[tests/selinux] pr775-checkpolicy-revdeps: add the icecast test into upstream repo

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b719355a36eeebb74547bc7770d06974eca11392
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-01-23T12:33:11+00:00
            Stats  : +234/-0 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b719355a36eeebb74547bc7770d06974eca11392?branch=pr775-checkpolicy-revdeps

            Log:
            add the icecast test into upstream repo

The existing icecast test is being moved from the downstream repository
to the upstream repository.
There are few changes in the test, for example: required packages,
relevant architectures, supported distros.

---
diff --git a/selinux-policy/icecast-and-similar/Makefile b/selinux-policy/icecast-and-similar/Makefile
new file mode 100644
index 0000000..0f6b02f
--- /dev/null
+++ b/selinux-policy/icecast-and-similar/Makefile
@@ -0,0 +1,69 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/selinux-policy/Regression/icecast-and-similar
+#   Description: SELinux interferes with icecast and related programs
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/icecast-and-similar
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+	chcon -t bin_t runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     SELinux interferes with icecast and related programs" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          selinux-policy" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service icecast" >> $(METADATA) # EPEL
+	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL8 -RHEL9" >> $(METADATA)
+	@echo "Architectures:   aarch64 ppc64le s390x x86_64" >> $(METADATA)
+	@echo "Bug:             894387" >> $(METADATA) # RHEL-6
+
+	rhts-lint $(METADATA)
+

diff --git a/selinux-policy/icecast-and-similar/PURPOSE b/selinux-policy/icecast-and-similar/PURPOSE
new file mode 100644
index 0000000..7a60dce
--- /dev/null
+++ b/selinux-policy/icecast-and-similar/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/icecast-and-similar
+Author: Milos Malik <mmalik@redhat.com>
+
+SELinux interferes with icecast and related programs.
+

diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf
new file mode 100644
index 0000000..10ba3e8
--- /dev/null
+++ b/selinux-policy/icecast-and-similar/main.fmf
@@ -0,0 +1,44 @@
+summary: SELinux interferes with icecast and related programs
+description: |+
+    SELinux interferes with icecast and related programs.
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+  - selinux-policy
+test: ./runtest.sh
+framework: beakerlib
+require:
+  - library(selinux-policy/common)
+recommend:
+  - audit
+  - libselinux
+  - libselinux-utils
+  - policycoreutils
+  - selinux-policy
+  - selinux-policy-targeted
+  - setools-console
+  - /usr/sbin/service
+  - icecast
+environment:
+    AVC_ERROR: +no_avc_check
+duration: 10m
+enabled: true
+tag:
+  - NoRHEL4
+  - TIPpass_Security
+  - TierCandidatesPASS
+  - f31friendly
+  - f32friendly
+  - targeted
+link:
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=894387
+adjust:
+  - enabled: false
+    when: arch == i386, ppc, ppc64, s390
+    continue: false
+  - enabled: false
+    when: distro == rhel-4, rhel-8, rhel-9
+    continue: false
+extra-nitrate: TC#0388472
+extra-summary: /CoreOS/selinux-policy/Regression/icecast-and-similar
+extra-task: /CoreOS/selinux-policy/Regression/icecast-and-similar

diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh
new file mode 100755
index 0000000..9d1e93e
--- /dev/null
+++ b/selinux-policy/icecast-and-similar/runtest.sh
@@ -0,0 +1,116 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/selinux-policy/Regression/icecast-and-similar
+#   Description: SELinux interferes with icecast and related programs
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+ROOT_PASSWORD="redhat"
+FILE_PATH="/usr/bin/icecast"
+FILE_CONTEXT="icecast_exec_t"
+SERVICE_PACKAGE="icecast"
+SERVICE_NAME="icecast"
+PROCESS_NAME="icecast"
+PROCESS_CONTEXT="icecast_t"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'"
+        rlSESatisfyRequires
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-targeted
+        rlAssertRpm ${SERVICE_PACKAGE}
+
+        rlServiceStop ${SERVICE_NAME}
+        rlFileBackup /etc/icecast.xml
+
+        rlRun "setenforce 1"
+        rlSEStatus
+        rlSESetTimestamp
+        sleep 2
+    rlPhaseEnd
+
+    if ! rlIsRHEL 5 ; then
+    rlPhaseStartTest "SELinux contexts and rules"
+        rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}"
+        if rlIsRHEL 5 ; then
+            SOURCE_TYPE="initrc_t"
+            BOOLEANS="[ ]"
+        elif rlIsRHEL 6 ; then
+            SOURCE_TYPE="initrc_t"
+        else # RHEL-7 etc.
+            SOURCE_TYPE="init_t" # systemd runs the process
+        fi
+        rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS"
+        rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS"
+        rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#894387"
+        rlSEMatchPathCon "/usr/bin/icecast" "icecast_exec_t"
+        rlSEMatchPortCon tcp 8080 http_cache_port_t
+        rlSESearchRule "allow icecast_t http_cache_port_t : tcp_socket { name_bind } [ icecast_use_any_tcp_ports ]"
+        if rlIsRHEL 6 ; then
+            rlSESearchRule "dontaudit icecast_t tmp_t : dir { read }"
+        fi
+    rlPhaseEnd
+    fi
+
+    rlPhaseStartTest "real scenario -- bz#894387"
+        if rlIsRHEL 5 6 ; then
+            rlRun "setsebool icecast_connect_any on"
+        else
+            rlRun "setsebool icecast_use_any_tcp_ports on"
+        fi
+        rlRun "sed -i \"s|8000|8080|\" /etc/icecast.xml"
+        rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
+        if ! rlSEDefined ${PROCESS_CONTEXT} ; then
+            if rlIsRHEL 5 6 ; then
+                PROCESS_CONTEXT="initrc_t"
+            else
+                PROCESS_CONTEXT="unconfined_service_t"
+            fi
+        fi
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1
+        if rlIsRHEL 5 6 ; then
+            rlRun "setsebool icecast_connect_any off"
+        else
+            rlRun "setsebool icecast_use_any_tcp_ports off"
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        sleep 2
+        rlSECheckAVC
+
+        rlFileRestore
+        rlServiceRestore ${SERVICE_NAME}
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+