - policycoreutils
+  - checkpolicy
+  - setools-console
+  - selinux-policy
+  - selinux-policy-devel
+  - diffutils
+duration: 15m
+tier: 2
+enabled: true
+adjust:
+  - enabled: false
+    when: distro < rhel-9.1
+    because: RHEL-8 and below are not expected to support this
+  - enabled: false
+    when: distro < fedora-37
+    because: This feature may not be available in F36 and below
+link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2069718

diff --git a/libsepol/self-keyword-in-type-rules/rules_expected.txt b/libsepol/self-keyword-in-type-rules/rules_expected.txt
new file mode 100644
index 0000000..239acc4
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/rules_expected.txt
@@ -0,0 +1,90 @@
+type_change test_a_t test_a_t:dir test_e_t;
+type_change test_a_t test_a_t:file test_e_t;
+type_change test_b_t test_b_t:dir test_e_t;
+type_change test_b_t test_b_t:file test_e_t;
+type_change test_c_t test_c_t:dir test_e_t;
+type_change test_c_t test_c_t:file test_e_t;
+type_change test_d_t test_d_t:dir test_e_t;
+type_change test_d_t test_d_t:file test_e_t;
+type_change test_h_t test_a_t:dir test_e_t;
+type_change test_h_t test_a_t:file test_e_t;
+type_change test_h_t test_b_t:dir test_e_t;
+type_change test_h_t test_b_t:file test_e_t;
+type_change test_h_t test_c_t:dir test_e_t;
+type_change test_h_t test_c_t:file test_e_t;
+type_change test_h_t test_d_t:dir test_e_t;
+type_change test_h_t test_d_t:file test_e_t;
+type_change test_h_t test_h_t:dir test_e_t;
+type_change test_h_t test_h_t:file test_e_t;
+type_member test_a_t test_a_t:dir test_e_t;
+type_member test_a_t test_a_t:file test_e_t;
+type_member test_b_t test_b_t:dir test_e_t;
+type_member test_b_t test_b_t:file test_e_t;
+type_member test_c_t test_c_t:dir test_e_t;
+type_member test_c_t test_c_t:file test_e_t;
+type_member test_d_t test_d_t:dir test_e_t;
+type_member test_d_t test_d_t:file test_e_t;
+type_member test_h_t test_a_t:dir test_e_t;
+type_member test_h_t test_a_t:file test_e_t;
+type_member test_h_t test_b_t:dir test_e_t;
+type_member test_h_t test_b_t:file test_e_t;
+type_member test_h_t test_c_t:dir test_e_t;
+type_member test_h_t test_c_t:file test_e_t;
+type_member test_h_t test_d_t:dir test_e_t;
+type_member test_h_t test_d_t:file test_e_t;
+type_member test_h_t test_h_t:dir test_e_t;
+type_member test_h_t test_h_t:file test_e_t;
+type_transition test_a_t test_a_t:dir test_e_t;
+type_transition test_a_t test_a_t:dir test_f_t filename1;
+type_transition test_a_t test_a_t:dir test_g_t filename2;
+type_transition test_a_t test_a_t:file test_e_t;
+type_transition test_a_t test_a_t:file test_f_t filename1;
+type_transition test_a_t test_a_t:file test_g_t filename2;
+type_transition test_b_t test_b_t:dir test_e_t;
+type_transition test_b_t test_b_t:dir test_f_t filename1;
+type_transition test_b_t test_b_t:dir test_g_t filename2;
+type_transition test_b_t test_b_t:file test_e_t;
+type_transition test_b_t test_b_t:file test_f_t filename1;
+type_transition test_b_t test_b_t:file test_g_t filename2;
+type_transition test_c_t test_c_t:dir test_e_t;
+type_transition test_c_t test_c_t:dir test_f_t filename1;
+type_transition test_c_t test_c_t:dir test_g_t filename2;
+type_transition test_c_t test_c_t:file test_e_t;
+type_transition test_c_t test_c_t:file test_f_t filename1;
+type_transition test_c_t test_c_t:file test_g_t filename2;
+type_transition test_d_t test_d_t:dir test_e_t;
+type_transition test_d_t test_d_t:dir test_f_t filename1;
+type_transition test_d_t test_d_t:dir test_g_t filename2;
+type_transition test_d_t test_d_t:file test_e_t;
+type_transition test_d_t test_d_t:file test_f_t filename1;
+type_transition test_d_t test_d_t:file test_g_t filename2;
+type_transition test_h_t test_a_t:dir test_e_t;
+type_transition test_h_t test_a_t:dir test_f_t filename1;
+type_transition test_h_t test_a_t:dir test_g_t filename2;
+type_transition test_h_t test_a_t:file test_e_t;
+type_transition test_h_t test_a_t:file test_f_t filename1;
+type_transition test_h_t test_a_t:file test_g_t filename2;
+type_transition test_h_t test_b_t:dir test_e_t;
+type_transition test_h_t test_b_t:dir test_f_t filename1;
+type_transition test_h_t test_b_t:dir test_g_t filename2;
+type_transition test_h_t test_b_t:file test_e_t;
+type_transition test_h_t test_b_t:file test_f_t filename1;
+type_transition test_h_t test_b_t:file test_g_t filename2;
+type_transition test_h_t test_c_t:dir test_e_t;
+type_transition test_h_t test_c_t:dir test_f_t filename1;
+type_transition test_h_t test_c_t:dir test_g_t filename2;
+type_transition test_h_t test_c_t:file test_e_t;
+type_transition test_h_t test_c_t:file test_f_t filename1;
+type_transition test_h_t test_c_t:file test_g_t filename2;
+type_transition test_h_t test_d_t:dir test_e_t;
+type_transition test_h_t test_d_t:dir test_f_t filename1;
+type_transition test_h_t test_d_t:dir test_g_t filename2;
+type_transition test_h_t test_d_t:file test_e_t;
+type_transition test_h_t test_d_t:file test_f_t filename1;
+type_transition test_h_t test_d_t:file test_g_t filename2;
+type_transition test_h_t test_h_t:dir test_e_t;
+type_transition test_h_t test_h_t:dir test_f_t filename1;
+type_transition test_h_t test_h_t:dir test_g_t filename2;
+type_transition test_h_t test_h_t:file test_e_t;
+type_transition test_h_t test_h_t:file test_f_t filename1;
+type_transition test_h_t test_h_t:file test_g_t filename2;

