Tweak selinux-context test to handle sbin merge

We can't assume the existence of /usr/sbin/httpd any more; with
the sbin merge, it may be /usr/bin/httpd . Let's decide which to
look for by checking whether /usr/sbin is a symlink.

Signed-off-by: Adam Williamson <awilliam@redhat.com>

Sanity/got-audit/Makefile

@@ -0,0 +1,45 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/httpd/Sanity/got-audit
+#   Description: Ensure pointers in the server process GOT match expected values
+#   Author: Gordon Messmer <gordon.messmer@gmail.com>
+#
+
+export TEST=/CoreOS/httpd/Sanity/got-audit
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile got-audit.gdb
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+-include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Gordon Messmer <gordon.messmer@gmail.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Ensure pointers in the server process GOT match expected values" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          httpd" >> $(METADATA)
+	@echo "Requires:        httpd gdb-gef" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2+" >> $(METADATA)
+	@echo "Confidential:    yes" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        " >> $(METADATA)
+
+	rhts-lint $(METADATA)

Sanity/got-audit/got-audit.gdb

@@ -0,0 +1,2 @@
+gef config gef.disable_color True
+got-audit --all

Sanity/got-audit/main.fmf

@@ -0,0 +1,12 @@
+summary: Audit the GOT for signs of tampering
+description: |
+  Pointers in the server process GOT will be checked to ensure that
+  each function pointer's value is within a shared object file
+  that exports a symbol of that name, and that no shared object
+  files export conflicting symbols.
+contact: Gordon Messmer <gordon.messmer@gmail.com>
+require+:
+  - gdb-gef           # needed to test got-audit
+test: ./runtest.sh
+framework: beakerlib
+

Sanity/got-audit/runtest.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/httpd/Sanity/got-audit
+#   Description: Check pointers in the server process GOT for signs of tampering
+#   Author: Gordon Messmer <gordon.messmer@gmail.com>
+#
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlServiceStart httpd
+        rlRun "TestDir=\$(pwd)"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Run GEF got-audit"
+        rlRun "SERVICE_PID=\$( systemctl show --property=MainPID httpd.service | cut -f2 -d= )"
+        rlRun "echo SERVICE_PID is '$SERVICE_PID'"
+        [ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
+        rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
+        # Basic test: ensure that at least one symbol is found in libc.so,
+        #  to verify that the report looks plausible.
+        rlAssertGrep " : /.*/libc.so" "$auditfile"
+        # Ensure the got-audit did not report any errors
+        rlAssertNotGrep " :: ERROR" "$auditfile"
+        rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlServiceRestore httpd
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

core/selinux-context/runtest.sh

@@ -48,7 +48,13 @@ rlJournalStart
             rlRun "ls -d -Z \$(rpm -ql $httpHTTPD) > files_context.log"\
                 0 "getting selinux context of rpm's files ($httpHTTPD)"
         fi
-        rlAssertGrep "httpd_exec_t.*/usr/sbin/httpd" files_context.log
+        rlFileSubmit files_context.log
+        # handle sbin merge by checking if /usr/sbin is a symlink
+        if test -L /usr/sbin; then
+            rlAssertGrep "httpd_exec_t.*/usr/bin/httpd" files_context.log
+        else
+            rlAssertGrep "httpd_exec_t.*/usr/sbin/httpd" files_context.log
+        fi
         rlAssertGrep "httpd_config_t.*/etc/httpd" files_context.log
         rlAssertGrep "httpd_log_t.*/var/log/httpd" files_context.log
     rlPhaseEnd

core/smoke-htcacheclean/main.fmf

@@ -0,0 +1,18 @@
+summary: Smoke test for htcacheclean service
+description: ''
+component:
+- httpd
+test: ./runtest.sh
+framework: beakerlib
+require:
+- library(httpd/http)
+- httpd
+duration: 1m
+enabled: true
+tag:
+- Tier1
+tier: '1'
+adjust:
+-   enabled: false
+    when: distro < rhel-10, centos-stream-10
+    continue: false

core/smoke-htcacheclean/runtest.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh htcacheclean test
+#   Description: Smoke test of htcacheclean
+#   Author: Joe Orton <jorton@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2022 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGES="${PACKAGES:-httpd}"
+REQUIRES=${REQUIRES:-}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun -l "systemctl preset htcacheclean"
+        rlRun -s -l "systemctl is-enabled htcacheclean" 1
+        rlAssertGrep disabled $rlRun_LOG
+
+        # Check for warning for missing [Install]
+        rlRun -s -l "systemctl enable htcacheclean" 0 "Enable htcacheclean service"
+        rlAssertNotGrep 'The unit files have no installation config' $rlRun_LOG
+
+        rlRun -s -l "systemctl is-enabled htcacheclean"
+        rlAssertGrep enabled $rlRun_LOG
+
+        rlRun "systemctl start htcacheclean" 0 "Start htcacheclean service"
+        rlRun "sleep 5"
+        rlRun "systemctl stop htcacheclean" 0 "Stop htcacheclean service"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalEnd
+rlJournalPrintText

integration/php-mariadb/main.fmf

@@ -6,7 +6,6 @@ test: ./runtest.sh
 framework: beakerlib
 require:
 - library(httpd/http)
-- library(database/mysql)
 - library(database/mariadb)
 - library(php/utils)
 - httpd

mod_ssl/check-httpd-init/main.fmf

@@ -0,0 +1,15 @@
+summary: Smoke test for httpd-init service
+description: ''
+component:
+- httpd
+test: ./runtest.sh
+framework: beakerlib
+require:
+- library(httpd/http)
+- httpd
+- mod_ssl
+duration: 1m
+enabled: true
+tag:
+- Tier1
+tier: '1'

mod_ssl/check-httpd-init/runtest.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh htcacheclean test
+#   Description: Smoke test of htcacheclean
+#   Author: Joe Orton <jorton@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2022 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGES="${PACKAGES:-httpd mod_ssl}"
+REQUIRES=${REQUIRES:-}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie
+        rlRun "rm -vf /dhparams.pem /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "systemctl start httpd"
+        rlAssertNotExists /dhparams.pem
+        rlAssertExists /etc/pki/tls/certs/localhost.crt
+        rlAssertExists /etc/pki/tls/private/localhost.key
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "systemctl stop httpd"
+    rlPhaseEnd
+rlJournalEnd
+rlJournalPrintText