diff --git a/README.md b/README.md new file mode 100644 index 0000000..31b5c7d --- /dev/null +++ b/README.md @@ -0,0 +1,26 @@ +# SELinux tests + +This repository contains set of test for SELinux kernel, userspace and policy. +Tests are written using [beakerlib](https://github.com/beakerlib/beakerlib) with [TMT Metadata Specification](https://tmt.readthedocs.io/en/latest/spec.html). + + +## Gating Guidelines +Test tiers define a test's priority for our **gating process**. + +* **`tier: 1`**: Critical tests that must pass for any code merge. +* **`tier: 2`**: Important but non-critical tests. +* **`tier: 3`**: Non-critical tests. + +All other tier metadata (e.g., `tag:Tier1`) is now deprecated. + +## Plans + + $ tmt plans + Found 5 plans: /plans/ci, /plans/reboot, /plans/tier1, /plans/tier2 and /plans/tier3. + +## Usage + +Run `tier1` on `localhost`: + + # tmt run provision -h local prepare plans -n /plans/tier1 discover execute + # tmt run -l report -h display -v diff --git a/README.rst b/README.rst deleted file mode 100644 index e69de29..0000000 diff --git a/checkpolicy/checkmodule/Makefile b/checkpolicy/checkmodule/Makefile index 4dca103..c0b1096 100644 --- a/checkpolicy/checkmodule/Makefile +++ b/checkpolicy/checkmodule/Makefile @@ -53,12 +53,17 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: checkpolicy" >> $(METADATA) - @echo "Requires: checkpolicy man grep mktemp policycoreutils policycoreutils-devel" >> $(METADATA) + @echo "Requires: checkpolicy man grep policycoreutils policycoreutils-devel" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 533796" >> $(METADATA) # RHEL-5 + @echo "Bug: 588294" >> $(METADATA) # RHEL-6 + @echo "Bug: 1064603" >> $(METADATA) # RHEL-7 + @echo "Bug: 1329217" >> $(METADATA) # RHEL-7 + @echo "Bug: 1392394" >> $(METADATA) # RHEL-6 rhts-lint $(METADATA) diff --git a/checkpolicy/checkmodule/main.fmf b/checkpolicy/checkmodule/main.fmf index 6173448..0c472de 100644 --- a/checkpolicy/checkmodule/main.fmf +++ b/checkpolicy/checkmodule/main.fmf @@ -1 +1,37 @@ -path: /checkpolicy/checkmodule +summary: runs checkmodule with various options to find out if it behaves correctly +description: |+ + This TC runs checkmodule with various options to find out if it behaves correctly. + +contact: Milos Malik +component: + - checkpolicy +test: ./runtest.sh +framework: beakerlib +recommend: + - checkpolicy + - man + - grep + - policycoreutils + - policycoreutils-devel +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - f31friendly + - f32friendly + - targeted +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533796 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=588294 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064603 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0062301 +extra-summary: /CoreOS/checkpolicy/Sanity/checkmodule +extra-task: /CoreOS/checkpolicy/Sanity/checkmodule diff --git a/checkpolicy/checkmodule/runtest.sh b/checkpolicy/checkmodule/runtest.sh old mode 100644 new mode 100755 index 590a799..0d2eb4a --- a/checkpolicy/checkmodule/runtest.sh +++ b/checkpolicy/checkmodule/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="checkpolicy" @@ -41,7 +40,7 @@ rlJournalStart rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/.*checkmodule" rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#533796 + bz#588294" rlRun "checkmodule >& ${TEST_FILE}" 1 rlAssertGrep "unable to open policy.conf" ${TEST_FILE} rlRun "checkmodule -b >& ${TEST_FILE}" 1 @@ -66,23 +65,27 @@ rlJournalStart rlRun "checkmodule ${TEST_FILE}" 1 rlRun "checkmodule -b ${TEST_FILE}" 1 if rlIsRHEL 5 ; then - rlRun "man checkmodule | col -b | grep -- -d" + if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then + rlRun "man checkmodule | col -b | grep -- -d" + fi rlRun "checkmodule --help 2>&1 | grep -- -d" fi - rlRun "man checkmodule | col -b | grep -- -h" - rlRun "man checkmodule | col -b | grep -- -U" + if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then + rlRun "man checkmodule | col -b | grep -- -h" + rlRun "man checkmodule | col -b | grep -- -U" + fi rlRun "checkmodule --help 2>&1 | grep -- -h" rlRun "checkmodule --help 2>&1 | grep -- -U" rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#1064603 + bz#1392394" for POLICY_KIND in minimum mls targeted ; do rlRun "checkmodule -M -m -b -o testmod.mod /etc/selinux/${POLICY_KIND}/policy/policy.* >& ${TEST_FILE}" 1 rlRun "grep -i \"checkmodule.*-b and -m are incompatible with each other\" ${TEST_FILE}" done rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#1329217" INPUT_FILE="mypolicy.te" OUTPUT_FILE="mypolicy.output" rlRun "ls -l ${INPUT_FILE}" @@ -95,6 +98,24 @@ rlJournalStart fi rlPhaseEnd + if ! rlIsRHEL 5 6 ; then # semodule_unpackage is not available on RHEL-5 and RHEL-6 + rlPhaseStartTest "handle unknown classes and perms" + rlRun "rm -f base.pp base.mod" + rlRun "semodule -E base" + rlRun "semodule_unpackage base.pp base.mod" + for ACTION in allow deny reject ; do + rlRun "checkmodule -b -o base.out -M -U ${ACTION} base.mod" + rlRun "echo -e 'u\nq\n' | sedismod base.out | grep -i \"${ACTION} unknown\"" + done + rlRun "checkmodule -m -o mypolicy.out -M -U deny mypolicy.te" + rlRun "ls -l mypolicy.out" + for ACTION in allow reject ; do + rlRun "checkmodule -m -o mypolicy.out -M -U ${ACTION} mypolicy.te 2>&1 | grep -i 'only valid.*base module'" + done + rlRun "rm -f base.pp base.mod base.out mypolicy.out" + rlPhaseEnd + fi + rlPhaseStartCleanup rlRun "rm -rf ${TEST_FILE} ${TEST_DIR} ${OUTPUT_FILE}" rlPhaseEnd diff --git a/checkpolicy/checkpolicy-docs/Makefile b/checkpolicy/checkpolicy-docs/Makefile index ea1a0bc..d0b165e 100644 --- a/checkpolicy/checkpolicy-docs/Makefile +++ b/checkpolicy/checkpolicy-docs/Makefile @@ -1,6 +1,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy +# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy-docs # Description: covers an issue where manpage included an unsupported option. # Author: Milos Malik # @@ -24,7 +24,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy +export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy-docs export TESTVERSION=1.0 BUILT_FILES= diff --git a/checkpolicy/checkpolicy-docs/PURPOSE b/checkpolicy/checkpolicy-docs/PURPOSE index bde34d7..ce7d2cc 100644 --- a/checkpolicy/checkpolicy-docs/PURPOSE +++ b/checkpolicy/checkpolicy-docs/PURPOSE @@ -1,4 +1,4 @@ -PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy +PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy-docs Description: covers an issue where manpage included an unsupported option. diff --git a/checkpolicy/checkpolicy-docs/main.fmf b/checkpolicy/checkpolicy-docs/main.fmf index f303b47..58021b7 100644 --- a/checkpolicy/checkpolicy-docs/main.fmf +++ b/checkpolicy/checkpolicy-docs/main.fmf @@ -1 +1,37 @@ -path: /checkpolicy/checkpolicy-docs +summary: covers an issue where manpage included an unsupported option. +description: |+ + Description: covers an issue where manpage included an unsupported option. + + Author: Milos Malik + + +contact: Milos Malik +component: + - setools + - checkpolicy +recommend: + - checkpolicy +duration: 1m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#00612804 +extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy-docs +extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy-docs +id: 8e06af12-0434-448a-aa85-9ed5c854daf9 diff --git a/checkpolicy/checkpolicy-docs/runtest.sh b/checkpolicy/checkpolicy-docs/runtest.sh old mode 100644 new mode 100755 index 83a7079..fc207c9 --- a/checkpolicy/checkpolicy-docs/runtest.sh +++ b/checkpolicy/checkpolicy-docs/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="checkpolicy" diff --git a/checkpolicy/checkpolicy/Makefile b/checkpolicy/checkpolicy/Makefile index 1ba29a4..3712630 100644 --- a/checkpolicy/checkpolicy/Makefile +++ b/checkpolicy/checkpolicy/Makefile @@ -59,6 +59,10 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 533790" >> $(METADATA) # RHEL-5 + @echo "Bug: 739866" >> $(METADATA) # RHEL-6 + @echo "Bug: 1328966" >> $(METADATA) # RHEL-7 + @echo "Bug: 1328979" >> $(METADATA) # RHEL-7 rhts-lint $(METADATA) diff --git a/checkpolicy/checkpolicy/PURPOSE b/checkpolicy/checkpolicy/PURPOSE index c60c59e..58a2359 100644 --- a/checkpolicy/checkpolicy/PURPOSE +++ b/checkpolicy/checkpolicy/PURPOSE @@ -4,4 +4,5 @@ Description: runs checkpolicy with various options to find out if it behaves cor Author: Milos Malik +This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ). diff --git a/checkpolicy/checkpolicy/main.fmf b/checkpolicy/checkpolicy/main.fmf index 0436b60..6d24ebe 100644 --- a/checkpolicy/checkpolicy/main.fmf +++ b/checkpolicy/checkpolicy/main.fmf @@ -1,2 +1,41 @@ -path: /checkpolicy/checkpolicy +summary: runs checkpolicy with various options to find out if it behaves correctly +description: |+ + Description: runs checkpolicy with various options to find out if it behaves correctly + + Author: Milos Malik + + This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ). + +contact: Milos Malik +component: + - setools + - checkpolicy +test: ./runtest.sh +framework: beakerlib +recommend: + - checkpolicy + - setools-console + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - f31friendly + - f32friendly + - targeted tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0062302 +extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy +extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh old mode 100644 new mode 100755 index 7bdfbba..059454f --- a/checkpolicy/checkpolicy/runtest.sh +++ b/checkpolicy/checkpolicy/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="checkpolicy" @@ -35,9 +34,11 @@ PACKAGE="checkpolicy" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} - rlAssertRpm selinux-policy-minimum - rlAssertRpm selinux-policy-mls - rlAssertRpm selinux-policy-targeted + if rlIsRHEL "<9" ; then + rlAssertRpm selinux-policy-minimum + fi + rlRun "rpm -qa | grep selinux-policy" + rlRun "rpm -qa | grep kernel" rlRun "uname -a" TEST_FILE=`mktemp` TEST_DIR=`mktemp -d` @@ -52,7 +53,7 @@ rlJournalStart if rlIsRHEL 5 6 ; then VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}` else - # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23" + # some versions are skipped because of BZ#1328979 VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23` fi for CUR_VERSION in ${VERSIONS} ; do @@ -67,7 +68,7 @@ rlJournalStart done rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#533790" rlRun "checkpolicy >& ${TEST_FILE}" 1 rlAssertGrep "unable to open policy.conf" ${TEST_FILE} rlRun "checkpolicy -b >& ${TEST_FILE}" 1 @@ -98,11 +99,13 @@ rlJournalStart rlRun "checkpolicy -c 0 2>&1 | grep \"value 0 not in range\"" rlRun "checkpolicy -t 2>&1 | grep \"option requires an argument\"" rlRun "checkpolicy -t xyz 2>&1 | grep -i \"unknown target platform\"" - rlRun "man checkpolicy | col -b | grep -- '-m]'" 1 + if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then + rlRun "man checkpolicy | col -b | grep -- '-m]'" 1 + fi rlRun "checkpolicy --help 2>&1 | grep -- '-m]'" 1 rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#739866" if rlIsRHEL 5 6 ; then ACTIVE_POLICY="/selinux/policy" else @@ -110,8 +113,13 @@ rlJournalStart fi rlRun "echo -e 'q\n' | checkpolicy -Mdb ${ACTIVE_POLICY} | tee ${OUTPUT_FILE}" rlRun "grep -qi -e error -e ebitmap -e 'not match' ${OUTPUT_FILE}" 1 - for POLICY_TYPE in minimum mls targeted ; do - if [ ! -e /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then + if rlIsRHEL "<9" ; then + LIST="minimum mls targeted" + else + LIST="mls targeted" + fi + for POLICY_TYPE in $LIST ; do + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then continue fi rlRun "echo -e 'q\n' | checkpolicy -Mdb /etc/selinux/${POLICY_TYPE}/policy/policy.