[tests/selinux] pr775-checkpolicy-revdeps: semodule-rebuild-if-modules-changed: test changing booleans

[tests/selinux] pr775-checkpolicy-revdeps: semodule-rebuild-if-modules-changed: test changing booleans

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : c3dd00f4bcf4355897a4e726ca12740b88ea5b17
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2022-08-02T15:03:48+02:00
            Stats  : +58/-16 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/c3dd00f4bcf4355897a4e726ca12740b88ea5b17?branch=pr775-checkpolicy-revdeps

            Log:
            semodule-rebuild-if-modules-changed: test changing booleans

Extend the test to verify correct behavior when a boolean setting
override is injected. Also add auto-detection of the --refresh /
--rebuild-if-modules-changed command-line option support, which
indicates the expected level of functionality. (And we also need to
ensure that --refresh is used when supported because the other option
may be removed in the future.)

Additionally, we need to work around the fact that the exact binary
policy content can now be different depending on if the optimized code
path has been taken. Do this by toggling a boolean before introducing
injected customizations, thus obtaining the expected policy content for
the case after `semodule --refresh`.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
index 98e84d6..16e3ccf 100755
--- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
+++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
@@ -11,7 +11,11 @@ STORE_ROOT=/var/lib/selinux
 STORE_TYPE=targeted
 MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules"
 STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern"
+STORE_BOOLS="$STORE_ROOT/$STORE_TYPE/active/booleans.local"
 TEST_MODULE_DIR="$MODULES_ROOT/400/test_module"
+TEST_BOOLEAN="xguest_exec_content"
+TEST_BOOLEAN_VALUE="0"
+TEST_BOOLEAN_VALUE_TEXT="false"
 
 CHECKSUM_CMD=sha256sum
 
@@ -31,27 +35,46 @@ rlJournalStart
         if [ "$policyvers" -lt "$policyvers_kernel" ]; then
             policyvers="$policyvers_kernel"
         fi
+
+        rlRun "semodule -N -B" 0 \
+            "Make sure policy store is in a consistent state initially"
+
+        refresh_opt=""
+        for opt in --refresh --rebuild-if-modules-changed; do
+            if semodule --help | grep -q -- "$opt"; then
+                refresh_opt="$opt"
+                rlLog "$opt command-line option detected for semodule"
+                break
+            fi
+        done
     rlPhaseEnd
 
-    rlPhaseStartTest
-        if semodule --help | grep -q -- --rebuild-if-modules-changed; then
-            rlRun "semodule -N -B" 0 \
-                "Make sure policy store is in a consistent state initially"
+    if [ -n "$refresh_opt" ]; then
+        rlPhaseStartTest "No change behavior"
+            # The resulting binary policy will be different (albeit
+            # equivalent) after a full rebuild vs. when only local
+            # changes are applied to existing policy.linked file, so
+            # toggle a boolean twice to get the expected binary form.
+            rlRun "setsebool -P xguest_exec_content $TEST_BOOLEAN_VALUE"
+            rlRun "setsebool -P xguest_exec_content $(( ! $TEST_BOOLEAN_VALUE ))"
 
             checksum_before="$(policy_checksum "$policyvers")"
-            rlRun "semodule -N --rebuild-if-modules-changed"
+            rlRun "semodule -N $refresh_opt"
             checksum_after="$(policy_checksum "$policyvers")"
             rlAssertEquals "Binary policy must not change after rebuild" \
                 "$checksum_before" "$checksum_after"
 
+            # Make sure policy is restored regardless of any previous failures
             rlRun "semodule -N -B" 0 \
-                "Make sure policy store is in a consistent state initially"
+                "Force a rebuild to clean things up"
+        rlPhaseEnd
 
+        rlPhaseStartTest "Module injected"
             rlLog "Inject a new module into the store"
             rlRun "mkdir -p '$TEST_MODULE_DIR'"
             rlRun "echo -n cil >'$TEST_MODULE_DIR/lang_ext'"
             rlRun "echo '(type test_module_type_t)' >'$TEST_MODULE_DIR/cil'"
-            rlRun "semodule -N --rebuild-if-modules-changed" 0 \
+            rlRun "semodule -N $refresh_opt" 0 \
                 "Do a conditional rebuild"
             rlRun "semodule -l | grep test_module" 0 \
                 "Verify that the module has been picked up"
@@ -60,7 +83,7 @@ rlJournalStart
 
             rlLog "Now remove the module"
             rlRun "rm -rf '$TEST_MODULE_DIR'"
-            rlRun "semodule -N --rebuild-if-modules-changed"
+            rlRun "semodule -N $refresh_opt"
             rlRun "semodule -l | grep test_module" 1 \
                 "Verify that the module has been removed"
             rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 1 \
@@ -69,14 +92,33 @@ rlJournalStart
             # Make sure policy is restored regardless of any previous failures
             rlRun "semodule -N -B" 0 \
                 "Force a rebuild to clean things up"
-            #rlRun "setsebool -NP daemons_use_tty=on"
-            # TODO test changing booleans (persistently)
-        else
-            rlLog "--rebuild-if-modules-changed command-line option not supported; skipping tests..."
-        fi
-    rlPhaseEnd
+        rlPhaseEnd
 
-    rlPhaseStartCleanup
-    rlPhaseEnd
+        # --refresh option implies fixed boolean/etc. behavior
+        if [ "$refresh_opt" = "--refresh" ]; then
+            rlPhaseStartTest "Boolean setting injected"
+                rlLog "Inject a boolean setting into the store"
+                rlRun "echo '$TEST_BOOLEAN=$TEST_BOOLEAN_VALUE' >'$STORE_BOOLS'"
+                rlRun "semodule -N $refresh_opt" 0 \
+                    "Do a conditional rebuild"
+                rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 0 \
+                    "Verify that the boolean setting has been picked up"
+
+                rlLog "Now remove the setting"
+                rlRun "rm -f '$STORE_BOOLS'"
+                rlRun "semodule -N $refresh_opt"
+                rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 1 \
+                    "Verify that the boolean setting has been reset back"
+
+                # Make sure policy is restored regardless of any previous failures
+                rlRun "semodule -N -B" 0 \
+                    "Force a rebuild to clean things up"
+            rlPhaseEnd
+        fi
+    else
+        rlPhaseStartTest "Test skipped"
+            rlLog "--rebuild-if-modules-changed/--refresh command-line option not supported; skipping tests..."
+        rlPhaseEnd
+    fi
 rlJournalPrintText
 rlJournalEnd