diff --git a/libsepol/self-keyword-in-type-rules/runtest.sh b/libsepol/self-keyword-in-type-rules/runtest.sh
new file mode 100755
index 0000000..982a2e9
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/runtest.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+MODULES_BAD="test_self_tt_bad1 test_self_tt_bad2 test_self_tt_bad3 test_self_tt_bad4"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm "libsepol"
+        rlAssertRpm "checkpolicy"
+        rlAssertRpm "policycoreutils"
+        rlAssertRpm "selinux-policy"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test good TE module"
+        rlRun "make -f /usr/share/selinux/devel/Makefile test_self_tt_good.pp" 0 \
+            "Test that test_self_tt_good TE module can be built"
+        rlRun "semodule -i test_self_tt_good.pp" 0 \
+            "Test that test_self_tt_good TE module can be installed"
+        rlRun "diff rules_expected.txt <(sesearch -T --type_change --type_member -rd -D 'test_[efg]_t' | sort)" 0 \
+            "Test that the resulting binary policy rules match the expected ones"
+        rlRun "semodule -r test_self_tt_good" 0 \
+            "Remove the test_self_tt_good TE module"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test good CIL module"
+        rlRun "semodule -i test_self_tt_good.cil" 0 \
+            "Test that test_self_tt_good CIL module can be installed"
+        rlRun "diff rules_expected.txt <(sesearch -T --type_change --type_member -rd -D 'test_[efg]_t' | sort)" 0 \
+            "Test that the resulting binary policy rules match the expected ones"
+        rlRun "semodule -r test_self_tt_good" 0 \
+            "Remove the test_self_tt_good CIL module"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test bad TE modules"
+        for i in {1..8}; do
+            rlRun "make -f /usr/share/selinux/devel/Makefile test_self_tt_bad$i.pp" 0-2 \
+                "Try to build test_self_tt_bad$i TE module"
+            rlRun "semodule -i test_self_tt_bad$i.pp" 1 \
+                "Test that test_self_tt_bad$i TE module cannot be installed"
+            rlRun "semodule -r test_self_tt_bad$i" 1 \
+                "Try to remove the test_self_tt_bad$i TE module"
+        done
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test bad CIL modules"
+        for i in {1..8}; do
+            rlRun "semodule -i test_self_tt_bad$i.cil" 1 \
+                "Test that test_self_tt_bad$i CIL module cannot be installed"
+            rlRun "semodule -r test_self_tt_bad$i" 1 \
+                "Try to remove the test_self_tt_bad$i CIL module"
+        done
+    rlPhaseEnd
+
+    rlJournalPrintText
+rlJournalEnd

