[tests/selinux] pr775-checkpolicy-revdeps: add a new test plan which covers reboot actions

[tests/selinux] pr775-checkpolicy-revdeps: add a new test plan which covers reboot actions

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : d5d0a48cc8c18ee431a2aef8c3d873724cc94bad
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-02-08T22:27:40+01:00
            Stats  : +108/-1 in 8 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/d5d0a48cc8c18ee431a2aef8c3d873724cc94bad?branch=pr775-checkpolicy-revdeps

            Log:
            add a new test plan which covers reboot actions

The test plan covers the following actions:
 * update packages to the latest versions available
 * reboot
 * collect SELinux denials that appeared since reboot

---
diff --git a/other/collect-denials/main.fmf b/other/collect-denials/main.fmf
new file mode 100644
index 0000000..a02c9b6
--- /dev/null
+++ b/other/collect-denials/main.fmf
@@ -0,0 +1,11 @@
+summary: collect SELinux denials which appeared since boot
+contact: Milos Malik <mmalik@redhat.com>
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+ - audit
+ - /usr/sbin/service
+ - policycoreutils
+duration: 5m
+enabled: true
+

diff --git a/other/collect-denials/runtest.sh b/other/collect-denials/runtest.sh
new file mode 100755
index 0000000..ff52732
--- /dev/null
+++ b/other/collect-denials/runtest.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "sestatus"
+        rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "service auditd status -l"
+        rlRun "ausearch -m avc -m selinux_err -i -ts boot" 1
+        rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+    rlPhaseEnd
+rlJournalEnd
+

diff --git a/other/collect-denials/test.sh b/other/collect-denials/test.sh
new file mode 100755
index 0000000..f8845e4
--- /dev/null
+++ b/other/collect-denials/test.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "sestatus"
+        rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "service auditd status -l"
+        rlRun "ausearch -m avc -m selinux_err -i -ts boot"
+        rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+    rlPhaseEnd
+rlJournalEnd
+

diff --git a/other/update-packages/main.fmf b/other/update-packages/main.fmf
new file mode 100644
index 0000000..2c54741
--- /dev/null
+++ b/other/update-packages/main.fmf
@@ -0,0 +1,7 @@
+summary: update packages to the latest versions available
+contact: Milos Malik <mmalik@redhat.com>
+test: ./runtest.sh
+framework: beakerlib
+duration: 15m
+enabled: true
+

diff --git a/other/update-packages/runtest.sh b/other/update-packages/runtest.sh
new file mode 100755
index 0000000..967588e
--- /dev/null
+++ b/other/update-packages/runtest.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "dnf clean all"
+        rlRun "dnf -y update --skip-broken --allowerasing"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort"
+    rlPhaseEnd
+rlJournalEnd
+

diff --git a/other/update-packages/test.sh b/other/update-packages/test.sh
new file mode 100755
index 0000000..967588e
--- /dev/null
+++ b/other/update-packages/test.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "dnf clean all"
+        rlRun "dnf -y update --skip-broken --allowerasing"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort"
+    rlPhaseEnd
+rlJournalEnd
+

diff --git a/plans/reboot.fmf b/plans/reboot.fmf
new file mode 100644
index 0000000..cb304d0
--- /dev/null
+++ b/plans/reboot.fmf
@@ -0,0 +1,11 @@
+summary: update, reboot and check for denials
+discover:
+    how: fmf
+    url: https://src.fedoraproject.org/tests/selinux
+    test:
+        - /other/update-packages
+        - /selinux-policy/bz533007-unable-to-start-kdump-service
+        - /other/collect-denials
+execute:
+    how: tmt
+

diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf
index eb81cce..152701d 100644
--- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf
@@ -1,4 +1,4 @@
-summary: kdump service cannot be started because of SELinux
+summary: SELinux interferes with kdump and related programs
 description: |+
     SELinux interferes with kdump and related programs.