From cb71152fff325490e9d17dddbfc2eb77bcdee7eb Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 24 Sep 2020 17:59:56 +0200 Subject: [PATCH] libselinux: Add new test covering get_default_context Perform lookup of a default context for system_u:system_r:crond_t. This should return context derived from "system_r:system_cronjob_t", but fails, because of a kernel bug, when libselinux uses security_compute_user (deprecated). See https://bugzilla.redhat.com/show_bug.cgi?id=1879368 --- libselinux/get_default_context/Makefile | 68 ++++++++++++++++++++ libselinux/get_default_context/PURPOSE | 7 ++ libselinux/get_default_context/main.fmf | 2 + libselinux/get_default_context/reproducer.py | 18 ++++++ libselinux/get_default_context/runtest.sh | 51 +++++++++++++++ 5 files changed, 146 insertions(+) create mode 100644 libselinux/get_default_context/Makefile create mode 100644 libselinux/get_default_context/PURPOSE create mode 100644 libselinux/get_default_context/main.fmf create mode 100644 libselinux/get_default_context/reproducer.py create mode 100755 libselinux/get_default_context/runtest.sh diff --git a/libselinux/get_default_context/Makefile b/libselinux/get_default_context/Makefile new file mode 100644 index 0000000..c7348e5 --- /dev/null +++ b/libselinux/get_default_context/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libselinux/Regression/get_default_context +# Description: Does get_default_context_with_rolelevel work as expected? +# Author: Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libselinux/Regression/get_default_context +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE reproducer.py + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + chmod a+x reproducer.py + chcon -t bin_t reproducer.py + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Vit Mojzis " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does get_default_context_with_rolelevel work as expected?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: libselinux" >> $(METADATA) + @echo "Requires: python3 python3-libselinux libselinux libselinux-utils" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1879368" >> $(METADATA) # RHEL-8.3 + + rhts-lint $(METADATA) diff --git a/libselinux/get_default_context/PURPOSE b/libselinux/get_default_context/PURPOSE new file mode 100644 index 0000000..f1f4e67 --- /dev/null +++ b/libselinux/get_default_context/PURPOSE @@ -0,0 +1,7 @@ +PURPOSE of /CoreOS/libselinux/Regression/get_default_context +Author: Vit Mojzis +Perform lookup of a default context for system_u:system_r:crond_t. This should +return context derived from "system_r:system_cronjob_t", but fails, +because of a kernel bug, when libselinux uses security_compute_user +(deprecated). +See https://bugzilla.redhat.com/show_bug.cgi?id=1879368 diff --git a/libselinux/get_default_context/main.fmf b/libselinux/get_default_context/main.fmf new file mode 100644 index 0000000..229106f --- /dev/null +++ b/libselinux/get_default_context/main.fmf @@ -0,0 +1,2 @@ +path: /libselinux/get_default_context +tier: 1 diff --git a/libselinux/get_default_context/reproducer.py b/libselinux/get_default_context/reproducer.py new file mode 100644 index 0000000..f7770e9 --- /dev/null +++ b/libselinux/get_default_context/reproducer.py @@ -0,0 +1,18 @@ +#!/usr/bin/python3 +from selinux import get_default_context_with_rolelevel + +context='system_u:system_r:crond_t:s0-s0:c1000.c1001,c1003.c1004,c1006.c1007,c1023' +user='system_u' +role='system_r' +(ret, result) = get_default_context_with_rolelevel(user, role, None, context) + +print("Return value: ", ret) +print("Result: ", result ) + +if ret == 0: + if result and (not result.startswith("system_u:system_r:system_cronjob_t")): + print("Unexpected result: ", result) + exit(1) +else: + print("Failed to get default context!") + exit(ret) diff --git a/libselinux/get_default_context/runtest.sh b/libselinux/get_default_context/runtest.sh new file mode 100755 index 0000000..a6d626b --- /dev/null +++ b/libselinux/get_default_context/runtest.sh @@ -0,0 +1,51 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libselinux/Regression/get_default_context +# Description: Does get_default_context_with_rolelevel work as expected? +# Author: Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libselinux" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm python3-${PACKAGE} + rlRun "setenforce 1" + rlRun "sestatus" + rlPhaseEnd + + rlPhaseStartTest "#1879368" + rlRun "cat ./reproducer.py" + rlRun "./reproducer.py" 0 + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalPrintText +rlJournalEnd