* | tee ${OUTPUT_FILE}" @@ -119,7 +127,7 @@ rlJournalStart done rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#1328966 + bz#1328979" if rlIsRHEL 5 6 ; then ACTIVE_POLICY_TREE="/selinux" else # RHEL-7 and above @@ -127,11 +135,20 @@ rlJournalStart fi MIN_VERSION="15" MAX_VERSION=`find /etc/selinux/ -name policy.?? | cut -d / -f 6 | cut -d . -f 2 | head -n 1` - for POLICY_TYPE in minimum mls targeted ; do + if rlIsRHEL "<9" ; then + LIST="minimum mls targeted" + else + LIST="mls targeted" + fi + for POLICY_TYPE in $LIST ; do + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then + rlLog "${POLICY_TYPE} policy file is not available, skipping" + continue + fi if rlIsRHEL 5 6 ; then VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}` else - # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23" + # some versions are skipped because of BZ#1328979 VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23` fi for CUR_VERSION in ${VERSIONS} ; do @@ -147,8 +164,75 @@ rlJournalStart done rlPhaseEnd + rlPhaseStartTest "handle unknown classes and perms" + for ACTION in allow deny reject ; do + rlRun "rm -f policy.out" + rlWatchdog "checkpolicy -M -U ${ACTION} -o policy.out policy.conf.from.secilc" 15 + if [ -s policy.out ] ; then + rlRun "echo -e 'U\nq\n' | sedispol policy.out 2>&1 | tee ${OUTPUT_FILE}" + rlRun "grep -i \"${ACTION} unknown\" ${OUTPUT_FILE}" + else + rlFail "policy.out is empty or was not created" + fi + done + rlPhaseEnd + + if ! rlIsRHEL '<=8.1'; then + rlPhaseStartTest "sorting ocontexts" + # check -S option in --help + rlRun "checkpolicy --help >$OUTPUT_FILE" 0,1 + rlRun "cat $OUTPUT_FILE" + rlAssertGrep "\[-S\]" $OUTPUT_FILE + + if [ -e "/usr/share/man/man8/checkmodule.8.gz" ];then + # check -S option in man page + rlRun "PAGER=cat man checkpolicy >$OUTPUT_FILE" + rlRun "cat $OUTPUT_FILE" + rlAssertGrep "\[-S\]" $OUTPUT_FILE + fi + + # run checkpolicy with the -S option + rlWatchdog "checkpolicy -S -M -o policy.out policy.conf.from.secilc" 15 + rlRun "seinfo policy.out" + rlPhaseEnd + fi + + rlPhaseStartTest "Test checkpolicy cil option" + # check -C option without input file + rlRun "checkpolicy -C 2>&1 | grep \"unable to open policy.conf\"" + # check -C option with policy.conf file + rlRun "checkpolicy -C -M -o policy.cil policy.conf.from.secilc" + rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil + # check -C option with policy binary file + rlRun "checkpolicy -C -M -o policy.cil2 -b /sys/fs/selinux/policy" + rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil2 + rlPhaseEnd + + if rlIsRHEL '>=9' ; then + rlPhaseStartTest "Test checkpolicy optimize option" + # check -O option without input file + rlRun "checkpolicy -O 2>&1 | grep \"unable to open policy.conf\"" + # Create optimized -O binary with policy.conf file + rlRun "checkpolicy -O -M -o policy.opt policy.conf.from.secilc" + rlRun "seinfo policy.opt" + # Create regular binary with policy.conf file + rlRun "checkpolicy -M -o policy.reg policy.conf.from.secilc" + rlRun "seinfo policy.reg" + # Compare size of optimized and regular binary + OPT1=`stat -c %s policy.opt` + REG1=`stat -c %s policy.reg` + rlAssertGreater "Test if regular file size is higher than optimized file" $REG1 $OPT1 + # Compare allow rule counts between optimized and regular binary + rlRun "seinfo policy.opt > /tmp/optfile" + OPT_CNT=`grep Allow: /tmp/optfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2` + rlRun "seinfo policy.reg > /tmp/regfile" + REG_CNT=`grep Allow: /tmp/regfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2` + rlAssertGreater "Regular file has higher allow rule than optimized file" $REG_CNT $OPT_CNT + rlPhaseEnd + fi + rlPhaseStartCleanup - rm -f ${OUTPUT_FILE} policy.out + rm -f ${OUTPUT_FILE} policy.out policy.cil policy.cil2 policy.opt policy.reg /tmp/optfile /tmp/regfile rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/checkpolicy/internal-tests/main.fmf b/checkpolicy/internal-tests/main.fmf new file mode 100644 index 0000000..437b964 --- /dev/null +++ b/checkpolicy/internal-tests/main.fmf @@ -0,0 +1,28 @@ +summary: Run internal checkpolicy tests +contact: Milos Malik +component: + - checkpolicy +require: + - bison + - checkpolicy + - flex + - gcc + - libsepol-devel + - make +recommend: + - libsepol-static +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - avoidImageMode +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the test is not relevant there +extra-nitrate: TC#0620041 +id: 3df4f40d-61a0-4267-b7db-6ff9f5254406 diff --git a/checkpolicy/internal-tests/runtest.sh b/checkpolicy/internal-tests/runtest.sh new file mode 100755 index 0000000..2977950 --- /dev/null +++ b/checkpolicy/internal-tests/runtest.sh @@ -0,0 +1,58 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/checkpolicy/internal-tests +# Description: Run internal checkpolicy tests +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="checkpolicy" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + if ! rpm -q libsepol-static >& /dev/null ; then + rlRun "dnf install -y libsepol-static --enablerepo '*'" + fi + rlRun "rpm -qa | grep libsepol | sort" + rlPhaseEnd + + rlPhaseStartTest "non-fuzzing tests" + rlRun "dnf download --source ${PACKAGE}" + rlRun "rpm -ivh ${PACKAGE}-*.src.rpm" + rlRun "rm -f ${PACKAGE}-*.src.rpm" + rlRun "tar zxf ~/rpmbuild/SOURCES/${PACKAGE}-*.tar.gz" + rlRun "pushd ${PACKAGE}-*" + rlRun "make test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf ~/rpmbuild ${PACKAGE}-*" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/checkpolicy/oom-compiler-failure/PURPOSE b/checkpolicy/oom-compiler-failure/PURPOSE new file mode 100644 index 0000000..2c3a537 --- /dev/null +++ b/checkpolicy/oom-compiler-failure/PURPOSE @@ -0,0 +1,21 @@ +PURPOSE of /CoreOS/checkpolicy/Regression/oom-compiler-failure +Author: Petr Matyas + +Description: checkpolicy and checkmodule must fail cleanly under OOM conditions + +When a policy compiler (checkpolicy, checkmodule) encounters a memory +allocation failure mid-compilation it must abort and return a non-zero exit +status. It must not write a partial or otherwise incorrect output binary, +which could be silently loaded by semodule and corrupt the running policy. + +The test constrains the virtual address space of the compiler subprocess to +8 MB using "ulimit -v", which is below the minimum required to compile a real +targeted policy binary but above the threshold needed to load shared libraries +and start execution. Two compilers are exercised: + + checkpolicy -b (recompiling the active kernel policy binary) + checkmodule -b (recompiling the base module extracted from the policy store) + +Assertions for each compiler: + 1. Exit status is non-zero. + 2. The output file was not created or is empty. diff --git a/checkpolicy/oom-compiler-failure/main.fmf b/checkpolicy/oom-compiler-failure/main.fmf new file mode 100644 index 0000000..bbc0491 --- /dev/null +++ b/checkpolicy/oom-compiler-failure/main.fmf @@ -0,0 +1,18 @@ +summary: checkpolicy and checkmodule must fail cleanly under OOM conditions +description: |+ + Simulate an out-of-memory condition by capping the virtual address space of + the compiler subprocess with ulimit -v. Verify that both checkpolicy and + checkmodule exit with a non-zero status and do not produce an output binary + when memory is exhausted during compilation. + +contact: Petr Matyas +component: + - checkpolicy +test: ./runtest.sh +framework: beakerlib +require: + - checkpolicy + - policycoreutils +enabled: true +tier: 2 +id: 4afebe54-b8f3-41d0-b9bc-91d46d436236 diff --git a/checkpolicy/oom-compiler-failure/runtest.sh b/checkpolicy/oom-compiler-failure/runtest.sh new file mode 100755 index 0000000..46c242e --- /dev/null +++ b/checkpolicy/oom-compiler-failure/runtest.sh @@ -0,0 +1,86 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/checkpolicy/Regression/oom-compiler-failure +# Description: checkpolicy and checkmodule must fail cleanly under OOM +# Author: Petr Matyas +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="checkpolicy" + +# Virtual memory limit in KB applied to each compiler subprocess. +# 8 MB is below the minimum needed to parse a real targeted policy binary +# but above the minimum for the process to load its shared libraries and +# start executing. Validated against checkpolicy 3.x on RHEL-10. +MEM_LIMIT_KB=8192 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm policycoreutils + rlAssertExists "/usr/bin/checkpolicy" + rlAssertExists "/usr/bin/checkmodule" + rlAssertExists "/usr/bin/semodule_unpackage" + + # Locate the active compiled policy on disk. + POLICY_BINARY=$(find /etc/selinux/ -name "policy.*" -type f | head -1) + rlAssertExists "${POLICY_BINARY}" + rlLog "Using policy binary: ${POLICY_BINARY}" + + # Extract the base module binary so checkmodule can compile it back. + # semodule_unpackage accepts .pp and writes separate .mod and .fc files. + rlRun "semodule -E base" 0 "Extract base.pp from the active policy store" + rlAssertExists "base.pp" + rlRun "semodule_unpackage base.pp base.mod base.fc" 0 "Unpack base.pp into base.mod" + rlAssertExists "base.mod" + rlLog "base.mod size: $(stat -c %s base.mod) bytes" + rlPhaseEnd + + rlPhaseStartTest "checkpolicy fails without producing output under OOM" + rlRun "rm -f policy.oom" + # Run checkpolicy in a child process whose virtual address space is + # capped. exec replaces the shell so ulimit applies only to checkpolicy + # itself, leaving the test harness unaffected. + rlRun -s "bash -c 'ulimit -v ${MEM_LIMIT_KB}; exec checkpolicy -b -M -o policy.oom ${POLICY_BINARY}'" 1-255 \ + "checkpolicy must exit non-zero when memory is exhausted" + rlLog "checkpolicy output: $(cat ${rlRun_LOG})" + rlRun "test ! -s policy.oom" 0 \ + "checkpolicy must not produce an output binary under OOM" + rlPhaseEnd + + rlPhaseStartTest "checkmodule fails without producing output under OOM" + rlRun "rm -f base.oom" + rlRun -s "bash -c 'ulimit -v ${MEM_LIMIT_KB}; exec checkmodule -b -M -o base.oom base.mod'" 1-255 \ + "checkmodule must exit non-zero when memory is exhausted" + rlLog "checkmodule output: $(cat ${rlRun_LOG})" + rlRun "test ! -s base.oom" 0 \ + "checkmodule must not produce an output binary under OOM" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f policy.oom base.oom base.pp base.mod base.fc" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/checkpolicy/sedismod/main.fmf b/checkpolicy/sedismod/main.fmf index 05e7b34..a9ad051 100644 --- a/checkpolicy/sedismod/main.fmf +++ b/checkpolicy/sedismod/main.fmf @@ -1 +1,31 @@ -path: /checkpolicy/sedismod +summary: Does sedismod work correctly? +description: |+ + Does sedismod work correctly? + +contact: Milos Malik +component: + - checkpolicy +recommend: + - checkpolicy + - selinux-policy-targeted + - expect + - policycoreutils + - psmisc +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted +tier: 2 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0518635 +extra-summary: /CoreOS/checkpolicy/Sanity/sedismod +extra-task: /CoreOS/checkpolicy/Sanity/sedismod diff --git a/checkpolicy/sedismod/runtest.sh b/checkpolicy/sedismod/runtest.sh index 8f86e9e..27de54e 100755 --- a/checkpolicy/sedismod/runtest.sh +++ b/checkpolicy/sedismod/runtest.sh @@ -27,12 +27,11 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="checkpolicy" # TODO: repeat for all policy modules that are installed under /etc/selinux -if rlIsFedora ; then +if rlIsFedora || rlIsCentOS ; then POLICY_FILE="`find /var/lib/selinux/targeted -type d -name base`/hll" elif rlIsRHEL '<7.3' ; then POLICY_FILE=`find /etc/selinux/targeted -type f -name base.pp` @@ -44,7 +43,7 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} OUTPUT_FILE=`mktemp` - if rlIsRHEL '>=7.3' || rlIsFedora ; then + if rlIsRHEL '>=7.3' || rlIsCentOS || rlIsFedora ; then rlRun "semodule -H -E base" else rlRun "cp ${POLICY_FILE} ./base.pp.bz2" @@ -75,6 +74,18 @@ rlJournalStart done rlPhaseEnd + if sedismod --help | grep -q actions ; then + rlPhaseStartTest "test the non-interactive actions" + rlLog "introduced in version 3.6" + for ACTION in 1 2 3 4 5 6 7 8 9 0 a b c u F v ; do + rlRun "sedismod -a ${ACTION} ${POLICY_FILE} > ${ACTION}.txt" + rlRun "ls -l ${ACTION}.txt" + rlRun "test -s ${ACTION}.txt" + rlRun "rm -f ${ACTION}.txt" + done + rlPhaseEnd + fi + rlPhaseStartCleanup rlRun "rm -f ${OUTPUT_FILE} ${POLICY_FILE}" rlPhaseEnd diff --git a/checkpolicy/sedispol/main.fmf b/checkpolicy/sedispol/main.fmf index 840a2e0..829c255 100644 --- a/checkpolicy/sedispol/main.fmf +++ b/checkpolicy/sedispol/main.fmf @@ -1 +1,31 @@ -path: /checkpolicy/sedispol +summary: Does sedispol work correctly? +description: |+ + Does sedispol work correctly? + +contact: Milos Malik +component: + - checkpolicy +recommend: + - checkpolicy + - selinux-policy + - expect +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - f31friendly + - f32friendly + - targeted +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1303696 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1337890 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0518626 +extra-summary: /CoreOS/checkpolicy/Sanity/sedispol +extra-task: /CoreOS/checkpolicy/Sanity/sedispol +id: bbeea40d-d503-4862-91ee-3bb1b71b7baa diff --git a/checkpolicy/sedispol/runtest.sh b/checkpolicy/sedispol/runtest.sh index 5ed441b..e785220 100755 --- a/checkpolicy/sedispol/runtest.sh +++ b/checkpolicy/sedispol/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="checkpolicy" @@ -65,10 +64,23 @@ rlJournalStart rlRun "grep AVTAB ${OUTPUT_FILE}" rlRun "grep AVTAG ${OUTPUT_FILE}" 1 rlRun "echo -en 'u\nq\n' | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}" - rlRun "grep permissions ${OUTPUT_FILE}" + rlRun "grep permisions ${OUTPUT_FILE}" 1 + rlRun "echo -en 'U\nq\n' | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}" rlRun "grep permisions ${OUTPUT_FILE}" 1 rlPhaseEnd + if sedispol --help | grep -q actions ; then + rlPhaseStartTest "test the non-interactive actions" + rlLog "introduced in version 3.6" + for ACTION in 1 2 3 4 5 6 8 c b C r t a p u U F ; do + rlRun "sedispol -a ${ACTION} ${POLICY_FILE} > ${ACTION}.txt" + rlRun "ls -l ${ACTION}.txt" + rlRun "test -s ${ACTION}.txt" + rlRun "rm -f ${ACTION}.txt" + done + rlPhaseEnd + fi + rlPhaseStartCleanup rlRun "rm -f ${OUTPUT_FILE}" rlPhaseEnd diff --git a/kernel/CVE-2025-71085/.gitignore b/kernel/CVE-2025-71085/.gitignore new file mode 100644 index 0000000..6263bf3 --- /dev/null +++ b/kernel/CVE-2025-71085/.gitignore @@ -0,0 +1 @@ +reproducer diff --git a/kernel/CVE-2025-71085/main.fmf b/kernel/CVE-2025-71085/main.fmf new file mode 100644 index 0000000..69e25f5 --- /dev/null +++ b/kernel/CVE-2025-71085/main.fmf @@ -0,0 +1,35 @@ +summary: Test for CVE-2025-71085 +description: | + Runs the reproducer for CVE-2025-71085 (taken from the original commit + message). +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - netlabel_tools + - gcc +duration: 5m +tier: 2 +check: + # The reproducer triggers a kernel BUG when the bug is present, so turn + # on the dmesg check. + - dmesg +enabled: true +link: + - relates: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83 + - verifies: https://issues.redhat.com/browse/RHEL-143531 + - verifies: https://issues.redhat.com/browse/RHEL-143532 + - verifies: https://issues.redhat.com/browse/RHEL-143533 + - verifies: https://issues.redhat.com/browse/RHEL-143534 + - verifies: https://issues.redhat.com/browse/RHEL-143535 + - verifies: https://issues.redhat.com/browse/RHEL-143541 + - verifies: https://issues.redhat.com/browse/RHEL-143542 + - verifies: https://issues.redhat.com/browse/RHEL-143543 + - verifies: https://issues.redhat.com/browse/RHEL-143544 + - verifies: https://issues.redhat.com/browse/RHEL-143545 + - verifies: https://issues.redhat.com/browse/RHEL-143546 + - verifies: https://issues.redhat.com/browse/RHEL-143547 + - verifies: https://issues.redhat.com/browse/RHEL-143548 + - verifies: https://issues.redhat.com/browse/RHEL-143551 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2429026 diff --git a/kernel/CVE-2025-71085/reproducer.c b/kernel/CVE-2025-71085/reproducer.c new file mode 100644 index 0000000..29f0dae --- /dev/null +++ b/kernel/CVE-2025-71085/reproducer.c @@ -0,0 +1,48 @@ +/* SPDX-License-Identifier: GPLv2 */ +/* + * Copyright (c) 2026 Red Hat, Inc. + * Author: Ondrej Mosnacek + * Taken from: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83 + * (Additional copyright/authorship might apply.) + */ + +#include + +#include +#include + +int main(int argc, char **argv) +{ + int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP); + + // setup msghdr + int cmsg_size = 2; + int cmsg_len = 0x60; + struct msghdr msg; + struct sockaddr_in6 dest_addr; + struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr) + cmsg_len); + msg.msg_name = &dest_addr; + msg.msg_namelen = sizeof(dest_addr); + msg.msg_iov = NULL; + msg.msg_iovlen = 0; + msg.msg_control = cmsg; + msg.msg_controllen = cmsg_len; + msg.msg_flags = 0; + + // setup sockaddr + dest_addr.sin6_family = AF_INET6; + dest_addr.sin6_port = htons(31337); + dest_addr.sin6_flowinfo = htonl(31337); + dest_addr.sin6_addr = in6addr_loopback; + dest_addr.sin6_scope_id = 31337; + + // setup cmsghdr + cmsg->cmsg_len = cmsg_len; + cmsg->cmsg_level = IPPROTO_IPV6; + cmsg->cmsg_type = IPV6_HOPOPTS; + char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr); + hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80 + + sendmsg(fd, &msg, 0); + return 0; +} diff --git a/kernel/CVE-2025-71085/runtest.sh b/kernel/CVE-2025-71085/runtest.sh new file mode 100755 index 0000000..1835976 --- /dev/null +++ b/kernel/CVE-2025-71085/runtest.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2026 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print kernel version" + + rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer" + + rlRun "netlabelctl calipso add pass doi:7" 0 "Set up CALIPSO" + rlRun "netlabelctl map del default" 0 "Delete default netlabel map" + rlRun "netlabelctl map add default address:0.0.0.0/0 protocol:unlbl" 0 \ + "Set unlabeled traffic by default" + rlRun "netlabelctl map add default address:::/0 protocol:unlbl" 0 \ + "Set unlabeled traffic by default" + rlRun "netlabelctl map add default address:0::1/128 protocol:calipso,7" 0 \ + "Set up CALIPSO for localhost only" + rlPhaseEnd + + rlPhaseStartTest + # Will trigger a kernel BUG in dmesg or panic when vulnerable + rlRun "./reproducer" 0 "Run the reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "netlabelctl map del default" 0 "Delete the CALIPSO map" + rlRun "netlabelctl calipso del doi:7" 0 "Unsetup CALIPSO" + rlRun "netlabelctl map add default protocol:unlbl" 0 "Re-add default netlabel map" + + rlRun "rm -f reproducer" 0 "Delete the reproducer binary" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/avc_corrupted_context/main.fmf b/kernel/avc_corrupted_context/main.fmf new file mode 100644 index 0000000..85fdb4e --- /dev/null +++ b/kernel/avc_corrupted_context/main.fmf @@ -0,0 +1,18 @@ +summary: Test SELinux labeling before initial policy load +description: | + Regression test for a bug where SELinux may have printed uninitialized + kernel memory instead of a valid source/target context in AVC denials. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - memcached + - policycoreutils +duration: 5m +tier: 2 +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1758086 +environment: + AVC_ERROR: +no_avc_check diff --git a/kernel/avc_corrupted_context/runtest.sh b/kernel/avc_corrupted_context/runtest.sh new file mode 100755 index 0000000..51bf7ee --- /dev/null +++ b/kernel/avc_corrupted_context/runtest.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + rlServiceStart memcached + rlPhaseEnd + + rlPhaseStartTest + rlRun "semodule -d memcached" 0 + rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 0 \ + "The service should be unlabeled now" + rlRun "load_policy" 0 + rlRun "semodule -e memcached" 0 + rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 1 \ + "The service shouldn't stay unlabeled" + rlRun "ps -Zp \$(pidof memcached) | grep system_r:memcached_t:s0" 0 \ + "The service should have the correct label" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "setenforce 0" 0 # service may be unlabeled + rlServiceStop memcached + rlRun "setenforce 1" 0 + rlServiceRestore memcached + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/avc_log_actual_context_if_invalid/main.fmf b/kernel/avc_log_actual_context_if_invalid/main.fmf new file mode 100644 index 0000000..222785b --- /dev/null +++ b/kernel/avc_log_actual_context_if_invalid/main.fmf @@ -0,0 +1,32 @@ +summary: Test logging of actual context in AVCs if it is invalid +description: | + Verify that SELinux logs the actual source/target context in a separate + AVC record field in case it is invalid. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy + - attr + - audit + - libselinux-utils + - policycoreutils + - selinux-policy +duration: 15m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-8.1 + because: RHEL-8.0 and below is not expected to support this +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1670039 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719666 +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail diff --git a/kernel/avc_log_actual_context_if_invalid/runtest.sh b/kernel/avc_log_actual_context_if_invalid/runtest.sh new file mode 100755 index 0000000..4ae5531 --- /dev/null +++ b/kernel/avc_log_actual_context_if_invalid/runtest.sh @@ -0,0 +1,101 @@ +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +EXE4="reproducer4" +EXE6="reproducer6" +PORT=8000 + +UNLABELED_CONTEXT="system_u:object_r:unlabeled_t:s0" +INVALID_TCONTEXT="system_u:object_r:banana_t:s0" +INVALID_SCONTEXT="system_u:system_r:tor_t:s0" +INVALID_SCONTEXT_MODULE="tor" + +GARBAGE_TCONTEXT="kuřecí řízek" +GARBAGE_TCONTEXT_AUDIT="6B75C5996563C3AD20C599C3AD7A656B" + +rlJournalStart + rlPhaseStartSetup + rlImport "selinux-policy/common" # for audit daemon handling + + rlRun "uname -r" 0 "Print running kernel version" + + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + old_enforce=$(getenforce) + rlLog "Backing up SELinux status: $old_enforce" + rlRun "setenforce 0" 0 "Switching to permissive" + rlPhaseEnd + + # helper function for subtests: + function check_avcs() { + local field_main="$1" + local field_raw="$2" + local invalid_ctx="$3" + + rlRun "LANG=en_US ausearch --input-logs -ts $audit_ts --raw -m AVC | \ + grep -E '^type=AVC .* $field_main=$UNLABELED_CONTEXT' \ + >tmpavcs" 0 "Collect AVCs" + + unlabeled_avcs=$(cat tmpavcs | wc -l) + unlabeled_avcs_with_rawcon=$(cat tmpavcs | \ + grep " $field_raw=$invalid_ctx" | wc -l) + rlAssertEquals "Check that all AVCs with $field_main=unlabeled have $field_raw= with the correct label" \ + $unlabeled_avcs $unlabeled_avcs_with_rawcon + rlRun "cat tmpavcs" 0 "Print checked AVCs" + } + + rlPhaseStartTest "trawcon" + rlRun "touch foo" 0 "Creating the foo test file" + rlRun "setfattr -n security.selinux -v $INVALID_TCONTEXT foo" 0 \ + "Setting SELinux xattr of foo to an invalid value" + + audit_ts="$(date +'%x %T')"; sleep 1.1 + rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \ + "Generating AVCs with invalid tcontext" + check_avcs tcontext trawcon "\"$INVALID_TCONTEXT\"" + rlPhaseEnd + + rlPhaseStartTest "trawcon-garbage" + rlRun "touch foo" 0 "Creating the foo test file" + rlRun "setfattr -n security.selinux -v '$GARBAGE_TCONTEXT' foo" 0 \ + "Setting SELinux xattr of foo to a garbage value" + + sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1 + rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \ + "Generating AVCs with invalid tcontext" + check_avcs tcontext trawcon "$GARBAGE_TCONTEXT_AUDIT" + rlPhaseEnd + + rlPhaseStartTest "srawcon" + function gen_scontext_unlabeled_avc() { + local fifo="$1" + + # Start bash with tor label, then make it invalid, + # and try to do something under the invalid label: + runcon "$INVALID_SCONTEXT" \ + bash -c "cat $fifo > /dev/null; /dev/null" & + semodule -d "$INVALID_SCONTEXT_MODULE" + echo go! >$fifo + wait %1 + semodule -e "$INVALID_SCONTEXT_MODULE" + } + + sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1 + rlRun "mkfifo tmpfifo" 0 + rlRun "gen_scontext_unlabeled_avc tmpfifo" 0 \ + "Generating AVCs with invalid scontext" + check_avcs scontext srawcon "\"$INVALID_SCONTEXT\"" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "setenforce $old_enforce" 0 "Restoring SELinux status" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/avc_tracepoint/Makefile b/kernel/avc_tracepoint/Makefile new file mode 100644 index 0000000..e266c68 --- /dev/null +++ b/kernel/avc_tracepoint/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: perf" + +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/kernel/avc_tracepoint/main.fmf b/kernel/avc_tracepoint/main.fmf new file mode 100644 index 0000000..e0794c8 --- /dev/null +++ b/kernel/avc_tracepoint/main.fmf @@ -0,0 +1,30 @@ +summary: Basic test for SELinux AVC tracepoint support +description: | + Tests basic functionality of the built-in kernel tracepoint for audited + SELinux denials that has been introduced in kernel v5.10. + + See also: + https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd8166212d9a2eca3181567c953d5687aea4d7dc +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- perf +duration: 5m +tier: 2 +enabled: true +adjust+: +- enabled: false + when: distro < rhel-8.5 + because: RHEL-8.5 and below are not expected to support this +- enabled: false + when: distro < fedora-35 + because: This feature may not be available in kernels in F34 and below +link: +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954024 +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail diff --git a/kernel/avc_tracepoint/runtest.sh b/kernel/avc_tracepoint/runtest.sh new file mode 100755 index 0000000..2700548 --- /dev/null +++ b/kernel/avc_tracepoint/runtest.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + rlPhaseEnd + + rlPhaseStartTest + rlAssertExists /sys/kernel/tracing/events/avc/selinux_audited/enable + rlRun "perf list | grep avc:selinux_audited" + rlRun "perf record -o perf.data -e avc:selinux_audited -g \ + runcon system_u:system_r:kernel_t:s0 echo" 0-255 + rlRun "perf script -i perf.data" + rlAssertGreater "'perf script' output should have more than 0 lines" \ + "$(perf script -i perf.data | wc -l)" "0" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f perf.data" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf b/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf new file mode 100644 index 0000000..1d3922d --- /dev/null +++ b/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf @@ -0,0 +1,22 @@ +summary: Regression test for bogus WARNING in SELinux +description: | + Verify that selinux_ima_measure_state() doesn't trigger a bogus + lock-related WARN_ON() when the mutex is held by another task. +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- policycoreutils +duration: 5m +tier: 2 +enabled: true +adjust+: +- enabled: false + when: distro < fedora-36 + because: some kernels on Fedora 35 and below don't have the fix +- enabled: false + when: distro < rhel-9.1 + because: not expected to be fixed earlier than RHEL-9.1 +link: +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2050966 diff --git a/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh b/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh new file mode 100755 index 0000000..061b9c7 --- /dev/null +++ b/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function trigger_the_bug() { + while true; do echo 0 > /sys/fs/selinux/checkreqprot; done & + while true; do load_policy; done & + + sleep 15s + + kill $(jobs -p) + wait $(jobs -p) + return 0 +} + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Show the running kernel version" + rlPhaseEnd + + rlPhaseStartTest + rlRun "trigger_the_bug" 0 "Run the reproducer" + rlRun "dmesg | grep -E 'WARNING:.*selinux_ima_measure_state'" 1 \ + "Check that dmesg doesn't contain relevant WARNING lines" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/connect_AF_UNSPEC/main.fmf b/kernel/connect_AF_UNSPEC/main.fmf new file mode 100644 index 0000000..6cc8d77 --- /dev/null +++ b/kernel/connect_AF_UNSPEC/main.fmf @@ -0,0 +1,25 @@ +summary: Test connect(AF_UNSPEC) behavior +description: | + Ensure that connect(AF_UNSPEC) (should disconnect a connected socket) + works correctly under SELinux. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - gcc + - nc + - strace +duration: 5m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro ~< rhel-8.1 + because: RHEL-8.0 is not expected to have the bug fixed + - enabled: false + when: distro ~< rhel-7.9 + because: RHEL-7.8 and below are not expected to have the bug fixed +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1707828 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1886305 diff --git a/kernel/connect_AF_UNSPEC/reproducer4.c b/kernel/connect_AF_UNSPEC/reproducer4.c new file mode 100644 index 0000000..def3f57 --- /dev/null +++ b/kernel/connect_AF_UNSPEC/reproducer4.c @@ -0,0 +1,46 @@ +#include +#include + +#include + +#include +#include +#include +#include + +int main(int argc, char **argv) +{ + int fd; + struct sockaddr_in addr; + struct sockaddr addr_unspec; + + if (argc < 2) + return 2; + + fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + if (fd < 0) { + perror(argv[0]); + return 1; + } + + addr.sin_family = AF_INET; + addr.sin_port = htons(atoi(argv[1])); + addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); + + if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { + perror(argv[0]); + close(fd); + return 1; + } + + memset(&addr_unspec, 0, sizeof(addr_unspec)); + addr_unspec.sa_family = AF_UNSPEC; + if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) { + perror(argv[0]); + close(fd); + return 1; + } + + close(fd); + return 0; +} diff --git a/kernel/connect_AF_UNSPEC/reproducer6.c b/kernel/connect_AF_UNSPEC/reproducer6.c new file mode 100644 index 0000000..169ed52 --- /dev/null +++ b/kernel/connect_AF_UNSPEC/reproducer6.c @@ -0,0 +1,47 @@ +#include +#include + +#include + +#include +#include +#include +#include + +int main(int argc, char **argv) +{ + int fd; + struct sockaddr_in6 addr; + struct sockaddr addr_unspec; + + if (argc < 2) + return 2; + + fd = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP); + if (fd < 0) { + perror(argv[0]); + return 1; + } + + memset(&addr, 0, sizeof(addr)); + addr.sin6_family = AF_INET6; + addr.sin6_port = htons(atoi(argv[1])); + addr.sin6_addr = (struct in6_addr)IN6ADDR_LOOPBACK_INIT; + + if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { + perror(argv[0]); + close(fd); + return 1; + } + + memset(&addr_unspec, 0, sizeof(addr_unspec)); + addr_unspec.sa_family = AF_UNSPEC; + if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) { + perror(argv[0]); + close(fd); + return 1; + } + + close(fd); + return 0; +} diff --git a/kernel/connect_AF_UNSPEC/runtest.sh b/kernel/connect_AF_UNSPEC/runtest.sh new file mode 100755 index 0000000..99f4ed2 --- /dev/null +++ b/kernel/connect_AF_UNSPEC/runtest.sh @@ -0,0 +1,39 @@ +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +EXE4="reproducer4" +EXE6="reproducer6" +PORT=8000 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + + rlRun "gcc -o $EXE4 reproducer4.c" 0 "Compile the IPv4 reproducer" + rlRun "gcc -o $EXE6 reproducer6.c" 0 "Compile the IPv6 reproducer" + rlRun "nc -4lk $PORT &" 0 "Start IPv4 server" + rlRun "nc -6lk $PORT &" 0 "Start IPv6 server" + rlPhaseEnd + + rlPhaseStartTest "IPv4" + rlRun "strace ./$EXE4 $PORT" 0 "Run the IPv4 reproducer" + rlPhaseEnd + + rlPhaseStartTest "IPv6" + rlRun "strace ./$EXE6 $PORT" 0 "Run the IPv6 reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $EXE4" 0 "Removing the IPv4 reproducer binary" + rlRun "rm -f $EXE6" 0 "Removing the IPv6 reproducer binary" + rlRun "kill %1" 0 "Kill the IPv4 server" + rlRun "kill %2" 0 "Kill the IPv6 server" + rlRun "wait $(jobs -p | tr '\n' ' ')" 0,143 "Wait for the servers to terminate" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/fanotify-mark-anon-pipe/.gitignore b/kernel/fanotify-mark-anon-pipe/.gitignore new file mode 100644 index 0000000..6263bf3 --- /dev/null +++ b/kernel/fanotify-mark-anon-pipe/.gitignore @@ -0,0 +1 @@ +reproducer diff --git a/kernel/fanotify-mark-anon-pipe/main.fmf b/kernel/fanotify-mark-anon-pipe/main.fmf new file mode 100644 index 0000000..da7a540 --- /dev/null +++ b/kernel/fanotify-mark-anon-pipe/main.fmf @@ -0,0 +1,21 @@ +summary: Verify no invalid denials for fanotify_mark() on an anonymous pipe +description: | + Verify that calling fanotify_mark() on an anonymous pipe just fails + with EINVAL and doesn't fail on SELinux checks earlier. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - gcc +duration: 5m +tier: 2 +check: + - how: avc +enabled: true +adjust+: + - enabled: false + when: distro < rhel-9 + because: On RHEL-8 fanotify mark is allowed on anonymous pipes. +link: + - verifies: https://issues.redhat.com/browse/RHEL-53850 diff --git a/kernel/fanotify-mark-anon-pipe/reproducer.c b/kernel/fanotify-mark-anon-pipe/reproducer.c new file mode 100644 index 0000000..c55b17d --- /dev/null +++ b/kernel/fanotify-mark-anon-pipe/reproducer.c @@ -0,0 +1,66 @@ +/* SPDX-License-Identifier: GPLv2 */ +/* Copyright (c) 2026 Red Hat, Inc. */ +/* Author: Ondrej Mosnacek */ + +#define _GNU_SOURCE + +#include +#include +#include + +#include +#include + +#include + +int main(int argc, char **argv) +{ + int ffd, ret, rc, pfd[2]; + + ret = pipe2(pfd, O_CLOEXEC); + if (ret == -1) { + perror("pipe2"); + rc = 2; + goto exit; + } + + ffd = fanotify_init(FAN_CLASS_NOTIF, O_RDONLY); + if (ffd == -1) { + perror("fanotify_init"); + rc = 2; + goto exit_close_pipes; + } + + rc = 0; + + ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MOUNT, FAN_ACCESS, + pfd[0], NULL); + if (ret == 0) { + printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT succeeded\n"); + rc = 1; + } else if (errno == EINVAL) { + printf("PASS: fanotify_mark() with FAN_MARK_MOUNT failed with EINVAL as expected\n"); + } else { + printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT failed with %s\n", strerror(errno)); + rc = 1; + } + + ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_FILESYSTEM, FAN_ACCESS, + pfd[0], NULL); + if (ret == 0) { + printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM succeeded\n"); + rc = 1; + } else if (errno == EINVAL) { + printf("PASS: fanotify_mark() with FAN_MARK_FILESYSTEM failed with EINVAL as expected\n"); + } else { + printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM failed with %s\n", strerror(errno)); + rc = 1; + } + + close(ffd); +exit_close_pipes: + close(pfd[0]); + close(pfd[1]); +exit: + return rc; +} diff --git a/kernel/fanotify-mark-anon-pipe/runtest.sh b/kernel/fanotify-mark-anon-pipe/runtest.sh new file mode 100755 index 0000000..16075eb --- /dev/null +++ b/kernel/fanotify-mark-anon-pipe/runtest.sh @@ -0,0 +1,25 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2026 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print kernel version" + + rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer" + rlPhaseEnd + + rlPhaseStartTest + rlRun "./reproducer" 0 "Run the reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f reproducer" 0 "Delete the reproducer binary" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/genfs_fallback/Makefile b/kernel/genfs_fallback/Makefile new file mode 100644 index 0000000..7abf97c --- /dev/null +++ b/kernel/genfs_fallback/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: policycoreutils" + +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/kernel/genfs_fallback/main.fmf b/kernel/genfs_fallback/main.fmf new file mode 100644 index 0000000..c83e5a9 --- /dev/null +++ b/kernel/genfs_fallback/main.fmf @@ -0,0 +1,29 @@ +summary: Test genfscon fallback for fs_use_xattr when no xattr support +description: | + Test that a fs_use_xattr filesystem mount falls back to genfscon when it + doesn't have xattr support. + + See also: + https://lore.kernel.org/selinux/CAFqZXNsGabHBfV36nNAVLJgEzjkBev-O3YZ1vnmXyVoaDdjiHQ@mail.gmail.com/T/ + https://lore.kernel.org/selinux/20210113123802.63563-1-omosnace@redhat.com/ +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- policycoreutils +- dosfstools +duration: 5m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-8.5 + because: RHEL-8.5 and below are not expected to support this + - enabled: false + when: distro < fedora-35 + because: This feature may not be supported on kernels in F34 and below +link: +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1899703 +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915825 +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1937297 diff --git a/kernel/genfs_fallback/runtest.sh b/kernel/genfs_fallback/runtest.sh new file mode 100755 index 0000000..3b9372a --- /dev/null +++ b/kernel/genfs_fallback/runtest.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + + rlRun "dd if=/dev/zero of=diskfile bs=4M count=1" + rlRun "mkfs.vfat diskfile" + DEVICE="$(losetup -f)" + rlRun "losetup $DEVICE diskfile" + + rlRun "echo '(fsuse xattr vfat (system_u object_r fs_t ((s0) (s0))))' >vfat_xattr.cil" + rlRun "semodule -i vfat_xattr.cil" + rlRun "mkdir /mnt/test-vfat" + rlPhaseEnd + + rlPhaseStartTest + rlRun "mount -t vfat $DEVICE /mnt/test-vfat" + rlRun "[ \"\$(secon -t -f /mnt/test-vfat)\" = dosfs_t ]" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "umount /mnt/test-vfat" 0-1 + rlRun "rmdir /mnt/test-vfat" + rlRun "semodule -r vfat_xattr" 0-1 + rlRun "rm -f vfat_xattr.cil" + + rlRun "losetup -d $DEVICE" 0-1 + rlRun "rm -f diskfile" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/getxattr_read_out_of_bounds/main.fmf b/kernel/getxattr_read_out_of_bounds/main.fmf new file mode 100644 index 0000000..0a807f2 --- /dev/null +++ b/kernel/getxattr_read_out_of_bounds/main.fmf @@ -0,0 +1,26 @@ +summary: Reproducer for an out-of-bounds read on getxattr(2) +description: | + Verifies that it is not possible to trigger an out-of-bounds read by + setting the security.selinux xattr to a value containing a null character + and then trying to read back the xattr. + + See also: https://git.kernel.org/torvalds/c/efe3de79e0b5 +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - coreutils + - policycoreutils + - attr +duration: 5m +tier: 2 +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1584307 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1595706 +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail diff --git a/kernel/getxattr_read_out_of_bounds/runtest.sh b/kernel/getxattr_read_out_of_bounds/runtest.sh new file mode 100755 index 0000000..8ae46c1 --- /dev/null +++ b/kernel/getxattr_read_out_of_bounds/runtest.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2018-2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + rlRun "touch testfile" + reset_enforcing=0 + if [ "$(getenforce)" = "Enforcing" ]; then + rlRun "setenforce 0" 0 "Switch to permissive" + reset_enforcing=1 + fi + rlPhaseEnd + + rlPhaseStartTest + rlRun "setfattr -n security.selinux -v 'a\\0aaaaaaaaaaaaaaaa' testfile" 0 \ + "Try to set a label with a null char in it" + rlRun "getfattr -e hex -n security.selinux testfile" + rlRun "getfattr -e hex -n security.selinux testfile | grep -E '0x6100[0-9a-f]+'" 1 \ + "Check for junk in the output of getfattr" + rlPhaseEnd + + rlPhaseStartCleanup + if [ "$reset_enforcing" -eq 1 ]; then + rlRun "setenforce 1" 0 "Switch back to enforcing" + fi + rlRun "rm -f testfile" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/journald_performance/main.fmf b/kernel/journald_performance/main.fmf new file mode 100644 index 0000000..310c826 --- /dev/null +++ b/kernel/journald_performance/main.fmf @@ -0,0 +1,26 @@ +summary: Test journald performance under SELinux +description: | + Regression test for a bug where systemd-journald suffered a terrible + performance overhead due to SELinux. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - perf + - util-linux + - coreutils + - perl-interpreter + - perl-open + - git-core +duration: 30m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-8.3 + because: RHEL-8.2 and below are not expected to have the bug fixed +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1733259 +tag: + - failinfedora diff --git a/kernel/journald_performance/runtest.sh b/kernel/journald_performance/runtest.sh new file mode 100755 index 0000000..a207d54 --- /dev/null +++ b/kernel/journald_performance/runtest.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +# Set this parameter to 1 to also generate a flamegraph. +GENERATE_FLAMEGRAPH="${GENERATE_FLAMEGRAPH:-0}" + +FG_URL="https://github.com/brendangregg/FlameGraph" +FG_DIR="FlameGraph" + +TARGET_SYMBOL="security_secid_to_secctx" +LIMIT="10.00%" + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlRun "git clone $FG_URL $FG_DIR" + fi + rlPhaseEnd + + rlPhaseStartTest + JOURNALD_PID=$(pidof systemd-journald) + rlLog "PID of systemd-journald is $JOURNALD_PID" + + rlRun "cat /dev/urandom | base64 | logger &" 0 \ + "Flood systemd-journald with data" + rlRun "timeout 30s perf record -o perf.data -p $(pidof systemd-journald) -g --call-graph dwarf" 124 \ + "Capture perf data on systemd-journald" + rlRun "kill %1" + + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" + fi + + rlRun "perf report -i perf.data -g none --pretty raw | grep $TARGET_SYMBOL" + PERCENT="$(perf report -g none --pretty raw | grep $TARGET_SYMBOL | \ + grep -Eo '[0-9]+\.[0-9]+%' | head -n 1)" + rlLog "Detected that $TARGET_SYMBOL took up $PERCENT of time (limit $LIMIT)." + rlRun "{ echo \$PERCENT; echo \$LIMIT; } | sort -n | tail -n 1 | grep \$LIMIT" 0 \ + "Check that time usage is within limit" + rlPhaseEnd + + rlPhaseStartCleanup + rlFileSubmit "perf.data" + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlFileSubmit "flamegraph.svg" + + rlRun "rm -rf $FG_DIR flamegraph.svg" + fi + rlRun "rm -f perf.data" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/keycreate_empty_value/main.fmf b/kernel/keycreate_empty_value/main.fmf new file mode 100644 index 0000000..d0d90da --- /dev/null +++ b/kernel/keycreate_empty_value/main.fmf @@ -0,0 +1,20 @@ +summary: Test writing empty value into /proc/self/attr/keycreate +description: | + Verifies that writing an empty value into /proc//attr/keycreate + is allowed. