[tests/selinux] pr775-checkpolicy-revdeps: selinux-policy/policy-rpm-macros: Use our version

[tests/selinux] pr775-checkpolicy-revdeps: selinux-policy/policy-rpm-macros: Use our version

[Petr Lautrbach]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b1adfa9c2b086ecd200069e43c0f201ceeb63994
            Author : Petr Lautrbach <lautrbach@redhat.com>
            Date   : 2025-03-10T16:41:43+01:00
            Stats  : +266/-10 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b1adfa9c2b086ecd200069e43c0f201ceeb63994?branch=pr775-checkpolicy-revdeps

            Log:
            selinux-policy/policy-rpm-macros: Use our version

https://github.com/fedora-selinux/selinux-policy-macros has not been
touched for years and it will obsoleted soon.

With this update:

- add runtest.sh from fedora-selinux/selinux-policy-macros as this
repository and rename it to selinux-policy-macros.runtest.sh

- update selinux-policy-macros.runtest.sh to use MACRO_FILE env variable
if exists

- update runtest.sh to export MACRO_FILE variable so that both tests use
the same file

- use ssh_sysadm_login instead of zabbix_... boolean as zabbix is in
EPEL in RHEL like repositories

---
diff --git a/selinux-policy/policy-rpm-macros/runtest.sh b/selinux-policy/policy-rpm-macros/runtest.sh
index 7be30c1..2460ddb 100755
--- a/selinux-policy/policy-rpm-macros/runtest.sh
+++ b/selinux-policy/policy-rpm-macros/runtest.sh
@@ -31,6 +31,7 @@
 
 PACKAGE="selinux-policy"
 MACRO_FILE="/usr/lib/rpm/macros.d/macros.selinux-policy"
+export MACRO_FILE
 
 rlJournalStart
     rlPhaseStartSetup
@@ -50,16 +51,9 @@ rlJournalStart
         rlRun "grep selinuxenabled ${MACRO_FILE} | grep /usr/sbin/" 1
     rlPhaseEnd
 
-    rlPhaseStartTest "download and prepare the upstream test"
-        rlRun "git clone https://github.com/fedora-selinux/selinux-policy-macros.git"
-        rlRun "rm -f selinux-policy-macros/macros.selinux-policy"
-        rlRun "cp /usr/lib/rpm/macros.d/macros.selinux-policy selinux-policy-macros/"
-    rlPhaseEnd
-
-    pushd selinux-policy-macros
-    # running an upstream test written by Petr Lautrbach, thanks
-    ./runtest.sh
-    popd
+    # originally test from https://github.com/fedora-selinux/selinux-policy-macros
+    # now shipped with this test
+    ./selinux-policy-macros.runtest.sh
 
     rlPhaseStartCleanup
         rlRun "rm -rf selinux-policy-macros"

