[tests/selinux] pr775-checkpolicy-revdeps: Update the install-uninstall-dsp-packages test

[Zdenek Pytela <zpytela@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 03fc444e76543cfc5eede55e9d5c7303051ff2b4
            Author : Zdenek Pytela <zpytela@redhat.com>
            Date   : 2024-03-18T13:42:48+00:00
            Stats  : +140/-12 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/03fc444e76543cfc5eede55e9d5c7303051ff2b4?branch=pr775-checkpolicy-revdeps

            Log:
            Update the install-uninstall-dsp-packages test

Particular changes:
- install also DSP packages which do not distribute its custom SELinux
  module in a subpackage with the "-selinux" suffix (Fedora only)
- use rlLogWarning to display warnings
- list /var/run entries not having an equivalent rule in /run
- make use of the DEBUG variable to keep output files
  with various data after the test finishes:
-- list files in /run which have incorrect context
-- list installed packages
-- list SELinux modules, permissive and unconfined domains
-- check if dbus communication is defined bidirectionally

---
diff --git a/selinux-policy/install-uninstall-dsp-packages/Makefile b/selinux-policy/install-uninstall-dsp-packages/Makefile
index 2ad8c5e..b801290 100644
--- a/selinux-policy/install-uninstall-dsp-packages/Makefile
+++ b/selinux-policy/install-uninstall-dsp-packages/Makefile
@@ -30,7 +30,7 @@ export TESTVERSION=1.0
 
 BUILT_FILES=
 
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
+FILES=$(METADATA) additional-dsp-packages.txt dbus-sendmsg.pl runtest.sh Makefile PURPOSE
 
 .PHONY: all install download clean
 

diff --git a/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt b/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt
new file mode 100644
index 0000000..bb3d718
--- /dev/null
+++ b/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt
@@ -0,0 +1,13 @@
+# List of additional DSP packages which distribute its custom SELinux module,
+# but not in a subpackage with the "-selinux" suffix
+# This file is being maintained manually
+
+BackupPC
+# beah - temporary not working in rawhide
+ec2-hibinit-agent
+google-compute-engine-oslogin
+mariadb-cracklib-password-check
+mariadb-server-galera
+postsrsd
+qm
+receptor

diff --git a/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl b/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl
new file mode 100755
index 0000000..cc46f51
--- /dev/null
+++ b/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl
@@ -0,0 +1,71 @@
+#!/usr/bin/perl -w
+### Check if dbus communication is allowed bidirectionally
+
+use strict;
+
+my $sesearch_cmd="/usr/bin/sesearch";
+my $sesearch_args="-A -c dbus -p send_msg";
+my ($line, @output);
+my (@seoutarray, $seout, $seline);
+my $count=0;
+
+# Take all allow rules matching the description
+open SESEARCH, "$sesearch_cmd $sesearch_args |"
+  or die "Cannot run sesearch: $!";
+while ($line =<SESEARCH>) {
+	$count++;
+	#debug printf "%4d %s", $count, $line;
+	chomp $line;
+	# > sesearch -A -t systemd_timedated_t -s initrc_t -c dbus -p send_msg
+	# allow dbusd_unconfined nsswitch_domain:dbus send_msg;
+	# allow system_bus_type system_dbusd_t:dbus { acquire_svc send_msg };
+	# allow NetworkManager_t xguest_t:dbus send_msg; [ xguest_connect_network ]:True
+	@output = split /[ :]/, $line;
+        next if $output[2] eq "self";
+        next if $output[2] eq $output[1];
+	# Look for the rule in the inverse direction
+	open $seout, "$sesearch_cmd $sesearch_args -s $output[2] -t $output[1] |"
+	  or die "Cannot run sesearch: $!";
+	@seoutarray = <$seout>;
+	if (@seoutarray == 0) {
+	  print "No reverse match: $line\n";
+	}
+	else {
+	  foreach $seline (@seoutarray) {
+	    if ($seline =~ /\]:/) {
+	      print "Conditional rule: $seline";
+	      print "   Original line: $line\n";
+	    }
+	  }
+	}
+	close $seout;
+}
+print "Total dbus:send_msg rules number: $count\n";
+
+__END__
+
+State as of 2024.03.05
+f39: 1738 rules, 8 asymmetrical
+RHEL9: 1731 rules, 6 asymmetrical
+RHEL8: 2359 rules, 52 asymmetrical
+
+f39
+No reverse match: allow cronjob_t openshift_app_t:dbus send_msg;
+No reverse match: allow cronjob_t openshift_t:dbus send_msg;
+No reverse match: allow cronjob_t staff_t:dbus send_msg;
+No reverse match: allow cronjob_t sysadm_t:dbus send_msg;
+No reverse match: allow cronjob_t user_t:dbus send_msg;
+No reverse match: allow pasta_t init_t:dbus send_msg;
+No reverse match: allow pasta_t system_dbusd_t:dbus send_msg;
+No reverse match: allow pasta_t systemd_hostnamed_t:dbus send_msg;
+
+RHEL9
+No reverse match: allow cronjob_t openshift_app_t:dbus send_msg;
+No reverse match: allow cronjob_t openshift_t:dbus send_msg;
+No reverse match: allow cronjob_t staff_t:dbus send_msg;
+No reverse match: allow cronjob_t sysadm_t:dbus send_msg;
+No reverse match: allow cronjob_t user_t:dbus send_msg;
+No reverse match: allow nvme_stas_t system_dbusd_t:dbus { acquire_svc send_msg };
+
+RHEL8
+

diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh
index b251ff3..058619f 100755
--- a/selinux-policy/install-uninstall-dsp-packages/runtest.sh
+++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh
@@ -34,8 +34,20 @@ PACKAGE="selinux-policy"
 SKIP_REMOVAL=${SKIP_REMOVAL:-""}
 SKIP_INSTALL=${SKIP_INSTALL:-""}
 INSTALL_ONLY=${INSTALL_ONLY:-""}
-FCONTEXT_LIST="/tmp/semanage-fcontext"
-FCONTEXT_LIST_VARRUN="/tmp/semanage-fcontext-varrun"
+ADDITIONAL_DSP_PACKAGES="additional-dsp-packages.txt"
+TMPDIR=${TMPDIR-"/var/tmp"}
+OUTDIR="${TMPDIR}/test-output"
+FCONTEXT_LIST="${OUTDIR}/semanage-fcontext"
+FCONTEXT_LIST2="${OUTDIR}/semanage-fcontext2"
+FCONTEXT_LIST_VARRUN="${OUTDIR}/semanage-fcontext-varrun"
+RESTORECON_RVN_RUN="${OUTDIR}/restorecon-rvn-run"
+RPMQA="${OUTDIR}/rpmqa"
+SEMODULE_LIST="${OUTDIR}/semodule-list"
+SEMODULE_LIST_DSP="${OUTDIR}/semodule-list-dsp"
+PERMISSIVE_DOMAINS="${OUTDIR}/permissive-domains"
+UNCONFINED_DOMAINS="${OUTDIR}/unconfined-domains"
+DBUS_SENDMSG="${OUTDIR}/dbus-sendmsg"
+mkdir -p ${OUTDIR}
 
 # Function to create a report template for install test
 function install_report() {
@@ -98,12 +110,17 @@ rlJournalStart
         rlRun "sed -i '/beaker-tasks/d' install-list"
 	# exclude debuginfo packages
         rlRun "sed -i '/-debuginfo/d' install-list"
-	# tmp: omit failing vfrnav
-        rlRun "sed -i '/vfrnav-selinux/d' install-list"
 	# packages names only
         rlRun "awk '{print \$1}' install-list > pkgonlylist"
 	# exclude updates-source
         rlRun "grep -vE '(.src)' pkgonlylist | sort -u > install-pkgs"
+	# include additional packages which do not match the "*-selinux" pattern
+	# currently for Fedora only
+	if rlIsFedora ">=38"
+	then
+	  # remove comments and blank lines
+	  rlRun "sed '/^[#]/d;/^$/d' ${ADDITIONAL_DSP_PACKAGES} >> install-pkgs"
+	fi
 	# use the same list for checks of the subsequent uninstallation
         rlRun "cp -f install-pkgs uninstall-pkgs"
         rlRun "install_report"
@@ -130,20 +147,46 @@ rlJournalStart
     rlPhaseEnd
 