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - policycoreutils + - gcc +duration: 5m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-8.1 + because: RHEL-8.0 and below are not expected to have the bug fixed +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719067 diff --git a/kernel/keycreate_empty_value/reproducer.c b/kernel/keycreate_empty_value/reproducer.c new file mode 100644 index 0000000..fa09608 --- /dev/null +++ b/kernel/keycreate_empty_value/reproducer.c @@ -0,0 +1,22 @@ +#include +#include +#include +#include +#include + +int main(void) +{ + int fd, r; + + fd = open("/proc/self/attr/keycreate", O_WRONLY); + if (fd < 0) { + perror("open"); + } + + r = write(fd, "", 0); + if (r < 0) { + perror("write"); + } + + return !!r; +} diff --git a/kernel/keycreate_empty_value/runtest.sh b/kernel/keycreate_empty_value/runtest.sh new file mode 100755 index 0000000..d8a0034 --- /dev/null +++ b/kernel/keycreate_empty_value/runtest.sh @@ -0,0 +1,37 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +EXE="reproducer" + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + + enable_container=0 + if semodule -l | grep -q container; then + rlRun "semodule -d container" 0 "Disable the container module" + enable_container=1 + fi + + rlRun "gcc -o $EXE reproducer.c" 0 "Compile the reproducer" + rlPhaseEnd + + rlPhaseStartTest + rlRun "./$EXE" 0 "Run the reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $EXE" 0 "Remove the reproducer binary" + + if [ "$enable_container" -eq 1 ]; then + rlRun "semodule -e container" 0 "Re-enable the container module" + fi + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/labeled-cephfs/main.fmf b/kernel/labeled-cephfs/main.fmf index 3d3c68e..371ab50 100644 --- a/kernel/labeled-cephfs/main.fmf +++ b/kernel/labeled-cephfs/main.fmf @@ -5,6 +5,9 @@ description: | This TC verifies that CephFS security label support works as expected. duration: 30m tier: 2 -adjust: +tag: + - failinfedora + - avoidImageMode +adjust+: - enabled: false when: distro < rhel-8 diff --git a/kernel/labeling_before_policy_load/labeldump-expected.txt b/kernel/labeling_before_policy_load/labeldump-expected.txt new file mode 100644 index 0000000..da985b5 --- /dev/null +++ b/kernel/labeling_before_policy_load/labeldump-expected.txt @@ -0,0 +1,3 @@ +system_u:object_r:etc_t:s0 + +system_u:object_r:etc_t:s0 diff --git a/kernel/labeling_before_policy_load/main.fmf b/kernel/labeling_before_policy_load/main.fmf new file mode 100644 index 0000000..a0b5c9f --- /dev/null +++ b/kernel/labeling_before_policy_load/main.fmf @@ -0,0 +1,29 @@ +summary: Test SELinux labeling before initial policy load +description: | + Verifies that reading/writing SELinux labels works before the first policy + load. + + See also: + https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e3e24b42043eceb97ed834102c2d094dfd7aaa6 + https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c8e222616c7e98305bdc861db3ccac520bc29921 + https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9530a3e00459cd6eabf050133205e0e8fecbdfc7 +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - dracut + - coreutils + - policycoreutils + - attr +duration: 30m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-8.3 + because: RHEL-8.2 and below are not expected to support this +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1777525 +tag: + - reboot diff --git a/kernel/labeling_before_policy_load/module-setup.sh b/kernel/labeling_before_policy_load/module-setup.sh new file mode 100644 index 0000000..d76aa67 --- /dev/null +++ b/kernel/labeling_before_policy_load/module-setup.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +# called by dracut +check() { + return 0 +} + +# called by dracut +depends() { + return 0 +} + +# called by dracut +install() { + inst_hook pre-pivot 50 "$moddir/relabel.sh" + inst_multiple setfiles getfattr +} diff --git a/kernel/labeling_before_policy_load/relabel.sh b/kernel/labeling_before_policy_load/relabel.sh new file mode 100644 index 0000000..18c0cc6 --- /dev/null +++ b/kernel/labeling_before_policy_load/relabel.sh @@ -0,0 +1,15 @@ +#!/bin/bash + +function dumpcon() { + getfattr --only-values -n security.selinux "$@" | tr -d '\000' + echo +} + +mount -o remount,rw /sysroot +dumpcon /sysroot/etc >/sysroot/etc/labeldump +echo test > /sysroot/etc/testfile +dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump +setfiles -vF -r /sysroot \ + /sysroot/etc/selinux/targeted/contexts/files/file_contexts \ + /sysroot/etc +dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump diff --git a/kernel/labeling_before_policy_load/runtest.sh b/kernel/labeling_before_policy_load/runtest.sh new file mode 100755 index 0000000..a9ec1a5 --- /dev/null +++ b/kernel/labeling_before_policy_load/runtest.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +# Beaker compat +if [ -n "$JOBID" ] && [ -n "$TESTID" ]; then + function tmt-reboot() { rstrnt-reboot; } + TMT_REBOOT_COUNT="$REBOOTCOUNT" +fi + +rlJournalStart +if [ $TMT_REBOOT_COUNT -lt 1 ]; then + rlPhaseStartSetup "Setup" + rlRun "uname -r" 0 "Kernel version before reboot" + + rlRun "install -d /usr/lib/dracut/modules.d/97bz1777525" 0 \ + "Install dracut plugin directory for testing" + rlRun "install module-setup.sh relabel.sh /usr/lib/dracut/modules.d/97bz1777525" 0 \ + "Install dracut plugin for testing" + rlRun "dracut -f" 0 "Rebuild the initramfs" + rlRun "grubby --set-default /boot/vmlinuz-$(uname -r)" 0 \ + "Ensure the current booted kernel is the default" + if command -v zipl >/dev/null; then + rlRun "zipl" 0 "Run zipl" + fi + rlPhaseEnd + + rlPhaseStartSetup "Reboot" + tmt-reboot +fi + rlRun "uname -r" 0 "Kernel version after reboot" + rlPhaseEnd + + rlPhaseStartTest "Test" + rlLog "Test writing labels (BZ 1777525)" + rlRun "ls -lZ /etc/testfile" + rlRun "ls -lZ /etc/testfile | grep -qF ':etc_t:'" 0 \ + "Test that /etc/testfile is labeled correctly" + + rlLog "Test reading labels (BZ 1839819)" + rlRun "cat /etc/labeldump" + rlAssertNotDiffer "/etc/labeldump" labeldump-expected.txt + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f /etc/labeldump /etc/testfile" 0 "Remove test files" + rlRun "rm -rf /usr/lib/dracut/modules.d/97bz1777525" 0 \ + "Remove the dracut plugin" + rlRun "dracut -f" 0 "Rebuild the initramfs again" + if command -v zipl >/dev/null; then + rlRun "zipl" 0 "Run zipl" + fi + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/mount-options-memleak/main.fmf b/kernel/mount-options-memleak/main.fmf new file mode 100644 index 0000000..08dfec9 --- /dev/null +++ b/kernel/mount-options-memleak/main.fmf @@ -0,0 +1,19 @@ +summary: Mount options memory leak test +description: | + Test that mounting with SELinux mount options doesn't leave behind + memory leaks. +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +duration: 1h +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187402 +tag: + - reboot diff --git a/kernel/mount-options-memleak/runtest.sh b/kernel/mount-options-memleak/runtest.sh new file mode 100755 index 0000000..8d21797 --- /dev/null +++ b/kernel/mount-options-memleak/runtest.sh @@ -0,0 +1,115 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2023 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +# Beaker compat +if [ -n "$JOBID" ] && [ -n "$TESTID" ]; then + function tmt-reboot() { rstrnt-reboot; } + TMT_REBOOT_COUNT="$REBOOTCOUNT" +fi + +function installDepsYum() { + local yum="$1"; shift + + if "$yum" install --help | grep -q -- --skip-unavailable; then + "$yum" install -y --skip-unavailable $* + elif "$yum" install --help | grep -q -- --skip-broken; then + "$yum" install -y --skip-broken $* + else + for req in $*; do + if ! rpm -q --quiet --whatprovides "$req"; then + "$yum" install -y "$req" || true + fi + done + fi +} + +function installDeps() { + if type yum >/dev/null; then + installDepsYum yum "$@" + elif type dnf >/dev/null; then + installDepsYum dnf "$@" + fi +} + +rlJournalStart +if [ $TMT_REBOOT_COUNT -lt 1 ]; then + rlPhaseStartSetup + rlRun "uname -r" 0 "Print initial running kernel version" + + uname="$(uname -r)" + raw_uname="${uname%+*}" + debug_uname="${raw_uname}+debug" + echo "$uname" >"$BEAKERLIB_DIR/orig_uname" + echo "$debug_uname" >"$BEAKERLIB_DIR/debug_uname" + if [ "$uname" = "$debug_uname" ]; then + rlLog "Already running the debug kernel, nice!" + else + rlLog "Install and boot the debug kernel" + + rlRun "installDeps kernel-debug-$raw_uname" + rlRun "grubby --set-default /boot/vmlinuz-$debug_uname" + fi + + rlRun "grubby --update-kernel /boot/vmlinuz-$debug_uname --args kmemleak=on" 0 \ + "Enable kmemleak on the debug kernel" + if command -v zipl >/dev/null; then + rlRun "zipl" 0 "Run zipl" + fi + tmt-reboot +fi +if [ $TMT_REBOOT_COUNT -lt 2 ]; then + rlRun "uname -r" 0 "Print running kernel version after reboot" + rlRun "cat /proc/cmdline" 0 "Print kernel cmdline after reboot" + + rlRun "mkdir -p /mnt/test_mount" 0 \ + "Create a directory for the test mount" + rlPhaseEnd + + rlPhaseStartTest + rlRun "echo clear > /sys/kernel/debug/kmemleak" 0 \ + "Clear the kmemleak buffer" + + rlRun "mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0 tmpfs /mnt/test_mount" 0 \ + "Do a context mount" + rlRun "umount /mnt/test_mount" 0 \ + "Unmount the context mount" + + # For whatever reason this needs to be run twice... + rlRun "echo scan > /sys/kernel/debug/kmemleak" 0 \ + "Trigger a kmemleak scan" + rlRun "cat /sys/kernel/debug/kmemleak >/dev/null" 0 \ + "Dump the kmemleak buffer once" + rlRun "echo scan > /sys/kernel/debug/kmemleak" 0 \ + "Trigger a second kmemleak scan" + + rlLog "Check that /sys/kernel/debug/kmemleak is empty" + rlAssertNotDiffer /sys/kernel/debug/kmemleak /dev/null + rlRun "cat /sys/kernel/debug/kmemleak" 0 \ + "Dump the kmemleak buffer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rmdir /mnt/test_mount" 0 \ + "Remove the directory for the test mount" + uname="$(cat "$BEAKERLIB_DIR/orig_uname")" + debug_uname="$(cat "$BEAKERLIB_DIR/debug_uname")" + rlRun "grubby --update-kernel /boot/vmlinuz-$debug_uname --remove-args kmemleak=on" 0 \ + "Undo kmemleak enabling" + rlRun "grubby --set-default /boot/vmlinuz-$uname" 0 \ + "Switch the default back to the initial kernel version" + if command -v zipl >/dev/null; then + rlRun "zipl" 0 "Run zipl" + fi + tmt-reboot +fi + rlRun "uname -r" 0 \ + "Print running kernel version after cleanup reboot" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/netlabel-leaves-nops-in-packets/main.fmf b/kernel/netlabel-leaves-nops-in-packets/main.fmf new file mode 100644 index 0000000..7d13bb0 --- /dev/null +++ b/kernel/netlabel-leaves-nops-in-packets/main.fmf @@ -0,0 +1,21 @@ +summary: Netlabel shouldn't leave NOPs in IP options when removing the CIPSO option +description: | + Test that seeting netlabel to unlabeled doesn't just overwrite CIPSO + options with NOPs, but actually removes them. Some routers may drop + packets with IP options, so this is important. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +duration: 15m +tier: 2 +require: + - gcc + - netlabel_tools +enabled: true +adjust+: + - enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test +link: + - verifies: https://issues.redhat.com/browse/RHEL-30904 diff --git a/kernel/netlabel-leaves-nops-in-packets/reproducer.c b/kernel/netlabel-leaves-nops-in-packets/reproducer.c new file mode 100644 index 0000000..f3ecb69 --- /dev/null +++ b/kernel/netlabel-leaves-nops-in-packets/reproducer.c @@ -0,0 +1,179 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * A reproducer that checks that CIPSO options are cleared properly + * by NetLabel when it is configured to send unabeled traffic. + * + * Copyright (c) 2024 Red Hat, Inc. + * Author: Ondrej Mosnacek + */ +#include +#include +#include + +#include +#include +#include + +int run_test(int csock, int ssock, const struct addrinfo *clientinfo, + int tnum, size_t expected_opt_length) +{ + char byte; + struct iovec iov; + struct msghdr msg; + struct cmsghdr *cmsg; + union { + struct cmsghdr cmsghdr; + char buf[CMSG_SPACE(256)]; + } control; + int ret, i, result; + + printf("TEST #%i\n", tnum); + + byte = 0; + ret = sendto(csock, &byte, 1, 0, clientinfo->ai_addr, clientinfo->ai_addrlen); + if (ret < 0) { + perror("sendto"); + exit(2); + } + + memset(&iov, 0, sizeof(iov)); + iov.iov_base = &byte; + iov.iov_len = 1; + memset(&msg, 0, sizeof(msg)); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = &control; + msg.msg_controllen = sizeof(control); + ret = recvmsg(ssock, &msg, 0); + if (ret < 0) { + perror("recvmsg"); + exit(2); + } + for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; + cmsg = CMSG_NXTHDR(&msg, cmsg)) { + if (cmsg->cmsg_level != SOL_IP || + cmsg->cmsg_type != IP_RECVOPTS) + continue; + + if (cmsg->cmsg_len - sizeof(struct cmsghdr) > 0) { + printf(" options: "); + for (i = 0; i < cmsg->cmsg_len - sizeof(struct cmsghdr); i++) { + printf("%02x ", (unsigned)(CMSG_DATA(cmsg)[i])); + } + printf("\n"); + result = expected_opt_length == cmsg->cmsg_len - sizeof(struct cmsghdr); + goto done; + } + } + printf(" no IP options\n"); + result = expected_opt_length == 0; + +done: + if (result) + printf(" PASS\n"); + else + printf(" FAIL\n"); + return result; +} + +int main(int argc, char **argv) +{ + static const unsigned char TEST_OPTION[] = { + 1, // NOP + 158, // option type - Experimental + 5, // option length + 0x12, 0x34, 0x56, // dummy data + 1, // NOP + 134, // option type - CIPSO + 11, // option length + 0, 0, 0, 16, // DOI + 1, // tag type 1 + 5, // tag length + 0, // alignment octet + 1, // sensitivity + 0xff, // bitmap of categories + 1, // NOP + 158, // option type - Experimental + 5, // option length + 0x12, 0x34, 0x56, // dummy data + }; + static const size_t TEST_OPTION_CIPSO_OFF = 7; + static const size_t TEST_OPTION_CIPSO_LEN = 11; + + int ret, result, csock, ssock, on = 1; + struct addrinfo hints, *serverinfo, *clientinfo; + + if (argc != 3) { + fprintf(stderr, "need 2 arguments!