[tests/selinux] pr775-checkpolicy-revdeps: Remove all check against the lockdown class

[Zdenek Pytela <zpytela@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 29d2c154d9f02fc3e468bad10360e90212883911
            Author : Zdenek Pytela <zpytela@redhat.com>
            Date   : 2024-01-04T22:09:17+01:00
            Stats  : +0/-200 in 7 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/29d2c154d9f02fc3e468bad10360e90212883911?branch=pr775-checkpolicy-revdeps

            Log:
            Remove all check against the lockdown class

The lockdown SELinux class was removed from kernel and no check is now
performed in the SELinux lockdown hook as a comprehensive fix for all
the SELinux lockdown-class related problems class was rejected, so no
test checks using the lockdown class are now pertinent.
The lockdown-class checks are now not in any supported systems kernels.

Related: https://bugzilla.redhat.com/show_bug.cgi?id=2017848

---
diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh
index ba14f7e..fd3ec10 100755
--- a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh
@@ -176,13 +176,6 @@ rlJournalStart
     rlPhaseEnd
     fi
 
-    if seinfo -c | grep -q lockdown ; then
-    rlPhaseStartTest "bz#1932752"
-        rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
-        rlSESearchRule "allow kdump_t kdump_t : lockdown { confidentiality integrity } [ ]"
-    rlPhaseEnd
-    fi
-
     if ! rlIsRHEL 5 6 7 ; then
     rlPhaseStartTest "bz#1951323 + bz#1961728 + bz#1965985 + bz#1965989"
         # the directory belongs to the kexec-tools package

diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh
index 0c18c3b..51caa22 100755
--- a/selinux-policy/dmidecode-and-similar/runtest.sh
+++ b/selinux-policy/dmidecode-and-similar/runtest.sh
@@ -78,14 +78,6 @@ rlJournalStart
     rlPhaseEnd
     fi
 
-    if seinfo -c | grep -q lockdown ; then
-    rlPhaseStartTest "bz#1926696"
-        rlSEMatchPathCon "/usr/sbin/biosdecode" "dmidecode_exec_t"
-        rlSEMatchPathCon "/usr/sbin/vpddecode" "dmidecode_exec_t"
-        rlSESearchRule "allow dmidecode_t dmidecode_t : lockdown { integrity } [ ]"
-    rlPhaseEnd
-    fi
-
     rlPhaseStartTest "real scenario -- runcon"
         # this TC does not belong to the small set of SELinux domains which can run dmidecode in the system_u:system_r:dmidecode_t:s0 context, therefore we need some help
         # TODO: use sysadm_t user instead of initrc_t to run dmidecode, because sysadm_t is allowed to transition to dmidecode_t

diff --git a/selinux-policy/lockdown-class/Makefile b/selinux-policy/lockdown-class/Makefile
deleted file mode 100644
index 549137c..0000000
--- a/selinux-policy/lockdown-class/Makefile
+++ /dev/null
@@ -1,70 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/selinux-policy/Sanity/lockdown-class
-#   Description: Is the lockdown class + its permissions defined in SELinux policy?
-#   Author: Milos Malik <mmalik@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2020 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/selinux-policy/Sanity/lockdown-class
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	chmod a+x runtest.sh
-	chcon -t bin_t runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Is the lockdown class + its permissions defined in SELinux policy?" >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        10m" >> $(METADATA)
-	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA)
-	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
-	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
-	@echo "Bug:             1915184" >> $(METADATA) # Fedora rawhide
-	@echo "Bug:             1929332" >> $(METADATA) # RHEL-9
-	@echo "Bug:             1933134" >> $(METADATA) # RHEL-9
-
-	rhts-lint $(METADATA)
-

