[tests/selinux] pr775-checkpolicy-revdeps: test if icecast can rotate its log files

[tests/selinux] pr775-checkpolicy-revdeps: test if icecast can rotate its log files

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 1bf5991b55797dcc6abc9097b5aa125a2c9b1343
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-01-23T12:33:11+00:00
            Stats  : +16/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/1bf5991b55797dcc6abc9097b5aa125a2c9b1343?branch=pr775-checkpolicy-revdeps

            Log:
            test if icecast can rotate its log files

When the icecast service is running for a long time, its log files
become large enough so that they will be rotated. Unfortunately,
SELinux prevents the rename of old log files. The TC reproduces
the situation.

In order to support the functionality of `logsize` and `logarchive`
options, I believe that SELinux policy should allow the actions.
The TC looks for appropriate policy rules and file context patterns.

The TC covers BZ#2156763.

---
diff --git a/selinux-policy/icecast-and-similar/Makefile b/selinux-policy/icecast-and-similar/Makefile
index 0f6b02f..51ccee4 100644
--- a/selinux-policy/icecast-and-similar/Makefile
+++ b/selinux-policy/icecast-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL8 -RHEL9" >> $(METADATA)
 	@echo "Architectures:   aarch64 ppc64le s390x x86_64" >> $(METADATA)
 	@echo "Bug:             894387" >> $(METADATA) # RHEL-6
+	@echo "Bug:             2156763" >> $(METADATA) # Fedora 36
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf
index 10ba3e8..497bea9 100644
--- a/selinux-policy/icecast-and-similar/main.fmf
+++ b/selinux-policy/icecast-and-similar/main.fmf
@@ -32,6 +32,7 @@ tag:
   - targeted
 link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=894387
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2156763
 adjust:
   - enabled: false
     when: arch == i386, ppc, ppc64, s390

diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh
index 9d1e93e..62f7de7 100755
--- a/selinux-policy/icecast-and-similar/runtest.sh
+++ b/selinux-policy/icecast-and-similar/runtest.sh
@@ -79,6 +79,14 @@ rlJournalStart
             rlSESearchRule "dontaudit icecast_t tmp_t : dir { read }"
         fi
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#2156763"
+        rlSEMatchPathCon "/usr/bin/icecast" "icecast_exec_t"
+        rlSEMatchPathCon "/var/log/icecast" "icecast_log_t"
+        rlSEMatchPathCon "/var/log/icecast/error.log" "icecast_log_t"
+        rlSESearchRule "allow icecast_t icecast_log_t : dir { remove_name } [ ]"
+        rlSESearchRule "allow icecast_t icecast_log_t : file { rename } [ ]"
+    rlPhaseEnd
     fi
 
     rlPhaseStartTest "real scenario -- bz#894387"
@@ -96,7 +104,12 @@ rlJournalStart
                 PROCESS_CONTEXT="unconfined_service_t"
             fi
         fi
-        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+        rlRun "sed -i 's|^\(.*logsize>\).*\(</logsize.*\)$|\11\2|' /etc/icecast.xml"
+        rlRun "grep logsize /etc/icecast.xml"
+        rlRun "sed -i 's|^.*\(<logarchive.*logarchive>\).*$|\1|' /etc/icecast.xml"
+        rlRun "grep logarchive /etc/icecast.xml"
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
         if rlIsRHEL 5 6 ; then
             rlRun "setsebool icecast_connect_any off"
         else