[tests/selinux] pr775-checkpolicy-revdeps: test if ladvd produces any SELinux denials

[tests/selinux] pr775-checkpolicy-revdeps: test if ladvd produces any SELinux denials

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : a7d24f429256dc3b7385c2438988af26fd49110d
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-11-28T15:50:21+01:00
            Stats  : +7/-2 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/a7d24f429256dc3b7385c2438988af26fd49110d?branch=pr775-checkpolicy-revdeps

            Log:
            test if ladvd produces any SELinux denials

The test should look for any SELinux denials that appear during
its run. No matter which process triggered them.

---
diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh
index ad3d458..7c057b7 100755
--- a/selinux-policy/ladvd/runtest.sh
+++ b/selinux-policy/ladvd/runtest.sh
@@ -44,6 +44,9 @@ rlJournalStart
         rlAssertRpm ${PACKAGE}-targeted
         rlAssertRpm ladvd
         rlAssertRpm ladvd-selinux
+
+        rlSESetTimestamp
+        rlRun "setsebool domain_kernel_load_modules on"
         rlServiceStop ladvd
         rlSESetEnforce
         rlSEStatus
@@ -52,7 +55,7 @@ rlJournalStart
     rlPhaseStartTest "ladvd service selinux denials, bz#1834325"
         rlServiceStart ladvd
         sleep 2
-        rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 1
+        rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 0,1
         if grep "tclass=process2" /tmp/avcfile; then
             grep "tclass=process2" /tmp/avcfile > /tmp/avc_class_file
             rlAssertNotGrep "denied  { nnp_transition }" /tmp/avc_class_file
@@ -74,7 +77,7 @@ rlJournalStart
     rlPhaseStartTest "ladvd selinux denials due to libpcap, bz#1855163"
         rlServiceStart ladvd
         sleep 2
-        rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 1
+        rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 0,1
         if grep "tclass=netlink_rdma_socket" /tmp/avcfile; then
             grep "tclass=netlink_rdma_socket" /tmp/avcfile > /tmp/avc_class_file
             rlAssertNotGrep "denied  { create }" /tmp/avc_class_file
@@ -88,6 +91,8 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartCleanup
+        rlSECheckAVC
+        rlRun "setsebool domain_kernel_load_modules off"
         rlServiceRestore ladvd
         rlRun "rm -f /tmp/avcfile"
         rlRun "rm -f /tmp/avc_class_file"