diff --git a/selinux-policy/lockdown-class/PURPOSE b/selinux-policy/lockdown-class/PURPOSE
deleted file mode 100644
index 17dd1ab..0000000
--- a/selinux-policy/lockdown-class/PURPOSE
+++ /dev/null
@@ -1,5 +0,0 @@
-PURPOSE of /CoreOS/selinux-policy/Sanity/lockdown-class
-Author: Milos Malik <mmalik@redhat.com>
-
-Description: Is the lockdown class + its permissions defined in SELinux policy?
-

diff --git a/selinux-policy/lockdown-class/main.fmf b/selinux-policy/lockdown-class/main.fmf
deleted file mode 100644
index c780d92..0000000
--- a/selinux-policy/lockdown-class/main.fmf
+++ /dev/null
@@ -1,40 +0,0 @@
-summary: Is the lockdown class + its permissions defined in SELinux policy?
-description: |+
-    Description: Is the lockdown class + its permissions defined in SELinux policy?
-
-contact: Milos Malik <mmalik@redhat.com>
-component:
-  - selinux-policy
-require:
-  - library(selinux-policy/common)
-recommend:
-  - audit
-  - libselinux
-  - libselinux-utils
-  - policycoreutils
-  - selinux-policy
-  - selinux-policy-targeted
-  - setools-console
-environment:
-    AVC_ERROR: +no_avc_check
-duration: 10m
-enabled: true
-tag:
-  - NoRHEL4
-  - NoRHEL5
-  - NoRHEL6
-  - NoRHEL7
-  - NoRHEL8
-  - targeted
-link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1915184
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929332
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933134
-adjust:
-  - enabled: false
-    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, centos-stream-8
-    because: the lockdown class is not defined there
-extra-summary: /CoreOS/selinux-policy/Sanity/lockdown-class
-extra-task: /CoreOS/selinux-policy/Sanity/lockdown-class
-extra-nitrate: TC#0615920
-id: 5ef38ca9-81bf-4051-9c9d-201ffccd351f

diff --git a/selinux-policy/lockdown-class/runtest.sh b/selinux-policy/lockdown-class/runtest.sh
deleted file mode 100755
index 02e7682..0000000
--- a/selinux-policy/lockdown-class/runtest.sh
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/selinux-policy/Sanity/lockdown-class
-#   Description: Is the lockdown class + its permissions defined in SELinux policy?
-#   Author: Milos Malik <mmalik@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2020 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGE="selinux-policy"
-
-rlJournalStart
-    if ! seinfo -c | grep -q lockdown ; then
-        rlLog "Not applicable to this OS version."
-        rlJournalEnd
-        exit 0
-    fi
-    rlPhaseStartSetup
-        rlRun "rlImport 'selinux-policy/common'"
-        rlSESatisfyRequires
-        rlAssertRpm ${PACKAGE}
-        rlAssertRpm ${PACKAGE}-targeted
-
-        rlSESetEnforce
-        rlSEStatus
-        rlSESetTimestamp
-        sleep 2
-    rlPhaseEnd
-
-    rlPhaseStartTest "bz#1915184"
-        rlRun "seinfo -c lockdown"
-        rlRun "seinfo -c lockdown -x | grep confidentiality"
-        rlRun "seinfo -c lockdown -x | grep integrity"
-    rlPhaseEnd
-
-    rlPhaseStartTest "bz#1929332 + bz#1933134"
-        rlSESearchRule "allow unconfined_t unconfined_t : lockdown { integrity } [ ]"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        sleep 2
-        rlSECheckAVC
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd

diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
index 7f89ee6..1589c14 100755
--- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh
+++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
@@ -125,9 +125,6 @@ rlJournalStart
         rlRun "lsmod | grep rdma"
         rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1
         rlRun "systemctl stop rdma-load-modules@rdma.service"
-        if seinfo -c | grep -q lockdown ; then
-            rlSESearchRule "allow systemd_modules_load_t systemd_modules_load_t : lockdown { confidentiality } [ ]"
-        fi
     rlPhaseEnd
 
     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then