[tests/selinux] pr775-checkpolicy-revdeps: test if rpmdb-migrate service works successfully

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 3e70b4f33b2ca0d7975d143910a2feb16fc59226
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-02-02T15:13:03+00:00
            Stats  : +25/-5 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/3e70b4f33b2ca0d7975d143910a2feb16fc59226?branch=pr775-checkpolicy-revdeps

            Log:
            test if rpmdb-migrate service works successfully

The upgrade procedure from Fedora 36 to Fedora 37 revealed that
SELinux prevents the rpmdb-migrate service from executing the
bash, rpm and rm programs. The TC reproduces the situation
without performing the upgrade.

In order to support the functionality of the rpmdb-migrate service,
I believe that SELinux policy should allow these actions. The TC
looks for appropriate policy rules and file context patterns.

The TC covers BZ#2164752.

---
diff --git a/selinux-policy/rpmdb-and-similar/Makefile b/selinux-policy/rpmdb-and-similar/Makefile
index e26c29e..89d9191 100644
--- a/selinux-policy/rpmdb-and-similar/Makefile
+++ b/selinux-policy/rpmdb-and-similar/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts sssd" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service sssd" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -65,6 +65,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1461313" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1899548" >> $(METADATA) # Fedora 33
 	@echo "Bug:             2023163" >> $(METADATA) # Fedora 35
+	@echo "Bug:             2164752" >> $(METADATA) # Fedora 37
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf
index 1adc4e3..713ea2d 100644
--- a/selinux-policy/rpmdb-and-similar/main.fmf
+++ b/selinux-policy/rpmdb-and-similar/main.fmf
@@ -16,7 +16,7 @@ recommend:
   - selinux-policy
   - selinux-policy-targeted
   - setools-console
-  - initscripts
+  - /usr/sbin/service
   - sssd
 environment:
     AVC_ERROR: +no_avc_check
@@ -32,6 +32,7 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1461313
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899548
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2023163
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2164752
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh
index 18919be..b026c92 100755
--- a/selinux-policy/rpmdb-and-similar/runtest.sh
+++ b/selinux-policy/rpmdb-and-similar/runtest.sh
@@ -30,7 +30,6 @@
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 PACKAGE="selinux-policy"
-ROOT_PASSWORD="redhat"
 SERVICE_PACKAGE="rpm"
 SERVICE_NAME="rpmdb-rebuild"
 PROCESS_NAME="rpmdb"
@@ -69,10 +68,10 @@ rlJournalStart
 
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "touch /var/lib/rpm/.rebuilddb"
-        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
+        rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
         rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlRun "touch /var/lib/rpm/.rebuilddb"
-        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1
+        rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 
     rlPhaseStartTest "rpmdb executed by root/unconfined_t"
@@ -90,6 +89,25 @@ rlJournalStart
         rm -f ${OUTPUT_FILE}
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2164752"
+        rlSEMatchPathCon "/usr/bin/rpm" "rpm_exec_t"
+        rlSEMatchPathCon "/usr/lib/rpm/rpmdb_migrate" "rpmdb_exec_t"
+        rlSEMatchPathCon "/var/lib/rpm" "rpm_var_lib_t"
+        rlSEMatchPathCon "/var/lib/rpm/.migratedb" "rpm_var_lib_t"
+        rlSESearchRule "allow rpmdb_t shell_exec_t : file { map execute } [ ]"
+        rlSESearchRule "allow rpmdb_t rpm_exec_t : file { getattr open read map execute } [ ]"
+        rlSESearchRule "allow rpmdb_t bin_t : file { getattr open read execute execute_no_trans } [ ]"
+        rlSESearchRule "allow rpmdb_t rpm_var_lib_t : lnk_file { getattr read } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "real scenario -- rpmdb-migrate service"
+        rlRun "touch /var/lib/rpm/.migratedb"
+        rlSEService - rpmdb-migrate - rpmdb_t "start status" 1
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlRun "touch /var/lib/rpm/.migratedb"
+        rlSEService - rpmdb-migrate - rpmdb_t "restart status stop status" 1
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC