[tests/selinux] pr775-checkpolicy-revdeps: adapt to testing under confined users too

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : f80d8f1fead645e9ce1caa3fbf4d7e6e20e7aee7
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-01-02T13:12:32+00:00
            Stats  : +83/-17 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/f80d8f1fead645e9ce1caa3fbf4d7e6e20e7aee7?branch=pr775-checkpolicy-revdeps

            Log:
            adapt to testing under confined users too

The root user on a system is usually not confined by SELinux (context:
unconfined_u:unconfined_r:unconfined_t), but there are security
standarts which require the root user to be confined by SELinux
(context: sysadm_u:sysadm_r:sysadm_t).
In order to use this automated test on such systems, certain code
changes were necessary.

---
diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf
index eb66a3a..6f2625a 100644
--- a/selinux-policy/deny-rules/main.fmf
+++ b/selinux-policy/deny-rules/main.fmf
@@ -11,6 +11,7 @@ recommend:
   - policycoreutils
   - selinux-policy
   - strace
+  - expect
 duration: 10m
 enabled: true
 tier: 1

diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh
index 19f77e2..73f96af 100755
--- a/selinux-policy/deny-rules/runtest.sh
+++ b/selinux-policy/deny-rules/runtest.sh
@@ -2,67 +2,104 @@
 # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+USER_CONTEXT=${USER_CONTEXT:-"sysadm_u:sysadm_r:sysadm_t"}
+SELINUX_USER=`echo ${USER_CONTEXT} | cut -d : -f 1`
+USER_ROLE=`echo ${USER_CONTEXT} | cut -d : -f 2`
+USER_TYPE=`echo ${USER_CONTEXT} | cut -d : -f 3`
+USER_NAME="user${RANDOM}"
+USER_SECRET="S3krET${RANDOM}"
+
 rlJournalStart
+    CUR_VERSION=`rpm -q --qf "%{version}" policycoreutils | head -n 1`
+    if rlTestVersion ${CUR_VERSION} '<' 3.6 ; then
+        rlLog "The installed SELinux userspace does NOT support deny rules."
+        rlLog "The automated test is NOT relevant for this environment."
+        rlJournalEnd
+        exit 0
+    fi
+
     rlPhaseStartSetup
         rlAssertRpm libsepol
         rlAssertRpm libsemanage
         rlAssertRpm libselinux
         rlAssertRpm policycoreutils
         rlAssertRpm selinux-policy
+
         rlRun "setenforce 1"
         rlRun "sestatus"
+        rlRun "useradd -o -u 0 -g 0 -Z ${SELINUX_USER} ${USER_NAME}"
+        rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+        rlRun "setsebool ssh_sysadm_login on"
+
+        rlFileBackup /etc/ssh/sshd_config
+        rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config"
+        rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config"
+        if [ -d /etc/ssh/sshd_config.d ] ; then
+            rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf"
+        fi
+        rlRun "service sshd restart"
     rlPhaseEnd
 
     rlPhaseStartTest "prevent the reading of a file"
         rlRun "stat /etc/shadow" 0
         rlRun "grep ^bin /etc/shadow" 0
-        rlRun "echo -e '( deny unconfined_t shadow_t ( file ( getattr read )))' > testpolicy.cil"
+        rlRun "echo -e '( deny ${USER_TYPE} shadow_t ( file ( getattr read )))' > testpolicy.cil"
         rlRun "semodule -i testpolicy.cil"
         rlRun "semodule -lfull | grep testpolicy"
-        rlRun "stat /etc/shadow" 1
-        rlRun "grep ^bin /etc/shadow" 2
+        rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost stat /etc/shadow"
+        rlRun "grep -i 'permission denied' $rlRun_LOG"
+        rm -f $rlRun_LOG
+        rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost grep ^bin /etc/shadow"
+        rlRun "grep -i 'permission denied' $rlRun_LOG"
+        rm -f $rlRun_LOG
         rlRun "semodule -r testpolicy"
     rlPhaseEnd
 
     rlPhaseStartTest "prevent the execution of a file"
         rlRun "dmesg >& /dev/null"
-        rlRun "echo -e '( deny unconfined_t dmesg_exec_t ( file ( execute execute_no_trans )))' > testpolicy.cil"
+        rlRun "echo -e '( deny ${USER_TYPE} dmesg_exec_t ( file ( execute execute_no_trans )))' > testpolicy.cil"
         rlRun "semodule -i testpolicy.cil"
         rlRun "semodule -lfull | grep testpolicy"
-        rlRun "dmesg" 126
+        rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost dmesg"
+        rlRun "grep -i 'permission denied' $rlRun_LOG"
+        rm -f $rlRun_LOG
         rlRun "semodule -r testpolicy"
     rlPhaseEnd
 
     rlPhaseStartTest "prevent removal of a file"
         if [ -f /etc/machine-id ] ; then
-            rlRun "cp -a /etc/machine-id ."
+            rlRun "cp -a /etc/machine-id /home/${USER_NAME}/"
         else
-            rlRun "cp -a /run/machine-id ."
+            rlRun "cp -a /run/machine-id /home/${USER_NAME}/"
         fi
-        rlRun "ls -Z ./machine-id"
-        rlRun "echo -e '( deny unconfined_t machineid_t ( file ( unlink )))' > testpolicy.cil"
+        rlRun "ls -Z /home/${USER_NAME}/machine-id"
+        rlRun "echo -e '( deny ${USER_TYPE} machineid_t ( file ( unlink )))' > testpolicy.cil"
         rlRun "semodule -i testpolicy.cil"
         rlRun "semodule -lfull | grep testpolicy"
-        rlRun "rm -f ./machine-id" 1,2
+        rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost rm -f /home/${USER_NAME}/machine-id"
+        rlRun "grep -i 'permission denied' $rlRun_LOG"
+        rm -f $rlRun_LOG
         rlRun "semodule -r testpolicy"
-        rlRun "rm -f ./machine-id"
+        rlRun "rm -f /home/${USER_NAME}/machine-id"
     rlPhaseEnd
 
     rlPhaseStartTest "prevent the search in a directory"
         rlRun "ls -lZR /etc/pki >& /dev/null"
-        rlRun "echo -e '( deny unconfined_t cert_t ( dir ( search )))' > testpolicy.cil"
+        rlRun "echo -e '( deny ${USER_TYPE} cert_t ( dir ( search )))' > testpolicy.cil"
         rlRun "semodule -i testpolicy.cil"
         rlRun "semodule -lfull | grep testpolicy"
-        rlRun "ls -lZR /etc/pki" 1
+        rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost ls -lZR /etc/pki"
+        rlRun "grep -i 'permission denied' $rlRun_LOG"
+        rm -f $rlRun_LOG
         rlRun "semodule -r testpolicy"
     rlPhaseEnd
 
     rlPhaseStartTest "prevent ptracing of processes"
         rlWatchdog "strace -p $$" 5
-        rlRun "echo -e '( deny unconfined_t unconfined_t ( process ( ptrace )))' > testpolicy.cil"
+        rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( process ( ptrace )))' > testpolicy.cil"
         rlRun "semodule -i testpolicy.cil"
         rlRun "semodule -lfull | grep testpolicy"
-        rlRun -s "strace -p $$" 1
+        rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost strace -p $$"
         rlRun "grep -i 'permission denied' $rlRun_LOG"
         rm -f $rlRun_LOG
         rlRun "semodule -r testpolicy"
@@ -72,10 +109,11 @@ rlJournalStart
         if lsmod | grep -q dummy ; then
             rlRun "modprobe -r dummy"
         fi
-        rlRun "echo -e '( deny unconfined_t unconfined_t ( system ( module_load module_request )))' > testpolicy.cil"
+        rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( system ( module_load module_request )))' > testpolicy.cil"
+        rlRun "echo -e '( deny kmod_t kmod_t ( system ( module_load module_request )))' >> testpolicy.cil"
         rlRun "semodule -i testpolicy.cil"
         rlRun "semodule -lfull | grep testpolicy"
-        rlRun -s "modprobe dummy" 1
+        rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost modprobe dummy"
         rlRun "grep -i 'permission denied' $rlRun_LOG"
         rm -f $rlRun_LOG
         rlRun "lsmod | grep dummy" 1
@@ -85,6 +123,13 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartCleanup
+        rlRun "setsebool ssh_sysadm_login off"
+        rlRun "userdel -rfZ ${USER_NAME}"
+        rlFileRestore
+        if [ -d /etc/ssh/sshd_config.d ] ; then
+            rlRun "rm -f /etc/ssh/sshd_config.d/001-enable-password.conf"
+        fi
+        rlRun "service sshd restart"
     rlPhaseEnd
 rlJournalEnd
 

diff --git a/selinux-policy/deny-rules/ssh.exp b/selinux-policy/deny-rules/ssh.exp
new file mode 100755
index 0000000..58c9647
--- /dev/null
+++ b/selinux-policy/deny-rules/ssh.exp
@@ -0,0 +1,20 @@
+#!/usr/bin/expect -f
+# Expect script for SSH logging as $username to $hostname using $password and executing $command.
+# Usage:
+#   ./ssh.exp username password hostname command
+set username [lrange $argv 0 0]
+set password [lrange $argv 1 1]
+set hostname [lrange $argv 2 2]
+set command  [lrange $argv 3 10]
+set timeout 15
+# connect to remote host and execute given command
+log_user 1
+spawn ssh -t $username@$hostname $command
+expect {
+  -nocase "yes/no" { send -- "yes\r" ; exp_continue }
+  -nocase "password" { send -- "$password\r" }
+}
+log_user 1
+# send -- "\r"
+expect eof
+