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil
new file mode 100644
index 0000000..a686a2b
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil
@@ -0,0 +1,6 @@
+(type test_a_t)
+(type test_b_t)
+(type test_c_t)
+
+(typetransition test_a_t self file test_b_t)
+(typetransition test_a_t self file test_c_t)

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te
new file mode 100644
index 0000000..a788670
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te
@@ -0,0 +1,8 @@
+policy_module(test_self_tt_bad1,1.0)
+
+type test_a_t;
+type test_b_t;
+type test_c_t;
+
+type_transition test_a_t self:file test_b_t;
+type_transition test_a_t self:file test_c_t;

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil
new file mode 100644
index 0000000..a1815b1
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil
@@ -0,0 +1,6 @@
+(type test_a_t)
+(type test_b_t)
+(type test_c_t)
+
+(typetransition test_a_t self file test_b_t)
+(typetransition test_a_t test_a_t file test_c_t)

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te
new file mode 100644
index 0000000..592880a
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te
@@ -0,0 +1,8 @@
+policy_module(test_self_tt_bad2,1.0)
+
+type test_a_t;
+type test_b_t;
+type test_c_t;
+
+type_transition test_a_t self:file test_b_t;
+type_transition test_a_t test_a_t:file test_c_t;

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil
new file mode 100644
index 0000000..850305b
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil
@@ -0,0 +1,11 @@
+(typeattribute  test_attrib_1)
+
+(type test_a_t)
+(type test_b_t)
+(type test_c_t)
+(type test_d_t)
+
+(typeattributeset test_attrib_1 (test_a_t test_b_t))
+
+(typetransition test_attrib_1 self file test_b_t)
+(typetransition test_a_t test_a_t file test_c_t)

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te
new file mode 100644
index 0000000..7be110a
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te
@@ -0,0 +1,11 @@
+policy_module(test_self_tt_bad3,1.0)
+
+attribute test_attrib_1;
+
+type test_a_t, test_attrib_1;
+type test_b_t, test_attrib_1;
+type test_c_t;
+type test_d_t;
+
+type_transition test_attrib_1 self:file test_c_t;
+type_transition test_a_t test_a_t:file test_d_t;

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil
new file mode 100644
index 0000000..0474094
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil
@@ -0,0 +1,11 @@
+(typeattribute  test_attrib_1)
+
+(type test_a_t)
+(type test_b_t)
+(type test_c_t)
+(type test_d_t)
+
+(typeattributeset test_attrib_1 (test_a_t test_b_t))
+
+(typetransition test_a_t self file test_b_t)
+(typetransition test_attrib_1 test_attrib_1 file test_c_t)

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te
new file mode 100644
index 0000000..2a2cd1e
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te
@@ -0,0 +1,11 @@
+policy_module(test_self_tt_bad4,1.0)
+
+attribute test_attrib_1;
+
+type test_a_t, test_attrib_1;
+type test_b_t, test_attrib_1;
+type test_c_t;
+type test_d_t;
+
+type_transition test_a_t self:file test_c_t;
+type_transition test_attrib_1 test_attrib_1:file test_d_t;

