[tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: add a fix and a workaround for rpm-ostree

[tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: add a fix and a workaround for rpm-ostree

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 1a3d30f8ddfaed64910d54f5c1689d8a6b0e5d4b
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2024-02-13T08:46:14+00:00
            Stats  : +13/-1 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/1a3d30f8ddfaed64910d54f5c1689d8a6b0e5d4b?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/selinux-testsuite: add a fix and a workaround for rpm-ostree

1. Bump the upstream commit to pull in [1].
2. Apply a workaround to compensate for [2] not yet being applied
   everywhere where it matters.

[1] https://github.com/SELinuxProject/selinux-testsuite/commit/f9f4a604b50eecdc9ff674f1762208f23c15013f
[2] https://github.com/fedora-selinux/selinux-policy/pull/2029

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
index b5f6cc9..a5258dc 100755
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -35,7 +35,7 @@ PACKAGE="selinux-policy"
 # This should be updated as needed after verifying that the new version
 # doesn't break testing and after applying all necessary tweaks in the TC.
 # Run with GIT_BRANCH=master to run the latest upstream version.
-DEFAULT_COMMIT="514e324abc099057782ec569b720eaf9b6d9d99f"
+DEFAULT_COMMIT="f9f4a604b50eecdc9ff674f1762208f23c15013f"
 # Default pull requests to merge before running the test.
 # If non-empty, then after checking out GIT_BRANCH the listed upstream pull
 # requests (by number) are merged, creating a new temporary local branch.
@@ -333,6 +333,18 @@ rlJournalStart
         rlRun "sed -i 's/tm\.tv_sec = [0-9]*;/tm.tv_sec = $NETWORK_TIMEOUT;/' ./tests/*/*.c" 0 \
             "Tweak timeout in networking tests" # 2 secs is too little for SCTP test
 
+        # Fixed by https://github.com/fedora-selinux/selinux-policy/pull/2029,
+        # but may not be in all distro streams.
+        rlRun "tee -a policy/test_global.te" 0  \
+            "Work around missing policy rules" <<EOF
+
+            gen_require(\`
+                attribute domain;
+                type install_t;
+            ')
+            allow domain install_t:fd use;
+EOF
+
         if rlIsRHEL; then
             if kver_lt "3.10.0-349"; then
                 # c4684bbdac07 [security] selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID