[tests/selinux] pr775-checkpolicy-revdeps: fix known issues in 3 automated tests

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b25abf5f67a1ca1232dcd9250b28ee39c8819235
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-01-16T18:04:46+01:00
            Stats  : +10/-3 in 5 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b25abf5f67a1ca1232dcd9250b28ee39c8819235?branch=pr775-checkpolicy-revdeps

            Log:
            fix known issues in 3 automated tests

1) opensmtpd-and-similar test:
The opensmtpd service needs to be started before an email can be sent
via the mailx command. The original order led to the following error:

  /root/dead.letter 17/564
  s-nail: ... message not sent

2) deny-rules test:
The deny-rules test intentionally triggers SELinux denials. These
SELinux denials should not be reported as errors or warnings.

3) systemd-modules-load-and-similar test:
Not all kernel modules required by the RDMA services are available
on all machines. To avoid unnecessary failures, the test phase
devoted to bz#1942267 will be skipped on such machines.

The automated tests should be fixed now.

---
diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf
index 6f2625a..77ef7a5 100644
--- a/selinux-policy/deny-rules/main.fmf
+++ b/selinux-policy/deny-rules/main.fmf
@@ -12,6 +12,8 @@ recommend:
   - selinux-policy
   - strace
   - expect
+environment:
+    AVC_ERROR: +no_avc_check
 duration: 10m
 enabled: true
 tier: 1

diff --git a/selinux-policy/opensmtpd-and-similar/Makefile b/selinux-policy/opensmtpd-and-similar/Makefile
index a053a8f..1e21b4b 100644
--- a/selinux-policy/opensmtpd-and-similar/Makefile
+++ b/selinux-policy/opensmtpd-and-similar/Makefile
@@ -54,14 +54,14 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service /usr/bin/mailx" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service /usr/bin/mailx" >> $(METADATA) # EPEL
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             2208696" >> $(METADATA) # Fedora 38
 	@echo "Bug:             2246115" >> $(METADATA) # Fedora rawhide
 	@echo "Bug:             RHEL-15175" >> $(METADATA) # RHEL-9

diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf
index 1e8c31e..9621bae 100644
--- a/selinux-policy/opensmtpd-and-similar/main.fmf
+++ b/selinux-policy/opensmtpd-and-similar/main.fmf
@@ -28,6 +28,9 @@ tag:
   - NoRHEL6
   - NoRHEL7
   - targeted
+  - epel
+  - rhel8-epel
+  - rhel9-epel
 link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246115

diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh
index ea750ad..e397a87 100755
--- a/selinux-policy/opensmtpd-and-similar/runtest.sh
+++ b/selinux-policy/opensmtpd-and-similar/runtest.sh
@@ -75,12 +75,12 @@ rlJournalStart
     fi
 
     rlPhaseStartTest "real scenario -- standalone service"
-        rlRun "sestatus | mailx -s test-email root@localhost"
         if ! ls -Z ${FILE_PATH} | grep -q ${FILE_CONTEXT} ; then
             # for environments where the service is not yet confined
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+        rlRun "sestatus | mailx -s test-email root@localhost"
         rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255
         rlRun "smtpctl show status"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1

diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
index 1589c14..8ffe27e 100755
--- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh
+++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
@@ -116,6 +116,7 @@ rlJournalStart
         rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf"
     rlPhaseEnd
 
+    if modinfo `grep ^ib /etc/rdma/modules/rdma.conf` >& /dev/null ; then
     rlPhaseStartTest "bz#1942267"
         tst_Time="$(date '+%T')"
         # Install kernel-module matching the running kernel version
@@ -126,6 +127,7 @@ rlJournalStart
         rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1
         rlRun "systemctl stop rdma-load-modules@rdma.service"
     rlPhaseEnd
+    fi
 
     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then
     rlPhaseStartTest "bz#2088257 + bz#2088258"