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil
new file mode 100644
index 0000000..6bd03d0
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil
@@ -0,0 +1,6 @@
+(type test_a_t)
+(type test_b_t)
+(type test_c_t)
+
+(typetransition test_a_t self file "filename" test_b_t)
+(typetransition test_a_t self file "filename" test_c_t)

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te
new file mode 100644
index 0000000..53391c7
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te
@@ -0,0 +1,8 @@
+policy_module(test_self_tt_bad1,1.0)
+
+type test_a_t;
+type test_b_t;
+type test_c_t;
+
+type_transition test_a_t self:file test_b_t "filename";
+type_transition test_a_t self:file test_c_t "filename";

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil
new file mode 100644
index 0000000..c7c9a12
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil
@@ -0,0 +1,6 @@
+(type test_a_t)
+(type test_b_t)
+(type test_c_t)
+
+(typetransition test_a_t self file "filename" test_b_t)
+(typetransition test_a_t test_a_t file "filename" test_c_t)

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te
new file mode 100644
index 0000000..e2c273d
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te
@@ -0,0 +1,8 @@
+policy_module(test_self_tt_bad6,1.0)
+
+type test_a_t;
+type test_b_t;
+type test_c_t;
+
+type_transition test_a_t self:file test_b_t "filename";
+type_transition test_a_t test_a_t:file test_c_t "filename";

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil
new file mode 100644
index 0000000..e84100f
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil
@@ -0,0 +1,11 @@
+(typeattribute  test_attrib_1)
+
+(type test_a_t)
+(type test_b_t)
+(type test_c_t)
+(type test_d_t)
+
+(typeattributeset test_attrib_1 (test_a_t test_b_t))
+
+(typetransition test_attrib_1 self file "filename" test_b_t)
+(typetransition test_a_t test_a_t file "filename" test_c_t)

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te
new file mode 100644
index 0000000..7b2f74e
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te
@@ -0,0 +1,11 @@
+policy_module(test_self_tt_bad7,1.0)
+
+attribute test_attrib_1;
+
+type test_a_t, test_attrib_1;
+type test_b_t, test_attrib_1;
+type test_c_t;
+type test_d_t;
+
+type_transition test_attrib_1 self:file test_c_t "filename";
+type_transition test_a_t test_a_t:file test_d_t "filename";

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil
new file mode 100644
index 0000000..b90d5a3
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil
@@ -0,0 +1,11 @@
+(typeattribute  test_attrib_1)
+
+(type test_a_t)
+(type test_b_t)
+(type test_c_t)
+(type test_d_t)
+
+(typeattributeset test_attrib_1 (test_a_t test_b_t))
+
+(typetransition test_a_t self file "filename" test_b_t)
+(typetransition test_attrib_1 test_attrib_1 file "filename" test_c_t)

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te
new file mode 100644
index 0000000..c649ec1
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te
@@ -0,0 +1,11 @@
+policy_module(test_self_tt_bad8,1.0)
+
+attribute test_attrib_1;
+
+type test_a_t, test_attrib_1;
+type test_b_t, test_attrib_1;
+type test_c_t;
+type test_d_t;
+
+type_transition test_a_t self:file test_c_t "filename";
+type_transition test_attrib_1 test_attrib_1:file test_d_t "filename";