diff --git a/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh b/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh
new file mode 100755
index 0000000..7ae2d68
--- /dev/null
+++ b/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh
@@ -0,0 +1,262 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of ipp
+#   Description: Tests for IPP scriptlets
+#   Author: Petr Lautrbach <plautrba@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (C) 2017 Red Hat, Inc. All rights reserved.
+# 
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include the BeakerLib environment
+. /usr/share/beakerlib/beakerlib.sh
+
+# Set SELinux store
+if rlIsRHEL "<=7" || rlIsCentOS "<=7"; then
+    SELINUXSTOREPATH=/etc/selinux
+else
+    SELINUXSTOREPATH=/var/lib/selinux
+fi
+
+# Set the full test name
+TEST="IPP"
+
+# Package being tested
+PACKAGE="IPP"
+
+MACRO_FILE=${MACRO_FILE:-/usr/lib/rpm/macros.d/macros.selinux-policy}
+
+set_booleans() {
+    rlRun "rpm --eval '%selinux_set_booleans -s targeted $*' > run_selinux_set_booleans.sh" 0
+    rlRun "bash run_selinux_set_booleans.sh"
+}
+
+unset_booleans() {
+        rlRun "rpm --eval '%selinux_unset_booleans -s targeted $*' > run_selinux_unset_booleans.sh" 0
+        rlRun "bash run_selinux_unset_booleans.sh"
+}
+
+
+rlJournalStart
+    rlPhaseStartSetup "Setup"
+        rlRun "rlFileBackup --clean ~/.rpmmacros" 0,1 "Backing up ~/.rpmmacros"
+        rlRun "sed 's|SELINUXSTOREPATH|$SELINUXSTOREPATH|' ${MACRO_FILE} >>  ~/.rpmmacros" 0 "Updating ~/.rpmmacros"
+        rlRun "rlFileBackup --clean ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0,1 "Backing up ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0,1 "Updating ~/.rpmmacros"
+        rlRun 'TmpDir=$(mktemp -d)' 0
+        pushd $TmpDir
+        rlRun "semanage boolean -E > boolean.import" 0 "Backup local boolean modifications"
+        rlRun "semanage boolean -D" 0 "Drop local boolean modifications"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test install on a clean system"
+        set_booleans secure_mode=1 secure_mode_insmod=1
+
+        rlRun "semanage boolean -E > boolean.local"
+        # test if local changes are applied
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local"
+        # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty
+        rlAssertNotGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test uninstall on a clean system"
+        unset_booleans secure_mode=0 secure_mode_insmod=0
+
+        # test if local changes are removed
+        rlRun "semanage boolean -E > boolean.local"
+        rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local"
+        rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlRun "semanage boolean -m --off secure_mode" 0 "cleanup"
+        rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup"
+        rlRun "semanage boolean -D" 0 "cleanup"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test install on a system with secure_mode is already on"
+        rlRun "semanage boolean -m --on secure_mode" 0 "Setting secure_mode=on"
+
+        set_booleans secure_mode=1 secure_mode_insmod=1
+
+        rlRun "semanage boolean -E > boolean.local"
+        # test if local changes are applied
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local"
+        # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty
+        rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test uninstall on a system where secure_mode was on before install"
+
+        unset_booleans secure_mode=0 secure_mode_insmod=0
+
+        # test if local changes are removed
+        rlRun "semanage boolean -E > boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local"
+        rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+
+        rlRun "semanage boolean -m --off secure_mode" 0 "cleanup"
+        rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup"
+        rlRun "semanage boolean -D" 0 "cleanup"
+
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test install on a system with secure_mode was changed to off"
+        rlRun "semanage boolean -m --off secure_mode" 0 "Setting secure_mode=on"
+
+        set_booleans secure_mode=1 secure_mode_insmod=1
+
+        rlRun "semanage boolean -E > boolean.local"
+        # test if local changes are applied
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local"
+        # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty
+        rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test uninstall on a system where secure_mode was on before install"
+
+        unset_booleans secure_mode=0 secure_mode_insmod=0
+
+        # test if local changes are removed
+        rlRun "semanage boolean -E > boolean.local"
+        rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode' "boolean.local"
+        rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local"
+        rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+
+        rlRun "semanage boolean -m --off secure_mode" 0 "cleanup"
+        rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup"
+        rlRun "semanage boolean -D" 0 "cleanup"
+
+    rlPhaseEnd
+
+# ============ Install twice, remove once ======================
+
+    rlPhaseStartTest "Test install twice on a clean system"
+        set_booleans secure_mode=1 secure_mode_insmod=1
+        set_booleans secure_mode=1 ssh_sysadm_login=1
+
+        rlRun "semanage boolean -E > boolean.local"
+        # test if local changes are applied
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) ssh_sysadm_login' "boolean.local"
+        # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty
+        rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertNotGrep '\(-1\|--on\) ssh_sysadm_login' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test uninstall once after install twice"
+        unset_booleans secure_mode=0 secure_mode_insmod=0
+
+        # test if local changes are removed
+        rlRun "semanage boolean -E > boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) ssh_sysadm_login' "boolean.local"
+        rlAssertGrep 'secure_mode$' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertGrep 'ssh_sysadm_login' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlRun "semanage boolean -m --off secure_mode" 0 "cleanup"
+        rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup"
+        rlRun "semanage boolean -m --off ssh_sysadm_login" 0 "cleanup"
+        rlRun "semanage boolean -D" 0 "cleanup"
+	rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0 "cleanup"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test install twice on a system with secure_mode is already on"
+        rlRun "semanage boolean -m --on secure_mode" 0 "Setting secure_mode=on"
+
+        set_booleans secure_mode=1 secure_mode_insmod=1
+        set_booleans secure_mode=1
+
+        rlRun "semanage boolean -E > boolean.local"
+        # test if local changes are applied
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local"
+        # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty
+        rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test uninstall once after install twice on a system where secure_mode was on before install"
+
+        unset_booleans secure_mode=0 secure_mode_insmod=0
+
+        # test if local changes are removed
+        rlRun "semanage boolean -E > boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local"
+        rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+
+        rlRun "semanage boolean -m --off secure_mode" 0 "cleanup"
+        rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup"
+        rlRun "semanage boolean -D" 0 "cleanup"
+	rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0 "cleanup"
+
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test install twice on a system with secure_mode was changed to off"
+        rlRun "semanage boolean -m --off secure_mode" 0 "Setting secure_mode=on"
+
+        set_booleans secure_mode=1 secure_mode_insmod=1
+        set_booleans secure_mode=1
+
+        rlRun "semanage boolean -E > boolean.local"
+        # test if local changes are applied
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local"
+        # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty
+        rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test uninstall once after install twice on a system where secure_mode was off before install"
+
+        unset_booleans secure_mode=0 secure_mode_insmod=0
+
+        # test if local changes are removed
+        rlRun "semanage boolean -E > boolean.local"
+        rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local"
+        rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local"
+        rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+        rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom"
+
+        rlRun "semanage boolean -m --off secure_mode" 0 "cleanup"
+        rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup"
+        rlRun "semanage boolean -D" 0 "cleanup"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup "Cleanup"
+        rlRun "semanage boolean -D" 0 "Clean all boolean changes"
+        rlRun "semanage import < boolean.import" 0 "Import local boolean modifications back"
+        popd
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlRun "rlFileRestore"
+    rlPhaseEnd
+
+rlJournalEnd
+
+# Print the test report
+rlJournalPrintText