[tests/selinux] pr775-checkpolicy-revdeps: Test selabel_lookup with local fcontext modifications

[tests/selinux] pr775-checkpolicy-revdeps: Test selabel_lookup with local fcontext modifications

[Petr Lautrbach]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 9fbaa60c55fc1348a6aa49853c7e7161297ec3d3
            Author : Petr Lautrbach <lautrbach@redhat.com>
            Date   : 2025-05-29T15:48:05+02:00
            Stats  : +75/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/9fbaa60c55fc1348a6aa49853c7e7161297ec3d3?branch=pr775-checkpolicy-revdeps

            Log:
            Test selabel_lookup with local fcontext modifications

In specific conditions, it was not possible to override default file
context using `semanage fcontext`. The test imitates the right condition
and checks whether it works as expected.

Related: https://bugzilla.redhat.com/show_bug.cgi?id=2360183

---
diff --git a/libselinux/selabel_lookup-and-local-changes/main.fmf b/libselinux/selabel_lookup-and-local-changes/main.fmf
new file mode 100644
index 0000000..66cbf9d
--- /dev/null
+++ b/libselinux/selabel_lookup-and-local-changes/main.fmf
@@ -0,0 +1,23 @@
+summary: Test selabel_lookup with local fcontext modifications
+description: We need to be sure that different of local fcontext modifications are consistently resolved
+test: ./test.sh
+framework: beakerlib
+contact: Petr Lautrbach <lautrbach@redhat.com>
+component:
+  - libselinux
+require:
+  - libselinux-utils
+  - policycoreutils-python-utils
+enabled: true
+duration: 10m
+tier: 1
+tag:
+  - CI-Tier-1
+  - NoRHEL4
+  - NoRHEL5
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6
+    continue: false
+link:
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2360183

diff --git a/libselinux/selabel_lookup-and-local-changes/test.sh b/libselinux/selabel_lookup-and-local-changes/test.sh
new file mode 100755
index 0000000..1a944b7
--- /dev/null
+++ b/libselinux/selabel_lookup-and-local-changes/test.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PATHS="/rc.d/init.d/test42XYZ-selabel
+/usr/bin/test42XYZ-selabel_lookup
+/var/lib/test42XYZ-selabel_lookup/bestmatch"
+
+PATHSPECS='/rc\.d/init\.d/test42XYZ-(selabel|lookup)
+/usr/bin/test42XYZ-selabel_lookup
+/var/lib/test42XYZ-selabel_lookup(/.*)?'
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
+        rlRun "pushd $tmp"
+        rlRun "set -o pipefail"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        echo -n '' > test-selabel-lookup.cil
+        for pathspec in $PATHSPECS; do
+            echo "(filecon \"${pathspec}\" file (system_u object_r shell_exec_t ((s0) (s0))))" >> test-selabel-lookup.cil
+        done
+        rlRun "cat test-selabel-lookup.cil"
+        rlRun "semodule -i test-selabel-lookup.cil"
+        for path in $PATHS; do
+            rlRun -s "selabel_lookup -b file -k ${path}"
+            rlAssertGrep shell_exec_t $rlRun_LOG
+        done
+        for pathspec in $PATHSPECS; do
+            rlRun "semanage fcontext -a -t bin_t '${pathspec}'"
+        done
+        rlRun "semanage fcontext -l -C"
+        for path in $PATHS; do
+            rlRun -s "selabel_lookup -b file -k ${path}"
+            rlAssertGrep bin_t $rlRun_LOG
+
+            echo $?
+            rlRun "matchpathcon ${path}"
+        done
+        for pathspec in $PATHSPECS; do
+            rlRun "semanage fcontext -d -t bin_t '${pathspec}'"
+        done
+        rlRun "semodule -r test-selabel-lookup"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $tmp" 0 "Remove tmp directory"
+    rlPhaseEnd
+rlJournalEnd