[tests/selinux] pr775-checkpolicy-revdeps: add a basic apol test

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 29b9cb2a5c17964c877ecde61247a51135d87eba
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-05-09T15:17:40+00:00
            Stats  : +185/-0 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/29b9cb2a5c17964c877ecde61247a51135d87eba?branch=pr775-checkpolicy-revdeps

            Log:
            add a basic apol test

Main purpose of the automated test is to find out if the apol tool
can read and analyze the SELinux policies currently installed on
the system.

Because the apol tool is a graphical one, a working X session is
needed to conduct the testing procedure.

---
diff --git a/setools/apol/Makefile b/setools/apol/Makefile
new file mode 100644
index 0000000..c3390e4
--- /dev/null
+++ b/setools/apol/Makefile
@@ -0,0 +1,65 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/setools/Sanity/apol
+#   Description: basic apol testing
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2024 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/setools/Sanity/apol
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     basic apol test" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          setools" >> $(METADATA)
+	@echo "Requires:        setools-console setools-gui tigervnc-server selinux-policy-mls selinux-policy-targeted gnome-session-xsession gnome-shell" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+	@echo "Bug:             RHEL-29967" >> $(METADATA) # RHEL-10
+
+	rhts-lint $(METADATA)
+

diff --git a/setools/apol/PURPOSE b/setools/apol/PURPOSE
new file mode 100644
index 0000000..0b80714
--- /dev/null
+++ b/setools/apol/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/setools/Sanity/apol
+Author: Milos Malik <mmalik@redhat.com>
+
+Is apol able to run?
+

diff --git a/setools/apol/main.fmf b/setools/apol/main.fmf
new file mode 100644
index 0000000..3ec5295
--- /dev/null
+++ b/setools/apol/main.fmf
@@ -0,0 +1,36 @@
+summary: basic apol test
+description: |+
+    Is apol able to run?
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+  - setools
+test: ./runtest.sh
+framework: beakerlib
+require:
+  - library(selinux-policy/common)
+recommend:
+  - gnome-shell
+  - gnome-session-xsession
+  - setools-console
+  - setools-gui
+  - tigervnc-server
+  - selinux-policy-mls
+  - selinux-policy-targeted
+duration: 10m
+enabled: true
+tag:
+  - NoRHEL4
+  - NoRHEL5
+  - NoRHEL6
+  - NoRHEL7
+  - targeted
+link:
+  - relates: https://issues.redhat.com/browse/RHEL-29967
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
+    continue: false
+extra-summary: /CoreOS/setools/Sanity/apol
+extra-task: /CoreOS/setools/Sanity/apol
+extra-nitrate: TC#0617470

diff --git a/setools/apol/runtest.sh b/setools/apol/runtest.sh
new file mode 100755
index 0000000..32f2aa4
--- /dev/null
+++ b/setools/apol/runtest.sh
@@ -0,0 +1,79 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/setools/Sanity/apol
+#   Description: basic apol testing
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2024 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rpm -qa | grep setools"
+        for POLICY_KIND in mls targeted ; do
+            rlAssertRpm selinux-policy-${POLICY_KIND}
+        done
+        rlFileBackup /etc/tigervnc/vncserver.users
+    rlPhaseEnd
+
+    rlPhaseStartTest "real scenario -- RHEL-29967"
+        USER_NAME="toor"
+        USER_SECRET="S3kr3t${RANDOM}"
+        if ! grep -q ":10=${USER_NAME}" /etc/tigervnc/vncserver.users ; then
+            rlRun "echo -en '\n:10=${USER_NAME}\n' >> /etc/tigervnc/vncserver.users"
+        fi
+        rlRun "useradd -o -u 0 -g 0 ${USER_NAME}"
+        rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+        rlRun "mkdir -p /home/${USER_NAME}/.config"
+        rlRun "mkdir -p /home/${USER_NAME}/.vnc"
+        rlRun "echo ${USER_SECRET} | vncpasswd -f > /home/${USER_NAME}/.vnc/passwd"
+        rlRun "chmod go= /home/${USER_NAME}/.vnc/passwd"
+        rlRun "ls -l /home/${USER_NAME}/.vnc/"
+        rlRun "restorecon -RvF /home/${USER_NAME}"
+        rlRun "systemctl enable vncserver@:10.service"
+        rlRun "systemctl start vncserver@:10.service"
+        sleep 15
+        rlRun "cat /home/${USER_NAME}/.vnc/*.log"
+        rlRun "systemctl status vncserver@:10.service"
+        for POLICY_KIND in mls targeted ; do
+            rlRun "cp /etc/selinux/${POLICY_KIND}/policy/policy.* /home/${USER_NAME}/policy.${POLICY_KIND}"
+            rlWatchdog "DISPLAY=:10 apol -v /home/${USER_NAME}/policy.${POLICY_KIND} >& output.txt" 30
+            rlRun "grep -i 'success.*open.*permission map' output.txt"
+            rlRun "grep -i 'success.*open.*policy' output.txt"
+            rlRun "grep -i -e traceback -e error output.txt" 1
+        done
+        rlRun "systemctl stop vncserver@:10.service"
+        rlRun "systemctl status vncserver@:10.service" 3
+        rlRun "systemctl disable vncserver@:10.service"
+        sleep 15
+        rlRun "userdel -rfZ ${USER_NAME}"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlFileRestore
+    rlPhaseEnd
+    rlJournalPrintText
+rlJournalEnd
+