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil
new file mode 100644
index 0000000..48dc17c
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil
@@ -0,0 +1,56 @@
+(typeattribute  test_attrib_1)
+
+(type test_a_t)
+(type test_b_t)
+(type test_c_t)
+(type test_d_t)
+(type test_e_t)
+(type test_f_t)
+(type test_g_t)
+(type test_h_t)
+
+(typeattributeset test_attrib_1 (test_a_t test_b_t test_c_t))
+
+(classmap file_dir (set_1))
+(classmapping file_dir set_1 (file (all)))
+(classmapping file_dir set_1 (dir (all)))
+
+(typetransition test_d_t self file_dir test_e_t)
+(typetransition test_d_t self file_dir "filename1" test_f_t)
+(typetransition test_d_t self file_dir "filename2" test_g_t)
+
+; duplicate equivalent rules should be allowed
+(typetransition test_d_t test_d_t file_dir test_e_t)
+(typetransition test_d_t test_d_t file_dir "filename1" test_f_t)
+(typetransition test_d_t test_d_t file_dir "filename2" test_g_t)
+
+(typetransition test_attrib_1 self file_dir test_e_t)
+(typetransition test_attrib_1 self file_dir "filename1" test_f_t)
+(typetransition test_attrib_1 self file_dir "filename2" test_g_t)
+
+; CIL doesn't support inline type sets, so just add these rules
+; to match the TE version
+(typetransition test_h_t test_d_t file_dir test_e_t)
+(typetransition test_h_t test_attrib_1 file_dir test_e_t)
+(typetransition test_h_t self file_dir test_e_t)
+(typetransition test_h_t test_d_t file_dir "filename1" test_f_t)
+(typetransition test_h_t test_attrib_1 file_dir "filename1" test_f_t)
+(typetransition test_h_t self file_dir "filename1" test_f_t)
+(typetransition test_h_t test_d_t file_dir "filename2" test_g_t)
+(typetransition test_h_t test_attrib_1 file_dir "filename2" test_g_t)
+(typetransition test_h_t self file_dir "filename2" test_g_t)
+
+; test typechange and typemember as well
+(typechange test_d_t self file_dir test_e_t)
+(typechange test_d_t test_d_t file_dir test_e_t)
+(typechange test_attrib_1 self file_dir test_e_t)
+(typechange test_h_t test_d_t file_dir test_e_t)
+(typechange test_h_t test_attrib_1 file_dir test_e_t)
+(typechange test_h_t self file_dir test_e_t)
+
+(typemember test_d_t self file_dir test_e_t)
+(typemember test_d_t test_d_t file_dir test_e_t)
+(typemember test_attrib_1 self file_dir test_e_t)
+(typemember test_h_t test_d_t file_dir test_e_t)
+(typemember test_h_t test_attrib_1 file_dir test_e_t)
+(typemember test_h_t self file_dir test_e_t)

diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_good.te b/libsepol/self-keyword-in-type-rules/test_self_tt_good.te
new file mode 100644
index 0000000..4028741
--- /dev/null
+++ b/libsepol/self-keyword-in-type-rules/test_self_tt_good.te
@@ -0,0 +1,42 @@
+policy_module(test_self_tt_good,1.0)
+
+attribute test_attrib_1;
+
+type test_a_t, test_attrib_1;
+type test_b_t, test_attrib_1;
+type test_c_t, test_attrib_1;
+type test_d_t;
+type test_e_t;
+type test_f_t;
+type test_g_t;
+type test_h_t;
+
+type_transition test_d_t self:{ file dir } test_e_t;
+type_transition test_d_t self:{ file dir } test_f_t "filename1";
+type_transition test_d_t self:{ file dir } test_g_t "filename2";
+
+# duplicate equivalent rules should be allowed
+type_transition test_d_t test_d_t:{ file dir } test_e_t;
+# ...but not for _filename_ transitions ¯\_(ツ)_/¯
+#type_transition test_d_t test_d_t:{ file dir } test_f_t "filename1";
+#type_transition test_d_t test_d_t:{ file dir } test_g_t "filename2";
+
+type_transition test_attrib_1 self:{ file dir } test_e_t;
+type_transition test_attrib_1 self:{ file dir } test_f_t "filename1";
+type_transition test_attrib_1 self:{ file dir } test_g_t "filename2";
+
+# check this fancy syntax as well
+type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t;
+type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_f_t "filename1";
+type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_g_t "filename2";
+
+# test type_change and type_member as well
+type_change test_d_t self:{ file dir } test_e_t;
+type_change test_d_t test_d_t:{ file dir } test_e_t;
+type_change test_attrib_1 self:{ file dir } test_e_t;
+type_change test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t;
+
+type_member test_d_t self:{ file dir } test_e_t;
+type_member test_d_t test_d_t:{ file dir } test_e_t;
+type_member test_attrib_1 self:{ file dir } test_e_t;
+type_member test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t;