[tests/selinux] pr775-checkpolicy-revdeps: fix the type differences: stas_t vs. nvme_stas_t

[tests/selinux] pr775-checkpolicy-revdeps: fix the type differences: stas_t vs. nvme_stas_t

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 8698c26ae9aaa8661d7403974139f2a18a61d6ad
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-09-25T07:16:37+00:00
            Stats  : +23/-23 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/8698c26ae9aaa8661d7403974139f2a18a61d6ad?branch=pr775-checkpolicy-revdeps

            Log:
            fix the type differences: stas_t vs. nvme_stas_t

Even though the new policy for nvme-stas component was tested
multiple times (as can be seen in BZ#2111414 and RHEL-1557),
a SELinux type naming problem was introduced by various selinux-policy
builds. For example:
 * stas_t vs. nvme_stas_t
 * stas_exec_t vs. nvme_stas_exec_t
 * stas_var_run_t vs. nvme_stas_var_run_t
 * stas_cache_t vs. nvme_stas_cache_t

In order to make the automated test correct and reliable, the SELinux
policy checks executed by the test will use the nvme_* prefixed types,
because they are present in the latest selinux-policy builds.

---
diff --git a/selinux-policy/nvme-stas-and-similar/Makefile b/selinux-policy/nvme-stas-and-similar/Makefile
index b2e07cb..fadaa75 100644
--- a/selinux-policy/nvme-stas-and-similar/Makefile
+++ b/selinux-policy/nvme-stas-and-similar/Makefile
@@ -1,7 +1,7 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
 #   Makefile of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar
-#   Description: SELinux interferes with NVME sta* services
+#   Description: SELinux interferes with stacd and stafd services
 #   Author: Milos Malik <mmalik@redhat.com>
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -50,7 +50,7 @@ $(METADATA): Makefile
 	@echo "Name:            $(TEST)" >> $(METADATA)
 	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
 	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     SELinux interferes with NVME sta* services" >> $(METADATA)
+	@echo "Description:     SELinux interferes with stacd and stafd services" >> $(METADATA)
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          nvme-stas" >> $(METADATA)

diff --git a/selinux-policy/nvme-stas-and-similar/PURPOSE b/selinux-policy/nvme-stas-and-similar/PURPOSE
index a0cc42a..0f6ef81 100644
--- a/selinux-policy/nvme-stas-and-similar/PURPOSE
+++ b/selinux-policy/nvme-stas-and-similar/PURPOSE
@@ -1,6 +1,6 @@
 PURPOSE of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar
 Author: Milos Malik <mmalik@redhat.com>
 
-SELinux interferes with stacd, stafd services.
+SELinux interferes with stacd and stafd services.
 SELinux also affects the stacctl and stafctl programs.
 

diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf
index 76b2ef4..decc044 100644
--- a/selinux-policy/nvme-stas-and-similar/main.fmf
+++ b/selinux-policy/nvme-stas-and-similar/main.fmf
@@ -1,6 +1,6 @@
-summary: SELinux interferes with NVME sta* services
+summary: SELinux interferes with stacd and stafd services
 description: |+
-    SELinux interferes with NVME sta* services
+    SELinux interferes with stacd and stafd services
 
 contact: Milos Malik <mmalik@redhat.com>
 component:

diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh
index 725e2e9..ac5dd29 100755
--- a/selinux-policy/nvme-stas-and-similar/runtest.sh
+++ b/selinux-policy/nvme-stas-and-similar/runtest.sh
@@ -3,7 +3,7 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
 #   runtest.sh of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar
-#   Description: SELinux interferes with NVME sta* services
+#   Description: SELinux interferes with stacd and stafd services
 #   Author: Milos Malik <mmalik@redhat.com>
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -30,9 +30,9 @@
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 PACKAGE="selinux-policy"
-FILE_CONTEXT="stas_exec_t"
+FILE_CONTEXT="nvme_stas_exec_t"
 SERVICE_PACKAGE="nvme-stas"
-PROCESS_CONTEXT="stas_t"
+PROCESS_CONTEXT="nvme_stas_t"
 
 rlJournalStart
     rlPhaseStartSetup
@@ -59,29 +59,29 @@ rlJournalStart
         rlSEMatchPathCon "/usr/sbin/stafd" "${FILE_CONTEXT}"
         rlSEMatchPathCon "/dev/nvme-fabrics" "fixed_disk_device_t"
         rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t"
-        rlSEMatchPathCon "/run/stacd" "stas_var_run_t"
-        rlSEMatchPathCon "/run/stacd/last-known-config.pickle" "stas_var_run_t"
-        rlSEMatchPathCon "/run/stafd" "stas_var_run_t"
-        rlSEMatchPathCon "/run/stafd/last-known-config.pickle" "stas_var_run_t"
+        rlSEMatchPathCon "/run/stacd" "nvme_stas_var_run_t"
+        rlSEMatchPathCon "/run/stacd/last-known-config.pickle" "nvme_stas_var_run_t"
+        rlSEMatchPathCon "/run/stafd" "nvme_stas_var_run_t"
+        rlSEMatchPathCon "/run/stafd/last-known-config.pickle" "nvme_stas_var_run_t"
         rlSEMatchPathCon "/run/udev/" "udev_var_run_t"
         rlSEMatchPathCon "/run/udev/rules.d/" "udev_var_run_t"
         rlSEMatchPathCon "/run/udev/rules.d/70-nvmf-autoconnect.rules" "udev_var_run_t"
-        rlSEMatchPathCon "/var/cache/stacd" "stas_cache_t"
-        rlSEMatchPathCon "/var/cache/stafd" "stas_cache_t"
+        rlSEMatchPathCon "/var/cache/stacd" "nvme_stas_cache_t"
+        rlSEMatchPathCon "/var/cache/stafd" "nvme_stas_cache_t"
         SOURCE_TYPE="init_t" # systemd runs the process
         rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS"
         rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS"
         rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS"
         rlRun "semodule -lfull | grep stas"
-        rlSESearchRule "allow avahi_t stas_t : dbus { send_msg } [ ]"
-        rlSESearchRule "allow stas_t avahi_t : dbus { send_msg } [ ]"
-        rlSESearchRule "allow stas_t fixed_disk_device_t : chr_file { getattr } [ ]"
-        rlSESearchRule "allow stas_t stas_t : dbus { send_msg } [ ]"
-        rlSESearchRule "allow stas_t syslogd_var_run_t : sock_file { write } [ ]"
-        rlSESearchRule "allow stas_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]"
-        rlSESearchRule "allow stas_t udev_var_run_t : dir { add_name remove_name write } [ ]"
-        rlSESearchRule "allow stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]"
-        rlSESearchRule "allow stas_t stas_var_run_t : file { getattr ioctl open read write } [ ]"
+        rlSESearchRule "allow avahi_t nvme_stas_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow nvme_stas_t avahi_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow nvme_stas_t fixed_disk_device_t : chr_file { getattr } [ ]"
+        rlSESearchRule "allow nvme_stas_t nvme_stas_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow nvme_stas_t syslogd_var_run_t : sock_file { write } [ ]"
+        rlSESearchRule "allow nvme_stas_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]"
+        rlSESearchRule "allow nvme_stas_t udev_var_run_t : dir { add_name remove_name write } [ ]"
+        rlSESearchRule "allow nvme_stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]"
+        rlSESearchRule "allow nvme_stas_t nvme_stas_var_run_t : file { getattr ioctl open read write } [ ]"
         rlSESearchRule "allow unconfined_t nvme_stas_t : dbus { send_msg } [ ]"
         rlSESearchRule "allow nvme_stas_t unconfined_t : dbus { send_msg } [ ]"
     rlPhaseEnd