[tests/selinux] pr775-checkpolicy-revdeps: test if matchpathcon works fine in chroot environment

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 1800d749613d672b0bac3674e4dad0b0dbf5ea16
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-07-10T09:32:35+02:00
            Stats  : +174/-0 in 6 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/1800d749613d672b0bac3674e4dad0b0dbf5ea16?branch=pr775-checkpolicy-revdeps

            Log:
            test if matchpathcon works fine in chroot environment

A recent anaconda testing on Fedora rawhide machines revealed a
regression in the libselinux code which leads to segfaults. The TC
reproduces the situation.

The TC uses 2 reproducers (python code, binary command) to find out
if the problem is present or not. Both of them should pass when the
problem is fixed.

The TC covers BZ#2295428 and RHEL-46558.

---
diff --git a/libselinux/matchpathcon-in-chroot-env/Makefile b/libselinux/matchpathcon-in-chroot-env/Makefile
new file mode 100644
index 0000000..0028f3e
--- /dev/null
+++ b/libselinux/matchpathcon-in-chroot-env/Makefile
@@ -0,0 +1,67 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env
+#   Description: Does matchpathcon work correctly in chroot environment?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2024 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/libselinux/Regression/matchpathcon-in-chroot-env
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE test-script.sh test-script.py
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+	test -x test-script.sh || chmod a+x test-script.sh
+	test -x test-script.py || chmod a+x test-script.py
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Does matchpathcon work correctly in chroot environment?" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        15m" >> $(METADATA)
+	@echo "RunFor:          libselinux" >> $(METADATA)
+	@echo "Requires:        policycoreutils libselinux libselinux-utils python3-libselinux" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2+" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+	@echo "Bug:             2295428" >> $(METADATA) # Fedora 41
+	@echo "Bug:             RHEL-46558" >> $(METADATA) # RHEL-10
+
+	rhts-lint $(METADATA)
+

diff --git a/libselinux/matchpathcon-in-chroot-env/PURPOSE b/libselinux/matchpathcon-in-chroot-env/PURPOSE
new file mode 100644
index 0000000..7cbb17e
--- /dev/null
+++ b/libselinux/matchpathcon-in-chroot-env/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env
+Author: Milos Malik <mmalik@redhat.com>
+
+Does matchpathcon work correctly in chroot environment?
+

diff --git a/libselinux/matchpathcon-in-chroot-env/main.fmf b/libselinux/matchpathcon-in-chroot-env/main.fmf
new file mode 100644
index 0000000..edc58c1
--- /dev/null
+++ b/libselinux/matchpathcon-in-chroot-env/main.fmf
@@ -0,0 +1,27 @@
+summary: Does matchpathcon work correctly in chroot environment?
+description: |
+    Does matchpathcon work correctly in chroot environment?
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+  - libselinux
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+  - libselinux
+  - libselinux-utils
+  - python3-libselinux
+  - policycoreutils
+duration: 15m
+enabled: true
+tier: '1'
+tag:
+  - targeted
+  - CI-Tier-1
+  - NoRHIVOS
+link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2295428
+  - verifies: https://issues.redhat.com/browse/RHEL-46558
+extra-summary: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env
+extra-task: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env
+

diff --git a/libselinux/matchpathcon-in-chroot-env/runtest.sh b/libselinux/matchpathcon-in-chroot-env/runtest.sh
new file mode 100755
index 0000000..e273569
--- /dev/null
+++ b/libselinux/matchpathcon-in-chroot-env/runtest.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env
+#   Description: Does matchpathcon work correctly in chroot environment?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2024 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="libselinux"
+CHROOT_DIR=`mktemp -d`
+if rlIsFedora ; then
+    INSTALL_OPTION="--use-host-config"
+fi
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-utils
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#2295428 + RHEL-46558"
+        rlRun "yum -y install filesystem libselinux libselinux-utils python3-libselinux policycoreutils --installroot=${CHROOT_DIR} ${INSTALL_OPTION}"
+        rlRun "dmesg -c >& /dev/null"
+        rlRun "cp ./test-script.sh ${CHROOT_DIR}/usr/bin/"
+        rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.sh"
+        rlRun "grep -i -e 'segmentation' -e 'fault' $rlRun_LOG" 1
+        rm -f $rlRun_LOG
+        rlRun "cp ./test-script.py ${CHROOT_DIR}/usr/bin/"
+        rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.py"
+        rlRun "grep -i -e 'segmentation' -e 'fault' $rlRun_LOG" 1
+        rm -f $rlRun_LOG
+        rlRun "dmesg"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf ${CHROOT_DIR}"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+

diff --git a/libselinux/matchpathcon-in-chroot-env/test-script.py b/libselinux/matchpathcon-in-chroot-env/test-script.py
new file mode 100755
index 0000000..630741f
--- /dev/null
+++ b/libselinux/matchpathcon-in-chroot-env/test-script.py
@@ -0,0 +1,8 @@
+#!/usr/bin/python3
+
+import selinux
+try:
+    selinux.matchpathcon("/dev", 16384)
+except FileNotFoundError as e:
+    print(e)
+

diff --git a/libselinux/matchpathcon-in-chroot-env/test-script.sh b/libselinux/matchpathcon-in-chroot-env/test-script.sh
new file mode 100755
index 0000000..77ee72f
--- /dev/null
+++ b/libselinux/matchpathcon-in-chroot-env/test-script.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+sestatus
+matchpathcon /dev ; true
+