[tests/selinux] pr775-checkpolicy-revdeps: policycoreutils/semodule-rebuild-...: add coverage for dontaudit

[tests/selinux] pr775-checkpolicy-revdeps: policycoreutils/semodule-rebuild-...: add coverage for dontaudit

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 93eca7b0a958b64e2801a18a7c0bc1450834396f
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2023-03-21T15:15:30+00:00
            Stats  : +26/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/93eca7b0a958b64e2801a18a7c0bc1450834396f?branch=pr775-checkpolicy-revdeps

            Log:
            policycoreutils/semodule-rebuild-...: add coverage for dontaudit

Test that semodule --refresh works correctly with the disable_dontaudit
flag.

This currently requires the following patch to pass:
https://lore.kernel.org/selinux/20230309143741.346749-1-omosnace@redhat.com/

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf
index 1a8db10..a3191eb 100644
--- a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf
+++ b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf
@@ -26,3 +26,4 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049189
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049191
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049193
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173959

diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
index 16e3ccf..d3c8f63 100755
--- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
+++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
@@ -12,6 +12,7 @@ STORE_TYPE=targeted
 MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules"
 STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern"
 STORE_BOOLS="$STORE_ROOT/$STORE_TYPE/active/booleans.local"
+STORE_DISABLE_DONTAUDIT="$STORE_ROOT/$STORE_TYPE/active/disable_dontaudit"
 TEST_MODULE_DIR="$MODULES_ROOT/400/test_module"
 TEST_BOOLEAN="xguest_exec_content"
 TEST_BOOLEAN_VALUE="0"
@@ -29,6 +30,7 @@ rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm "libsemanage"
         rlAssertRpm "policycoreutils"
+        rlAssertRpm "selinux-policy"
 
         policyvers="$(checkpolicy -V | cut -f 1 -d ' ')"
         policyvers_kernel="$(cat /sys/fs/selinux/policyvers)"
@@ -114,6 +116,29 @@ rlJournalStart
                 rlRun "semodule -N -B" 0 \
                     "Force a rebuild to clean things up"
             rlPhaseEnd
+
+            if  { rlIsRHEL 9 && rlIsRHEL '<9.3'; } || \
+                { rlIsRHEL 8 && rlIsRHEL '<8.9'; }
+            then
+                rlPhaseStartTest "Disable dontaudit injected"
+                    rlLog "Inject disable_dontaudit flag into the store"
+                    rlRun "touch '$STORE_DISABLE_DONTAUDIT'"
+                    rlRun "semodule -N $refresh_opt" 0 \
+                        "Do a conditional rebuild"
+                    rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -eq 0" 0 \
+                        "Verify that the flag has been picked up"
+
+                    rlLog "Now remove the flag"
+                    rlRun "rm -f '$STORE_DISABLE_DONTAUDIT'"
+                    rlRun "semodule -N $refresh_opt"
+                    rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -gt 0" 0 \
+                        "Verify that the dontaudit rules are back"
+
+                    # Make sure policy is restored regardless of any previous failures
+                    rlRun "semodule -N -B" 0 \
+                        "Force a rebuild to clean things up"
+                rlPhaseEnd
+            fi
         fi
     else
         rlPhaseStartTest "Test skipped"