     ### Checks performed with all dsp packages installed
+
     ### Status of /run and /var/run equivalency
     rlPhaseStartTest "Check /run equivalency status"
 	rlRun "semanage fcontext -l > ${FCONTEXT_LIST}"
 	if grep -q "/run = /var/run" ${FCONTEXT_LIST}; then
-	    echo "Warning: Legacy equivalency settings \"/run = /var/run\" are in place."
+	    rlLogInfo "Legacy equivalency settings \"/run = /var/run\" are in place."
 	elif grep -q "/var/run = /run" ${FCONTEXT_LIST}; then
-	    echo "New equivalency settings /\"var/run = /run\" are in place."
-	    if grep -q "^/var/run" ${FCONTEXT_LIST}; then
-		rlLog "Warning: /var/run entries found in the file context database"
-		rlRun "sed '/^\/var\/run/!d; s|[ \t].*$||' ${FCONTEXT_LIST} | uniq > ${FCONTEXT_LIST_VARRUN}"
+	    rlLog "New equivalency settings /\"var/run = /run\" are in place."
+	    grep -v "/var/run = /run" ${FCONTEXT_LIST} > ${FCONTEXT_LIST2}
+	    if grep -q "^/var/run" ${FCONTEXT_LIST2}; then
+		rlLogWarning "/var/run entries found in the file context database"
+		rlRun "sed '/^\/var\/run/!d; s|[ \t].*$||' ${FCONTEXT_LIST2} | uniq > ${FCONTEXT_LIST_VARRUN}"
+
+		# List /var/run rules which do not have an equivalent one in /run
+		while read line
+		do
+		    if ! grep -q "^${line#/var}" ${FCONTEXT_LIST2}; then
+		        rlLog "Dup rule does not exist in /run: \"$line\""
+		    fi
+		done < ${FCONTEXT_LIST_VARRUN}
 	    fi
-	else echo "Unknown or none /run equivalency settings."
+	else rlLogWarning "None or unknown /run equivalency settings."
+	fi
+
+	[ "$DEBUG" = "yes" ] ||
+	rlRun "rm -f ${FCONTEXT_LIST} ${FCONTEXT_LIST_VARRUN}"
+    rlPhaseEnd
+
+    ### Store some data which might be of some use later
+    rlPhaseStartTest "Gather relevant data"
+	if [ "${DEBUG}" = "yes" ]; then
+	    rlRun "restorecon -Rvn /run > ${RESTORECON_RVN_RUN}"
+	    rlRun "rpm -qa | sort > ${RPMQA}"
+	    rlRun "semanage permissive -l > ${PERMISSIVE_DOMAINS}"
+	    rlRun "seinfo -xa unconfined_domain_type > ${UNCONFINED_DOMAINS}"
+	    rlRun "semodule -lfull > ${SEMODULE_LIST}"
+	    rlRun "grep -v ^100 ${SEMODULE_LIST} > ${SEMODULE_LIST_DSP}"
+	    rlRpmInstall "perl"
+	    rlRun "./dbus-sendmsg.pl > ${DBUS_SENDMSG}"
 	fi
-	rm -f ${FCONTEXT_LIST} ${FCONTEXT_LIST_VARRUN}
     rlPhaseEnd
 
     rlPhaseStartTest "Uninstall test for dsp packages"
@@ -174,6 +217,7 @@ rlJournalStart
         if [ -f "Err_file" ]; then
             rlRun "rm -f Err_file"
         fi
+	[ "$DEBUG" = "yes" ] ||
         rlRun "rm -f install-list pkgonlylist install-pkgs uninstall-pkgs pkglist.report"
         rlSECheckAVC --ignore 'type=USER_AVC.*denied.* send_msg .*scontext=.*:unconfined_t:.*tcontext=.*:system_dbusd_t:.*tclass=dbus' \
                      --ignore 'type=USER_AVC.* start .*:unconfined_t:.*:init_t:.*tclass=system' \