[tests/selinux] pr775-checkpolicy-revdeps: test if setfiles works correctly in chroot-ed environment

[tests/selinux] pr775-checkpolicy-revdeps: test if setfiles works correctly in chroot-ed environment

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 9cb79c94c6cee7612c83ef3d0799e3f2bba4f654
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-06-27T12:17:09+00:00
            Stats  : +152/-0 in 5 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/9cb79c94c6cee7612c83ef3d0799e3f2bba4f654?branch=pr775-checkpolicy-revdeps

            Log:
            test if setfiles works correctly in chroot-ed environment

Recent use of the setfiles program in chroot-ed environment revealed
the following error messages:

  /usr/sbin/setfiles: Could not set context for /usr/include:  No such file or directory

The problem was identified and fixed in the libselinux code. Purpose
of this TC is to test whether the fixfiles behaves correctly in such
environments.

The TC covers BZ#2094683.

---
diff --git a/libselinux/setfiles-in-chroot-env/Makefile b/libselinux/setfiles-in-chroot-env/Makefile
new file mode 100644
index 0000000..7d5c948
--- /dev/null
+++ b/libselinux/setfiles-in-chroot-env/Makefile
@@ -0,0 +1,66 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/libselinux/Regression/setfiles-in-chroot-env
+#   Description: Does setfiles work correctly in chroot environment?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2022 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/libselinux/Regression/setfiles-in-chroot-env
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE test-script.sh
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+	test -x test-script.sh || chmod a+x test-script.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Does setfiles work correctly in chroot environment?" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        15m" >> $(METADATA)
+	@echo "RunFor:          libselinux" >> $(METADATA)
+	@echo "RunFor:          policycoreutils" >> $(METADATA)
+	@echo "Requires:        libselinux policycoreutils" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2+" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+	@echo "Bug:             2094683" >> $(METADATA) # RHEL-9
+
+	rhts-lint $(METADATA)
+

diff --git a/libselinux/setfiles-in-chroot-env/PURPOSE b/libselinux/setfiles-in-chroot-env/PURPOSE
new file mode 100644
index 0000000..5402a21
--- /dev/null
+++ b/libselinux/setfiles-in-chroot-env/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/libselinux/Regression/setfiles-in-chroot-env
+Author: Milos Malik <mmalik@redhat.com>
+
+Does setfiles work correctly in chroot environment?
+

diff --git a/libselinux/setfiles-in-chroot-env/main.fmf b/libselinux/setfiles-in-chroot-env/main.fmf
new file mode 100644
index 0000000..074d84a
--- /dev/null
+++ b/libselinux/setfiles-in-chroot-env/main.fmf
@@ -0,0 +1,21 @@
+summary: Does setfiles work correctly in chroot environment?
+description: |
+    Does setfiles work correctly in chroot environment?
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+  - libselinux
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+  - libselinux
+  - policycoreutils
+duration: 15m
+enabled: true
+tag:
+  - targeted
+link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094683
+extra-summary: /CoreOS/libselinux/Regression/setfiles-in-chroot-env
+extra-task: /CoreOS/libselinux/Regression/setfiles-in-chroot-env
+

diff --git a/libselinux/setfiles-in-chroot-env/runtest.sh b/libselinux/setfiles-in-chroot-env/runtest.sh
new file mode 100755
index 0000000..d9afeb2
--- /dev/null
+++ b/libselinux/setfiles-in-chroot-env/runtest.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/libselinux/Regression/setfiles-in-chroot-env
+#   Description: Does setfiles work correctly in chroot environment?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2022 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="libselinux"
+CHROOT_DIR=`mktemp -d`
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm policycoreutils
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#2094683"
+        rlRun "yum -y install filesystem policycoreutils selinux-policy-targeted --installroot=${CHROOT_DIR} --disablerepo 'epel*'"
+        rlRun "cp ./test-script.sh ${CHROOT_DIR}/usr/bin/"
+        rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.sh"
+        rlRun "grep -i -e 'no such file or directory' -e 'not set context' $rlRun_LOG" 1
+        rm -f $rlRun_LOG
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf ${CHROOT_DIR}"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+

diff --git a/libselinux/setfiles-in-chroot-env/test-script.sh b/libselinux/setfiles-in-chroot-env/test-script.sh
new file mode 100755
index 0000000..d20ba83
--- /dev/null
+++ b/libselinux/setfiles-in-chroot-env/test-script.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+sestatus
+ls -lZ /
+/usr/sbin/setfiles -F /etc/selinux/targeted/contexts/files/file_contexts /
+ls -lZ /
+