[tests/selinux] pr775-checkpolicy-revdeps: Fix failing deny_load_module testcase

[tests/selinux] pr775-checkpolicy-revdeps: Fix failing deny_load_module testcase

[Amith Kumar]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : cc300caa91b35677c3980ef8bc8f775c7fcb6c47
            Author : Amith Kumar <apeetham@redhat.com>
            Date   : 2025-05-21T19:23:27+05:30
            Stats  : +6/-1 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/cc300caa91b35677c3980ef8bc8f775c7fcb6c47?branch=pr775-checkpolicy-revdeps

            Log:
            Fix failing deny_load_module testcase

The selinux-policy/deny-rules test suite failed during recent test runs
on Fedora-rawhide. The cause of failure seems to be missing deny rules
compatible to recent rawhide release. Fix the test code and address the
failures.

Signed-off-by: Amith Kumar <apeetham@redhat.com>

---
diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh
index 65f947e..36b5bbc 100755
--- a/selinux-policy/deny-rules/runtest.sh
+++ b/selinux-policy/deny-rules/runtest.sh
@@ -19,6 +19,7 @@ rlJournalStart
     fi
 
     rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'" 0,1
         rlAssertRpm libsepol
         rlAssertRpm libsemanage
         rlAssertRpm libselinux
@@ -41,6 +42,8 @@ rlJournalStart
             rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf"
         fi
         rlRun "service sshd restart"
+        rlSESetTimestamp
+        sleep 2
     rlPhaseEnd
 
     rlPhaseStartTest "prevent the reading of a file"
@@ -114,7 +117,8 @@ rlJournalStart
         fi
         rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( system ( module_load module_request )))' > testpolicy.cil"
         rlRun "echo -e '( deny kmod_t kmod_t ( system ( module_load module_request )))' >> testpolicy.cil"
-        rlRun "semodule -i testpolicy.cil"
+        rlRun "echo -e '( deny kmod_t modules_object_t ( system ( module_load )))' >> testpolicy.cil"
+	rlRun "semodule -i testpolicy.cil"
         rlRun "semodule -lfull | grep testpolicy"
         rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost modprobe dummy"
         rlRun "grep -i 'permission denied' $rlRun_LOG"
@@ -133,6 +137,7 @@ rlJournalStart
             rlRun "rm -f /etc/ssh/sshd_config.d/001-enable-password.conf"
         fi
         rlRun "service sshd restart"
+        rlSECheckAVC --ignore 'type=AVC .*  denied  { unlink } .* comm=rm .*:sysadm_t:.*:machineid_t:.*tclass=file' --ignore 'type=AVC .*  denied  { module_load } .* comm=modprobe .*:kmod_t:.*:modules_object_t:.*tclass=system'
     rlPhaseEnd
 rlJournalEnd