[tests/selinux] pr775-checkpolicy-revdeps: test if 'notself' and 'other' keywords are supported

[tests/selinux] pr775-checkpolicy-revdeps: test if 'notself' and 'other' keywords are supported

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b2097912cce168be4606f71a8c038efba65242d5
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-03-04T10:49:58+00:00
            Stats  : +115/-0 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b2097912cce168be4606f71a8c038efba65242d5?branch=pr775-checkpolicy-revdeps

            Log:
            test if 'notself' and 'other' keywords are supported

SELinux userspace 3.6 recognizes new keywords: notself, other.
 * https://github.com/SELinuxProject/selinux/releases/tag/3.6

Purpose of this automated test is to find out whether their
implementation matches the expected functionality.

---
diff --git a/selinux-policy/notself-other-keywords/main.fmf b/selinux-policy/notself-other-keywords/main.fmf
new file mode 100644
index 0000000..edbf75b
--- /dev/null
+++ b/selinux-policy/notself-other-keywords/main.fmf
@@ -0,0 +1,32 @@
+summary: Basic test of the notself/other keywords
+contact: Milos Malik <mmalik@redhat.com>
+test: ./runtest.sh
+framework: beakerlib
+component:
+  - selinux-policy
+recommend:
+  - libsepol
+  - libsemanage
+  - libselinux
+  - policycoreutils
+  - selinux-policy
+  - setools-console
+environment:
+    AVC_ERROR: +no_avc_check
+duration: 10m
+enabled: true
+tier: 1
+tag:
+  - CI-Tier-1
+  - NoRHEL4
+  - NoRHEL5
+  - NoRHEL6
+  - NoRHEL7
+  - NoRHEL8
+  - targeted
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8
+    because: notself/other keywords are not recognized/implemented there
+extra-nitrate: TC#0617216
+id: 88fc548f-c1fa-48dc-a5ca-58478774911f

diff --git a/selinux-policy/notself-other-keywords/notself-module.cil b/selinux-policy/notself-other-keywords/notself-module.cil
new file mode 100644
index 0000000..ae361a7
--- /dev/null
+++ b/selinux-policy/notself-other-keywords/notself-module.cil
@@ -0,0 +1,3 @@
+(type a_t)
+(allow a_t notself ( process ( signal )))
+

diff --git a/selinux-policy/notself-other-keywords/other-module.cil b/selinux-policy/notself-other-keywords/other-module.cil
new file mode 100644
index 0000000..90e0570
--- /dev/null
+++ b/selinux-policy/notself-other-keywords/other-module.cil
@@ -0,0 +1,9 @@
+(typeattribute parts)
+(type a_t)
+(type b_t)
+(type c_t)
+(typeattributeset parts ( a_t ))
+(typeattributeset parts ( b_t ))
+(typeattributeset parts ( c_t ))
+(allow parts other ( process ( signal )))
+

diff --git a/selinux-policy/notself-other-keywords/runtest.sh b/selinux-policy/notself-other-keywords/runtest.sh
new file mode 100755
index 0000000..48c5442
--- /dev/null
+++ b/selinux-policy/notself-other-keywords/runtest.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    CUR_VERSION=`rpm -q --qf "%{version}" policycoreutils | head -n 1`
+    if rlTestVersion ${CUR_VERSION} '<' 3.6 ; then
+        rlLog "The installed SELinux userspace does NOT support the notself/other keywords."
+        rlLog "The automated test is NOT relevant for this environment."
+        rlJournalEnd
+        exit 0
+    fi
+
+    rlPhaseStartSetup
+        rlAssertRpm libsepol
+        rlAssertRpm libsemanage
+        rlAssertRpm libselinux
+        rlAssertRpm policycoreutils
+        rlAssertRpm selinux-policy
+
+        rlRun "setenforce 1"
+        rlRun "sestatus"
+    rlPhaseEnd
+
+    rlPhaseStartTest "rules defined via the 'notself' keyword"
+        rlRun "semodule -lfull | grep notself-module" 1
+        rlRun "seinfo -t | grep -vi Types: | wc -l"
+        # FIXME: seinfo output contains 1 empty line
+        NO_TYPES_BEFORE=`seinfo -t | grep -vi Types: | wc -l`
+        rlRun "sesearch -A | wc -l"
+        NO_ALLOWS_BEFORE=`sesearch -A | wc -l`
+        rlRun "semodule -i notself-module.cil"
+        rlRun "semodule -lfull | grep notself-module"
+        rlRun "seinfo -t | grep -vi Types: | wc -l"
+        # FIXME: seinfo output contains 1 empty line
+        NO_TYPES_AFTER=`seinfo -t | grep -vi Types: | wc -l`
+        rlRun "sesearch -A | wc -l"
+        NO_ALLOWS_AFTER=`sesearch -A | wc -l`
+        rlLog "${NO_ALLOWS_BEFORE} + ${NO_TYPES_BEFORE} - 1 = ${NO_ALLOWS_AFTER}"
+        # FIXME: -1 is used because seinfo output contains 1 empty line
+        rlAssertEquals "the number of allow rules grows because of the 'notself' usage" $(( NO_ALLOWS_BEFORE + NO_TYPES_BEFORE - 1 )) $NO_ALLOWS_AFTER
+        rlRun "sesearch -A | grep notself" 1
+        rlRun "semodule -r notself-module"
+    rlPhaseEnd
+
+    rlPhaseStartTest "rules defined via the 'other' keyword"
+        rlRun "semodule -lfull | grep other-module" 1
+        rlRun "seinfo -t a_t -x | grep -i 'types: *0'"
+        rlRun "sesearch -s a_t -A" 1
+        rlRun "semodule -i other-module.cil"
+        rlRun "semodule -lfull | grep other-module"
+        rlRun "seinfo -t a_t -x | grep -C 1 -i 'types: *1'"
+        rlRun "sesearch -A | grep other" 1
+        rlLog "the 'other' keyword should NOT generate any allow rules where scontext = tcontext"
+        rlRun "sesearch -s a_t -t a_t -A | grep allow" 1
+        rlRun "sesearch -s b_t -t b_t -A | grep allow" 1
+        rlRun "sesearch -s c_t -t c_t -A | grep allow" 1
+        rlLog "the 'other' keyword should generate allow rules where scontext != tcontext"
+        rlRun "sesearch -s a_t -t b_t -A | grep allow"
+        rlRun "sesearch -s a_t -t c_t -A | grep allow"
+        rlRun "sesearch -s b_t -t a_t -A | grep allow"
+        rlRun "sesearch -s b_t -t c_t -A | grep allow"
+        rlRun "sesearch -s c_t -t a_t -A | grep allow"
+        rlRun "sesearch -s c_t -t b_t -A | grep allow"
+        rlRun "semodule -r other-module"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+    rlPhaseEnd
+rlJournalEnd
+