[tests/selinux] pr775-checkpolicy-revdeps: test if deny rules are implemented/recognized

[tests/selinux] pr775-checkpolicy-revdeps: test if deny rules are implemented/recognized

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b7731c9f6387dadcb3939b7b28c6667bdb00d2cc
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-12-07T13:27:23+01:00
            Stats  : +120/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b7731c9f6387dadcb3939b7b28c6667bdb00d2cc?branch=pr775-checkpolicy-revdeps

            Log:
            test if deny rules are implemented/recognized

The version 3.6 of SELinux userspace brings a new policy feature
called deny rules. Purpose of this basic test is to find out if
the deny rules function as expected.

The automated test covers the following scenarios:
 * file read prevention
 * file execution prevention
 * file removal prevention
 * directory search prevention
 * process ptrace prevention
 * kernel module load prevention

---
diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf
new file mode 100644
index 0000000..eb66a3a
--- /dev/null
+++ b/selinux-policy/deny-rules/main.fmf
@@ -0,0 +1,30 @@
+summary: Basic functional test of the deny rules in SELinux policy
+contact: Milos Malik <mmalik@redhat.com>
+test: ./runtest.sh
+framework: beakerlib
+component:
+  - selinux-policy
+recommend:
+  - libsepol
+  - libsemanage
+  - libselinux
+  - policycoreutils
+  - selinux-policy
+  - strace
+duration: 10m
+enabled: true
+tier: 1
+tag:
+  - CI-Tier-1
+  - NoRHEL4
+  - NoRHEL5
+  - NoRHEL6
+  - NoRHEL7
+  - NoRHEL8
+  - targeted
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8
+    because: deny rules are not recognized/implemented there
+extra-nitrate: TC#0616661
+id: 3221e55d-6039-40f6-b9ff-6a02e85948e7

diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh
new file mode 100755
index 0000000..19f77e2
--- /dev/null
+++ b/selinux-policy/deny-rules/runtest.sh
@@ -0,0 +1,90 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm libsepol
+        rlAssertRpm libsemanage
+        rlAssertRpm libselinux
+        rlAssertRpm policycoreutils
+        rlAssertRpm selinux-policy
+        rlRun "setenforce 1"
+        rlRun "sestatus"
+    rlPhaseEnd
+
+    rlPhaseStartTest "prevent the reading of a file"
+        rlRun "stat /etc/shadow" 0
+        rlRun "grep ^bin /etc/shadow" 0
+        rlRun "echo -e '( deny unconfined_t shadow_t ( file ( getattr read )))' > testpolicy.cil"
+        rlRun "semodule -i testpolicy.cil"
+        rlRun "semodule -lfull | grep testpolicy"
+        rlRun "stat /etc/shadow" 1
+        rlRun "grep ^bin /etc/shadow" 2
+        rlRun "semodule -r testpolicy"
+    rlPhaseEnd
+
+    rlPhaseStartTest "prevent the execution of a file"
+        rlRun "dmesg >& /dev/null"
+        rlRun "echo -e '( deny unconfined_t dmesg_exec_t ( file ( execute execute_no_trans )))' > testpolicy.cil"
+        rlRun "semodule -i testpolicy.cil"
+        rlRun "semodule -lfull | grep testpolicy"
+        rlRun "dmesg" 126
+        rlRun "semodule -r testpolicy"
+    rlPhaseEnd
+
+    rlPhaseStartTest "prevent removal of a file"
+        if [ -f /etc/machine-id ] ; then
+            rlRun "cp -a /etc/machine-id ."
+        else
+            rlRun "cp -a /run/machine-id ."
+        fi
+        rlRun "ls -Z ./machine-id"
+        rlRun "echo -e '( deny unconfined_t machineid_t ( file ( unlink )))' > testpolicy.cil"
+        rlRun "semodule -i testpolicy.cil"
+        rlRun "semodule -lfull | grep testpolicy"
+        rlRun "rm -f ./machine-id" 1,2
+        rlRun "semodule -r testpolicy"
+        rlRun "rm -f ./machine-id"
+    rlPhaseEnd
+
+    rlPhaseStartTest "prevent the search in a directory"
+        rlRun "ls -lZR /etc/pki >& /dev/null"
+        rlRun "echo -e '( deny unconfined_t cert_t ( dir ( search )))' > testpolicy.cil"
+        rlRun "semodule -i testpolicy.cil"
+        rlRun "semodule -lfull | grep testpolicy"
+        rlRun "ls -lZR /etc/pki" 1
+        rlRun "semodule -r testpolicy"
+    rlPhaseEnd
+
+    rlPhaseStartTest "prevent ptracing of processes"
+        rlWatchdog "strace -p $$" 5
+        rlRun "echo -e '( deny unconfined_t unconfined_t ( process ( ptrace )))' > testpolicy.cil"
+        rlRun "semodule -i testpolicy.cil"
+        rlRun "semodule -lfull | grep testpolicy"
+        rlRun -s "strace -p $$" 1
+        rlRun "grep -i 'permission denied' $rlRun_LOG"
+        rm -f $rlRun_LOG
+        rlRun "semodule -r testpolicy"
+    rlPhaseEnd
+
+    rlPhaseStartTest "prevent loading of kernel modules"
+        if lsmod | grep -q dummy ; then
+            rlRun "modprobe -r dummy"
+        fi
+        rlRun "echo -e '( deny unconfined_t unconfined_t ( system ( module_load module_request )))' > testpolicy.cil"
+        rlRun "semodule -i testpolicy.cil"
+        rlRun "semodule -lfull | grep testpolicy"
+        rlRun -s "modprobe dummy" 1
+        rlRun "grep -i 'permission denied' $rlRun_LOG"
+        rm -f $rlRun_LOG
+        rlRun "lsmod | grep dummy" 1
+        rlRun "semodule -r testpolicy"
+        rlRun "modprobe dummy"
+        rlRun "lsmod | grep dummy"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+    rlPhaseEnd
+rlJournalEnd
+