\n"); + exit(2); + } + + memset(&hints, 0, sizeof(struct addrinfo)); + + hints.ai_family = AF_INET; + hints.ai_socktype = SOCK_DGRAM; + hints.ai_protocol = IPPROTO_UDP; + + ret = getaddrinfo(argv[1], argv[2], &hints, &clientinfo); + if (ret < 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret)); + exit(2); + } + + ret = getaddrinfo(NULL, argv[2], &hints, &serverinfo); + if (ret < 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret)); + exit(2); + } + + csock = socket(clientinfo->ai_family, clientinfo->ai_socktype, + IPPROTO_UDP); + if (csock < 0) { + perror("client socket"); + exit(2); + } + + ssock = socket(serverinfo->ai_family, serverinfo->ai_socktype, + IPPROTO_UDP); + if (ssock < 0) { + perror("server socket"); + exit(2); + } + + ret = setsockopt(ssock, SOL_IP, IP_RECVOPTS, &on, sizeof(on)); + if (ret < 0) { + perror("server setsockopt: IP_RECVOPTS"); + exit(2); + } + + if (bind(ssock, serverinfo->ai_addr, serverinfo->ai_addrlen) < 0) { + perror("server bind"); + exit(2); + } + + result = 1; + + /* TEST 1 - only CIPSO */ + ret = setsockopt(csock, SOL_IP, IP_OPTIONS, + TEST_OPTION + TEST_OPTION_CIPSO_OFF, + TEST_OPTION_CIPSO_LEN); + if (ret < 0) { + perror("client setsockopt: IP_OPTIONS"); + exit(2); + } + if (!run_test(csock, ssock, clientinfo, 1, 0)) + result = 0; + + /* TEST 2 - CIPSO surrounded by other options */ + ret = setsockopt(csock, SOL_IP, IP_OPTIONS, + TEST_OPTION, sizeof(TEST_OPTION)); + if (ret < 0) { + perror("client setsockopt: IP_OPTIONS"); + exit(2); + } + if (!run_test(csock, ssock, clientinfo, 2, + (sizeof(TEST_OPTION) - TEST_OPTION_CIPSO_LEN) + 3) & 3) + result = 0; + + return result ? 0 : 1; +} diff --git a/kernel/netlabel-leaves-nops-in-packets/runtest.sh b/kernel/netlabel-leaves-nops-in-packets/runtest.sh new file mode 100755 index 0000000..8a25ff8 --- /dev/null +++ b/kernel/netlabel-leaves-nops-in-packets/runtest.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPL-2.0 +# Copyright (c) 2024 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "gcc -o reproducer reproducer.c" 0 "Build the reproducer" + + rlRun "netlabelctl cipsov4 add pass doi:16 tags:1" 0 + rlRun "netlabelctl map del default" 0 + rlRun "netlabelctl map add default address:0.0.0.0/0 protocol:unlbl" 0 + rlRun "netlabelctl map add default address:::/0 protocol:unlbl" 0 + rlPhaseEnd + + rlPhaseStartTest + rlRun "./reproducer 127.0.0.1 9999" 0 "Run the reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f reproducer" 0 "Remove the reproducer binary" + + rlRun "netlabelctl map del default" 0 + rlRun "netlabelctl cipsov4 del doi:16" 0 + rlRun "netlabelctl map add default protocol:unlbl" 0 + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/netlabel_many_ifaces/main.fmf b/kernel/netlabel_many_ifaces/main.fmf index 4fbbffe..cfb456e 100644 --- a/kernel/netlabel_many_ifaces/main.fmf +++ b/kernel/netlabel_many_ifaces/main.fmf @@ -12,7 +12,7 @@ require: duration: 5m tier: 2 enabled: true -adjust: - enabled: false - when: distro < rhel-7 - because: RHEL-6 and below is too old... +adjust+: + - enabled: false + when: distro < rhel-8.4 + because: not fixed below RHEL 8.4... diff --git a/kernel/ocontext-race/Makefile b/kernel/ocontext-race/Makefile new file mode 100644 index 0000000..966ae43 --- /dev/null +++ b/kernel/ocontext-race/Makefile @@ -0,0 +1,6 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: attr" +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/kernel/ocontext-race/main.fmf b/kernel/ocontext-race/main.fmf new file mode 100644 index 0000000..93b7423 --- /dev/null +++ b/kernel/ocontext-race/main.fmf @@ -0,0 +1,27 @@ +summary: Regression test for ocontext kernel structure race condition +description: | + Test that a race condition around the kernel's ocontext structures + doesn't cause an incorrect label to be assigned to files/mounts. +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- attr +duration: 15m +tier: 2 +enabled: true +adjust+: +- enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test +- enabled: false + when: arch = s390x + because: No machines likely available with required HW configuration +extra-hardware: | + keyvalue = PROCESSORS >= 4 +link: +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1969344 +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2040196 +tag: + - avoidImageMode diff --git a/kernel/ocontext-race/runtest.sh b/kernel/ocontext-race/runtest.sh new file mode 100755 index 0000000..b7f49ca --- /dev/null +++ b/kernel/ocontext-race/runtest.sh @@ -0,0 +1,74 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PREFIX=/tmp/repro- +NTHREADS=8 +TRIALS=20 + +function get_file_con() { + getfattr -h --absolute-names --only-values -n security.selinux "$1" | tr -d '\000' +} + +function strip_mls() { + # strip the MLS -- mcstrans might be running, leading to different MLS + # fields than expected + sed 's/\([^:]*:[^:]*:[^:]*\):.*$/\1/g' +} + +function check_file_con() { + rlAssertEquals "Check expected context of $1" \ + "$(get_file_con "$1" | strip_mls)" \ + "$(echo "$2" | strip_mls)" +} + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + + rlRun "test \$(nproc) -ge 4" 0 "Test needs an SMP machine, otherwise it may pass regardless of the bug" + + rlRun "tmpdir=\$(mktemp -d)" 0 "Create a temporary directory" + + prefix="$tmpdir/repro-" + + for (( i = 0; i < $NTHREADS; i++ )); do + rlRun "mkdir -p \"\${PREFIX}$i\"" 0 "Create subdirectory #$i" + done + rlPhaseEnd + +for (( k = 0; k < $TRIALS; k++ )); do + rlPhaseStartTest "Trial #$k" + rlRun "load_policy" 0 "Reload SELinux policy to reset internal state" + + # NOTE: this must be ran in a single rlRun, otherwise beakerlib + # overhead decreases the chance of a race condition + rlRun " + for (( i = 0; i < $NTHREADS; i++)); do + mount -t tmpfs tmpfs \"\${PREFIX}\$i\" & + done + wait + " 0 "Create $NTHREADS tmpfs mounts at once" + + for (( i = 0; i < $NTHREADS; i++)); do + rlRun "touch \"\${PREFIX}$i/file\"" 0 "Create a file in dir #$i" + check_file_con "$PREFIX$i" "unconfined_u:object_r:user_tmp_t" + check_file_con "$PREFIX$i/file" "unconfined_u:object_r:user_tmp_t" + done + + for (( i = 0; i < $NTHREADS; i++)); do + rlRun "umount \"\${PREFIX}$i\" &" 0 "Unmount dir #$i" + done + rlPhaseEnd +done + + rlPhaseStartCleanup + rlRun "rm -rf \$tmpdir" 0 "Clean up the temporary directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/overlayfs-mmap-bugs/main.fmf b/kernel/overlayfs-mmap-bugs/main.fmf new file mode 100644 index 0000000..8ff2402 --- /dev/null +++ b/kernel/overlayfs-mmap-bugs/main.fmf @@ -0,0 +1,27 @@ +summary: Regression test for overlayfs mmap/mprotect bugs +description: | + Tests various scenarios with overlayfs and mmap/mprotect syscalls. + This also covers CVE-2026-46054. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - selinux-policy-devel + - gcc +duration: 5m +tier: 2 +enabled: true +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-127505 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-46054 + - verifies: https://redhat.atlassian.net/browse/RHEL-185115 + - verifies: https://redhat.atlassian.net/browse/RHEL-185117 + - verifies: https://redhat.atlassian.net/browse/RHEL-185118 +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +extra-nitrate: TC#0620043 +id: 2ee56bc8-01f3-4b77-8cdb-494ad9a12451 diff --git a/kernel/overlayfs-mmap-bugs/map_access.c b/kernel/overlayfs-mmap-bugs/map_access.c new file mode 100644 index 0000000..0bd4530 --- /dev/null +++ b/kernel/overlayfs-mmap-bugs/map_access.c @@ -0,0 +1,75 @@ +#include +#include + +#include + +#include +#include +#include + +int main(int argc, const char **argv) +{ + const char *file, *context; + void *ptr; + int rdonly, execmem, flags, prot, fd, ctxfd, ret; + + if (argc < 4 || argc > 5 || + (strcmp(argv[2], "RDONLY") && strcmp(argv[2], "RDWR")) || + (strcmp(argv[3], "SHARED") && strcmp(argv[3], "PRIVATE")) + ) { + fprintf(stderr, "Usage %s RDONLY|RDWR\n", argv[0]); + return EINVAL; + } + + file = argv[1]; + rdonly = strcmp(argv[2], "RDONLY") == 0; + execmem = strcmp(argv[3], "PRIVATE") == 0; + flags = strcmp(argv[3], "PRIVATE") == 0 ? MAP_PRIVATE : MAP_SHARED; + prot = PROT_READ | (!rdonly || execmem ? PROT_WRITE : 0) | (execmem ? PROT_EXEC : 0); + context = argc >= 5 ? argv[4] : NULL; + + fd = open(file, rdonly ? O_RDONLY : O_RDWR); + if (fd == -1) { + perror("open"); + return 2; + } + + /* try direct mmap */ + ptr = mmap(NULL, 1, prot, flags, fd, 0); + if (ptr == MAP_FAILED) { + perror("mmap"); + return 3; + } + munmap(ptr, 1); + + /* try mmap with PROT_NONE followed by mprotect with full access */ + ptr = mmap(NULL, 1, PROT_NONE, flags, fd, 0); + if (ptr == MAP_FAILED) { + perror("mmap PROT_NONE"); + return 4; + } + + if (context) { + ctxfd = open("/proc/self/attr/current", O_RDWR); + if (ctxfd == -1) { + perror("open"); + return 6; + } + ret = write(ctxfd, context, strlen(context)); + if (ret == -1) { + perror("write"); + return 7; + } + close(ctxfd); + } + + ret = mprotect(ptr, 1, prot); + if (ret == -1) { + perror("mprotect"); + return 5; + } + + munmap(ptr, 1); + close(fd); + return 0; +} diff --git a/kernel/overlayfs-mmap-bugs/runtest.sh b/kernel/overlayfs-mmap-bugs/runtest.sh new file mode 100755 index 0000000..1cb3ab0 --- /dev/null +++ b/kernel/overlayfs-mmap-bugs/runtest.sh @@ -0,0 +1,83 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPL-2.0 +# Copyright (c) 2025 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print current running kernel version" + + SE_USER="$(secon -u --pid $$)" + SE_ROLE="$(secon -r --pid $$)" + SE_TYPE="$(secon -t --pid $$)" + SE_MLS="$(secon -m --pid $$)" + + OVERLAYCON="$SE_USER:object_r:test_mountedfile_t:s0" + DYNTRANSCON="$SE_USER:$SE_ROLE:test_access_exploit_t:$SE_MLS" + + rlRun "gcc -o map_access map_access.c" 0 \ + "Build the test program" + rlRun "chcon -t bin_t map_access" 0 "Relabel the test program" + rlRun "make -f /usr/share/selinux/devel/Makefile test_policy.pp M4PARAM='-D TEST_ROLE=$SE_ROLE -D TEST_TYPE=$SE_TYPE'" 0 \ + "Build the test policy" + rlRun "semodule -i test_policy.pp" 0 "Load test policy" + + rlRun "mkdir lowerdir upperdir workdir mountpoint" 0 "Create test dirs" + rlRun "touch lowerdir/file_ok lowerdir/file_no_map lowerdir/file_no_read lowerdir/file_no_write" 0 \ + "Create test files" + rlRun "chcon -R -t test_lowerfile_t lowerdir workdir upperdir" + rlRun "chcon -t test_lowerfile_no_map_t lowerdir/file_no_map" + rlRun "chcon -t test_lowerfile_no_write_t lowerdir/file_no_write" + rlRun "chcon -t test_lowerfile_no_read_t lowerdir/file_no_read" + + rlRun "runcon -t test_mounter_t mount -t overlay none -o 'context=$OVERLAYCON,lowerdir=./lowerdir,upperdir=./upperdir,workdir=./workdir' ./mountpoint" 0 \ + "Mount the overlay filesystem" + + rlRun ":>/var/log/audit/audit.log; rm -f /var/log/audit/audit.log.