[tests/selinux] pr775-checkpolicy-revdeps: avoid testing empty CIL modules

[tests/selinux] pr775-checkpolicy-revdeps: avoid testing empty CIL modules

[Zdenek Pytela]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 12dd91c7d4b723a91eebcde12f8d61c550b63e45
            Author : Zdenek Pytela <zpytela@redhat.com>
            Date   : 2022-06-07T15:43:51+00:00
            Stats  : +1/-1 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/12dd91c7d4b723a91eebcde12f8d61c550b63e45?branch=pr775-checkpolicy-revdeps

            Log:
            avoid testing empty CIL modules

SELinux user-space version 3.3 and higher does not support loading
of empty CIL modules. If such version is installed, one of the test
phases will be skipped. This commit changes existing code to using
rlTestVersion.

---
diff --git a/policycoreutils/CIL-modules-without-compilation/runtest.sh b/policycoreutils/CIL-modules-without-compilation/runtest.sh
index 8e96081..f47e67f 100755
--- a/policycoreutils/CIL-modules-without-compilation/runtest.sh
+++ b/policycoreutils/CIL-modules-without-compilation/runtest.sh
@@ -41,7 +41,7 @@ rlJournalStart
     rlPhaseEnd
 
     # version 3.3 of SELinux user-space does not accept empty CIL module
-    if echo "${PACKAGE_VERSION} < 3.3" | bc | grep -q 1 ; then
+    if rlTestVersion "${PACKAGE_VERSION}" "<" "3.3" ; then
     rlPhaseStartTest "empty CIL module"
         rlRun "semodule -lfull | grep '400.*empty.*cil'" 1
         rlRun "semodule -i empty.cil"

[tests/selinux] pr775-checkpolicy-revdeps: avoid testing empty CIL modules

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 37adc8484f605fb6ec13bd0e31e932eb86cb1202
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-10-07T14:24:29+02:00
            Stats  : +20/-2 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/37adc8484f605fb6ec13bd0e31e932eb86cb1202?branch=pr775-checkpolicy-revdeps

            Log:
            avoid testing empty CIL modules

SELinux user-space of version 3.3 and higher does not support loading
of empty CIL modules. If such version is installed, one of the test
phases will be skipped.

---
diff --git a/policycoreutils/CIL-modules-without-compilation/Makefile b/policycoreutils/CIL-modules-without-compilation/Makefile
index 2d8a660..a16e88d 100644
--- a/policycoreutils/CIL-modules-without-compilation/Makefile
+++ b/policycoreutils/CIL-modules-without-compilation/Makefile
@@ -53,7 +53,7 @@ $(METADATA): Makefile
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          policycoreutils" >> $(METADATA)
-	@echo "Requires:        policycoreutils" >> $(METADATA)
+	@echo "Requires:        /usr/sbin/semodule /usr/sbin/semanage" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

diff --git a/policycoreutils/CIL-modules-without-compilation/runtest.sh b/policycoreutils/CIL-modules-without-compilation/runtest.sh
index 451461a..a121c58 100755
--- a/policycoreutils/CIL-modules-without-compilation/runtest.sh
+++ b/policycoreutils/CIL-modules-without-compilation/runtest.sh
@@ -31,14 +31,18 @@
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 PACKAGE="policycoreutils"
+PACKAGE_VERSION=`rpm -q --queryformat '%{version}' ${PACKAGE}`
 
 rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm $PACKAGE
         rlRun "echo '()' > empty.cil"
+        rlRun "echo '( auditallow init_t security_t ( security ( setsecparam )))' > valid.cil"
         rlRun "echo '(())' > invalid.cil"
     rlPhaseEnd
 
+    # version 3.3 of SELinux user-space does not accept empty CIL module
+    if echo "${PACKAGE_VERSION} < 3.3" | bc | grep -q 1 ; then
     rlPhaseStartTest "empty CIL module"
         rlRun "semodule -lfull | grep '400.*empty.*cil'" 1
         rlRun "semodule -i empty.cil"
@@ -51,6 +55,20 @@ rlJournalStart
         rlRun "semanage module -r empty"
         rlRun "semanage module -l | grep 'empty.*400.*cil'" 1
     rlPhaseEnd
+    fi
+
+    rlPhaseStartTest "valid CIL module"
+        rlRun "semodule -lfull | grep '400.*valid.*cil'" 1
+        rlRun "semodule -i valid.cil"
+        rlRun "semodule -lfull | grep '400.*valid.*cil'"
+        rlRun "semodule -r valid"
+        rlRun "semodule -lfull | grep '400.*valid.*cil'" 1
+        rlRun "semanage module -l | grep 'valid.*400.*cil'" 1
+        rlRun "semanage module -a valid.cil"
+        rlRun "semanage module -l | grep 'valid.*400.*cil'"
+        rlRun "semanage module -r valid"
+        rlRun "semanage module -l | grep 'valid.*400.*cil'" 1
+    rlPhaseEnd
 
     rlPhaseStartTest "invalid CIL module"
         rlRun "semodule -lfull | grep '400.*invalid.*cil'" 1
@@ -66,7 +84,7 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartCleanup
-        rlRun "rm -f empty.cil invalid.cil"
+        rlRun "rm -f empty.cil valid.cil invalid.cil"
     rlPhaseEnd
 rlJournalPrintText
 rlJournalEnd