[tests/selinux] pr775-checkpolicy-revdeps: adapt to policies with reduced set of types and rules

[tests/selinux] pr775-checkpolicy-revdeps: adapt to policies with reduced set of types and rules

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : dff2d2b919c1af94f97c3dd892649cf367c5ac87
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-07-14T10:52:51+00:00
            Stats  : +21/-11 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/dff2d2b919c1af94f97c3dd892649cf367c5ac87?branch=pr775-checkpolicy-revdeps

            Log:
            adapt to policies with reduced set of types and rules

There are policies which define less types and rules than the targeted
policy. The executed automated tests should adapt if they still make sense.

---
diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh
index 4f5a7f3..87426c5 100755
--- a/selinux-policy/journalctl-and-similar/runtest.sh
+++ b/selinux-policy/journalctl-and-similar/runtest.sh
@@ -62,15 +62,21 @@ rlJournalStart
 
     rlPhaseStartTest "bz#1288255"
         rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}"
-        rlSESearchRule "allow staff_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
-        rlSESearchRule "allow sysadm_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
-        rlSESearchRule "allow user_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
-        rlSESearchRule "allow staff_t ${PROCESS_CONTEXT} : process { transition } [ ]"
-        rlSESearchRule "allow sysadm_t ${PROCESS_CONTEXT} : process { transition } [ ]"
-        rlSESearchRule "allow user_t ${PROCESS_CONTEXT} : process { transition } [ ]"
-        rlSESearchRule "type_transition staff_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
-        rlSESearchRule "type_transition sysadm_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
-        rlSESearchRule "type_transition user_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
+        if rlSEDefined "staff_t" ; then
+            rlSESearchRule "allow staff_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
+            rlSESearchRule "allow staff_t ${PROCESS_CONTEXT} : process { transition } [ ]"
+            rlSESearchRule "type_transition staff_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
+        fi
+        if rlSEDefined "sysadm_t" ; then
+            rlSESearchRule "allow sysadm_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
+            rlSESearchRule "allow sysadm_t ${PROCESS_CONTEXT} : process { transition } [ ]"
+            rlSESearchRule "type_transition sysadm_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
+        fi
+        if rlSEDefined "user_t" ; then
+            rlSESearchRule "allow user_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
+            rlSESearchRule "allow user_t ${PROCESS_CONTEXT} : process { transition } [ ]"
+            rlSESearchRule "type_transition user_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
+        fi
     rlPhaseEnd
 
     rlPhaseStartTest "bz#1685689"
@@ -90,7 +96,7 @@ rlJournalStart
         rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]"
     rlPhaseEnd
 
-    if ! rlIsFedora ; then
+    if ! rlIsFedora && rlSEDefined "user_t" ; then
     rlPhaseStartTest "bz#2017838"
         rlSEMatchPathCon "/run/log/journal/somehash/system.journal" "syslogd_var_run_t"
         rlSEMatchPathCon "/var/lib/systemd/catalog/database" "init_var_lib_t"

diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh
index 38b0fa4..e4a4fee 100755
--- a/selinux-policy/systemd-run-and-similar/runtest.sh
+++ b/selinux-policy/systemd-run-and-similar/runtest.sh
@@ -69,9 +69,11 @@ rlJournalStart
         rlSEMatchPathCon "/var/lib" "var_lib_t"
         rlSEMatchPathCon "/var/lib/myservice0" "var_lib_t"
         rlSESearchRule "allow init_t var_lib_t : lnk_file { getattr read } [ ]"
+        rlRun "setsebool daemons_use_tty on"
         rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0  touch /var/lib/myservice0/foo"
         rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 --pipe wc -c /var/lib/myservice0/foo"
         rlRun "ls -alZ /var/lib/myservice0 /var/lib/private/myservice0"
+        rlRun "setsebool daemons_use_tty off"
     rlPhaseEnd
 
     if ! rlIsRHEL "<9.7" ; then

diff --git a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
index 7f2e944..6c28056 100755
--- a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
+++ b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
@@ -51,7 +51,9 @@ rlJournalStart
 
     rlPhaseStartTest "RHEL-40374 + RHEL-44191"
         rlSEMatchPathCon "/usr/bin/systemd-tmpfiles" "systemd_tmpfiles_exec_t"
-        rlSESearchRule "allow staff_t systemd_tmpfiles_exec_t : file { getattr open read map execute execute_no_trans } [ ]"
+        if rlSEDefined "staff_t" ; then
+            rlSESearchRule "allow staff_t systemd_tmpfiles_exec_t : file { getattr open read map execute execute_no_trans } [ ]"
+        fi
         rlRun "setsebool ssh_sysadm_login on"
         CREATED_USERS=""
         for SELINUX_USER in ${ALLOWED_USERS} ; do