From 3efef0404f99f3e625f7f1ab92ffaf28df6a6024 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 14 Feb 2025 22:40:23 +0100
Subject: [PATCH] Add extra know to override default crypto-policy

On RHEL9 tests often fail just because SHA1 cannot be used, but is
expected there. Try to enable SHA1 when running test suite on RHEL9
automatically, allow environment to be used for other distributions.

Also do not chown complete root directory, as it break access via SSH
keys. Instead just allow anonymous user to enter $HOME, but not read
contents. Have ability to read just to build directory, that should be
enough.
---
 .../Run-internal-BIND-test-suite/main.fmf     |  1 +
 .../Run-internal-BIND-test-suite/runtest.sh   | 28 ++++++++++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/Sanity/named/Run-internal-BIND-test-suite/main.fmf b/Sanity/named/Run-internal-BIND-test-suite/main.fmf
index 0e259fa..0e60225 100644
--- a/Sanity/named/Run-internal-BIND-test-suite/main.fmf
+++ b/Sanity/named/Run-internal-BIND-test-suite/main.fmf
@@ -31,6 +31,7 @@ recommend:
   - gcc-c++
   - python3-dns
   - python3-pytest
+  - opensc
 adjust+:
   - enabled: false
     when: distro == rhel
diff --git a/Sanity/named/Run-internal-BIND-test-suite/runtest.sh b/Sanity/named/Run-internal-BIND-test-suite/runtest.sh
index fc784bc..146c0aa 100755
--- a/Sanity/named/Run-internal-BIND-test-suite/runtest.sh
+++ b/Sanity/named/Run-internal-BIND-test-suite/runtest.sh
@@ -44,6 +44,8 @@ USER="user$RANDOM"
 # May cause more failures.
 : ${MAXCORES:=8}
 : ${WITHOUT:=--without DOC --without EXPORT_LIBS}
+# Override default crypto-policy
+: ${CRYPTO_POLICY:=}
 
 rlJournalStart
     rlPhaseStartSetup
@@ -107,6 +109,9 @@ rlJournalStart
 			rlRun "dnf config-manager --set-enabled $REPO"
 		done
 	fi
+	if rlIsRHEL 9; then
+		CRYPTO_POLICY=DEFAULT:SHA1
+	fi
 
         # topdir
         if rlIsRHEL 3 || rlIsRHEL 4 || rlIsRHEL 5; then
@@ -165,6 +170,16 @@ rlJournalStart
 	rlRun "rpm -q perl-IO-Socket-INET6 || yum install -y 'perl(IO::Socket::INET6)' --enablerepo=\*" 0-255
         # stop bind if it is running
         service named stop
+
+	if [ -n "$CRYPTO_POLICY" ]; then
+		rlRun "BACKUP_CRYPTO_POLICY=$(update-crypto-policies --show)" 0 "Store original crypto policy"
+		rlRun "update-crypto-policies --set $CRYPTO_POLICY" 0 "Change crypto policy"
+	fi
+
+	SOFTHSM2_MODULE="$(rpm -E '%{_libdir}/pkcs11/libsofthsm2.so')"
+	if [ -x "$SOFTHSM2_MODULE" ]; then
+		export SOFTHSM2_MODULE
+	fi
     rlPhaseEnd
 
     rlPhaseStartTest
@@ -250,7 +265,8 @@ rlJournalStart
 
 	# Try to fix tssgsig failures on some machines, do not use system kerberos configuration
 	export KRB5_CONFIG=/dev/null
-	chmod a+rw -R /root #running as a USER
+	chmod a+x "$HOME" #running as a USER
+	chmod a+rX -R $(rpm -E %_builddir)
 	RHEL9HACK="sudo -u $USER"
 	set -o pipefail
         rlRun "${RHEL9HACK} make ${MAKE_TEST:-test -j$CORES} |& tee $TMPDIR/test.txt" 0-255 "Perform the test, --init-task=/distribution/install/rhel-buildroot is needed"
@@ -262,6 +278,13 @@ rlJournalStart
 	if [ -f bin/tests/system/testsummary.sh ]; then
 		FAILED_TESTS=`grep '^R:[a-z0-9_-][a-z0-9_-]*:FAIL' $TMPDIR/test.txt | cut -d':' -f2 | sort | xargs echo`
 		PASSED_TESTS=`grep '^R:[a-z0-9_-][a-z0-9_-]*:PASS' $TMPDIR/test.txt | cut -d':' -f2 | sort | xargs echo`
+
+		# 9.18.29+ uses pytest to run some tests and generates failed output to different place
+		pushd bin/tests/system
+		for TMPDIR in *_tmp_*/; do
+			FAILED_TESTS+=" $TMPDIR"
+		done
+		popd
 		if [ -n "$FAILED_TESTS" ]; then
 			rlLog "Failed tests: $FAILED_TESTS"
 			rlRun "tar czf $TMPDIR/failed-artifacts.tar.gz -C bin/tests/system $FAILED_TESTS" 0 "Archiving failed artifacts in tests"
@@ -321,6 +344,9 @@ rlJournalStart
 	if [ -r "$TMPDIR/failed-artifacts.tar.gz" ]; then
 		rlFileSubmit "$TMPDIR/failed-artifacts.tar.gz" failed-artifacts.tar.gz
 	fi
+	if [ -n "$CRYPTO_POLICY" ]; then
+		rlRun "update-crypto-policies --set $BACKUP_CRYPTO_POLICY" 0 "Restore original crypto policy"
+	fi
         rlRun "popd"
         rlServiceRestore "rngd"
         rlRun "rm -r $TMPDIR" 0 "Removing tmp directory"