*" 0 \ + "Clear the audit log" + rlPhaseEnd + + rlPhaseStartTest "CVE-2026-46054" + # Bug 1 + # Should get below AVC: + # avc: denied { map } for scontext=...test_mounter_t... tcontext=...test_lowerfile_no_map_t... tclass=file + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_no_map RDONLY SHARED" 3 "Test Bug 1" + + # Bug 2, result 1 + # Shouldn't get below AVC: + # avc: denied { use } for scontext=...test_access_full_t... tcontext=...test_mounter_t... tclass=fd + rlRun "setsebool domain_fd_use 0" + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED" 0 "Test Bug 2, result 1" + rlRun "setsebool domain_fd_use 1" + + # Bug 2, result 2 + # Shouldn't get below AVC: + # avc: denied { read } for scontext=...test_access_full_t... tcontext=...test_lowerfile_t... tclass=file + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED" 0 "Test Bug 2, result 2" + + # Bug 2, result 3 + # Should get below AVC: + # avc: denied { read } for scontext=...test_access_exploit_t... tcontext=...test_mountedfile_t... tclass=file + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED $DYNTRANSCON" 5 "Test Bug 2, result 3" + rlPhaseEnd + + rlPhaseStartTest "execmem regression" + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY PRIVATE" 0 "Verify no execmem denied" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "ausearch -i -m avc" 0 "Show AVC denials" + + rlRun "umount ./mountpoint" + rlRun "rm -rf lowerdir upperdir workdir mountpoint" + rlRun "semodule -r test_policy" 0 "Unload test policy" + rlRun "make -f /usr/share/selinux/devel/Makefile clean" 0 \ + "Clean the test policy" + rlRun "rm -f map_access" 0 "Remove the test program" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/overlayfs-mmap-bugs/test_policy.te b/kernel/overlayfs-mmap-bugs/test_policy.te new file mode 100644 index 0000000..73f05cc --- /dev/null +++ b/kernel/overlayfs-mmap-bugs/test_policy.te @@ -0,0 +1,106 @@ +policy_module(test_policy,1.0.0) + +type test_lowerfile_t; +files_type(test_lowerfile_t) + +type test_lowerfile_no_map_t; +files_type(test_lowerfile_no_map_t) + +type test_lowerfile_no_write_t; +files_type(test_lowerfile_no_write_t) + +type test_lowerfile_no_read_t; +files_type(test_lowerfile_no_read_t) + +type test_mountedfile_t; +files_type(test_mountedfile_t) + +type test_mounter_t; +domain_type(test_mounter_t) + +allow test_mounter_t self:capability { sys_admin dac_read_search dac_override }; + +# test_mounter_t has full access to test_lowerfile_t +manage_dirs_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) +manage_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) +manage_chr_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) +allow test_mounter_t test_lowerfile_t:file map; +# extra permission for execmem regression test +allow test_mounter_t test_lowerfile_t:file { execute }; + +# test_mounter_t can't map test_lowerfile_t +rw_files_pattern(test_mounter_t, test_lowerfile_no_map_t, test_lowerfile_no_map_t) + +# test_mounter_t can't write test_lowerfile_no_write_t +read_files_pattern(test_mounter_t, test_lowerfile_no_write_t, test_lowerfile_no_write_t) +allow test_mounter_t test_lowerfile_no_write_t:file map; + +# test_mounter_t can't read test_lowerfile_no_read_t +write_files_pattern(test_mounter_t, test_lowerfile_no_read_t, test_lowerfile_no_read_t) +allow test_mounter_t test_lowerfile_no_read_t:file map; + +allow test_mounter_t test_mountedfile_t:dir { getattr setattr }; +allow test_mounter_t test_mountedfile_t:filesystem { relabelfrom relabelto mount }; + +kernel_read_system_state(test_mounter_t) +kernel_read_proc_symlinks(test_mounter_t) +kernel_request_load_module(test_mounter_t) +kernel_search_proc(test_mounter_t) + +fs_getattr_xattr_fs(test_mounter_t) +fs_relabelfrom_xattr_fs(test_mounter_t) + +mount_entry_type(test_mounter_t) +mount_rw_pid_files(test_mounter_t) + +selinux_getattr_fs(test_mounter_t) + +files_mounton_all_mountpoints(test_mounter_t) + +# Domain with full mountedfile access +type test_access_full_t; +domain_type(test_access_full_t) + +manage_dirs_pattern(test_access_full_t, test_mountedfile_t, test_mountedfile_t) +manage_files_pattern(test_access_full_t, test_mountedfile_t, test_mountedfile_t) +allow test_access_full_t test_mountedfile_t:file map; + +corecmd_bin_entry_type(test_access_full_t) + +# Domain with lowerfile access, but no mountedfile access (exploiting Bug 2) +type test_access_exploit_t; +domain_type(test_access_exploit_t) + +manage_files_pattern(test_access_exploit_t, test_lowerfile_t, test_lowerfile_t) + +corecmd_bin_entry_type(test_access_exploit_t) + +# for dyntransition test_access_full_t -> test_access_exploit_t +allow test_access_full_t self:process { setcurrent }; +allow test_access_full_t test_access_exploit_t:process { dyntransition }; + +# extra permissions for execmem regression test +allow test_access_full_t test_mountedfile_t:file { execute }; +allow test_access_full_t self:process { execmem }; + +attribute test_domain; +typeattribute test_mounter_t test_domain; +typeattribute test_access_full_t test_domain; +typeattribute test_access_exploit_t test_domain; + +require { + type TEST_TYPE; + role TEST_ROLE; +} +allow TEST_TYPE test_domain:process transition; +role TEST_ROLE types test_domain; + +allow test_domain TEST_TYPE:fd use; +allow test_domain TEST_TYPE:fifo_file rw_inherited_fifo_file_perms; +allow test_domain TEST_TYPE:process { sigchld }; + +files_search_tmp(test_domain) + +term_use_all_terms(test_domain) + +userdom_search_user_tmp_dirs(test_domain) diff --git a/kernel/policy_load_enomem_on_new_context/main.fmf b/kernel/policy_load_enomem_on_new_context/main.fmf new file mode 100644 index 0000000..0f69dae --- /dev/null +++ b/kernel/policy_load_enomem_on_new_context/main.fmf @@ -0,0 +1,17 @@ +summary: Test that creating a new SELinux context doesn't fail during policy load +description: | + Verifies that there are no ENOMEM errors when the kernel encounters a new + SELinux context during a policy load. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - policycoreutils + - diffutils +duration: 10m +tier: 2 +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1335986 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1656787 diff --git a/kernel/policy_load_enomem_on_new_context/runtest.sh b/kernel/policy_load_enomem_on_new_context/runtest.sh new file mode 100755 index 0000000..a6c7196 --- /dev/null +++ b/kernel/policy_load_enomem_on_new_context/runtest.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2019-2022 Red Hat, Inc. +# Author: Milos Malik + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + rlPhaseEnd + + rlPhaseStartTest "bz#1335986 + bz#1656787" + rlRun "dmesg > before.txt" + rlRun "while true; do load_policy; sleep 0.1; done &" 0 \ + "Start reloading the policy in a loop" + + function runcon_loop() { + for (( i = 0; i < 1024; i++ )); do + runcon -l s0:c$i true || return 1 + done + return 0 + } + rlRun "runcon_loop" 0 "Run runcon in a loop with varying contexts" + rlRun "dmesg > after.txt" + rlRun "diff before.txt after.txt | grep -e inode_doinit_with_dentry -e context_to_sid" 1 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "kill \$(jobs -p)" 0 "Terminate background jobs" + rlRun "wait" 0 "Wait for background jobs to terminate" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/sctp_peeloff_corner_case/main.fmf b/kernel/sctp_peeloff_corner_case/main.fmf new file mode 100644 index 0000000..68b07e7 --- /dev/null +++ b/kernel/sctp_peeloff_corner_case/main.fmf @@ -0,0 +1,25 @@ +summary: Verify that two-way SCTP association setup doesn't trigger AVCs +description: | + When two SCTP endpoints try to initiate an association + simultaneously with each other, they may hit various corner cases. + This test verifies that this scenario works correctly and that the + resulting association is properly labeled (by peeling it off, which + transfers the label onto the new socket). +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - make + - gcc + - lksctp-tools-devel + - audit +duration: 10m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-8 + because: RHEL-7 and below don't have SCTP SELinux support +link: + - verifies: https://issues.redhat.com/browse/RHEL-48647 diff --git a/kernel/sctp_peeloff_corner_case/reproducer.c b/kernel/sctp_peeloff_corner_case/reproducer.c new file mode 100644 index 0000000..de6cedb --- /dev/null +++ b/kernel/sctp_peeloff_corner_case/reproducer.c @@ -0,0 +1,187 @@ +// SPDX-License-Identifier: GPLv2 +/* + * Copyright (c) 2024 Red Hat, Inc. + * Author: Ondrej Mosnacek + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include + +static const char * const TEST_PORTS[] = { "9998", "9999" }; + +#define ITERATIONS 1000 + +#define member_size(type, member) sizeof(((type *)0)->member) +#define sizeof_up_to(type, member) (offsetof(type, member) + member_size(type, member)) + +enum { + PIPE_R = 0, + PIPE_W, +}; + +int main(int argc, char **argv) +{ + int sock, psock, result, flags, index, i, pipefd[2], pipes[2][2]; + struct addrinfo hints, *info; + struct sctp_event_subscribe subscr_events; + pid_t fork_pid; + char byte = 0x41, data[1024]; + sctp_assoc_t assoc_id; + union sctp_notification *notif; + + result = pipe(pipefd); + if (result < 0) { + perror("pipe"); + return 1; + } + pipes[0][PIPE_R] = pipefd[0]; + pipes[1][PIPE_W] = pipefd[1]; + + result = pipe(pipefd); + if (result < 0) { + perror("pipe"); + return 1; + } + pipes[1][PIPE_R] = pipefd[0]; + pipes[0][PIPE_W] = pipefd[1]; + + fork_pid = fork(); + if (fork_pid < 0) { + perror("fork"); + return 1; + } + + index = !!fork_pid; + close(pipes[!index][PIPE_R]); + close(pipes[!index][PIPE_W]); + + memset(&hints, 0, sizeof(struct addrinfo)); + hints.ai_flags = AI_PASSIVE; + hints.ai_protocol = IPPROTO_SCTP; + hints.ai_family = AF_INET; + hints.ai_socktype = SOCK_SEQPACKET; + + result = getaddrinfo(NULL, TEST_PORTS[index], &hints, &info); + if (result < 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(result)); + return 1; + } + + sock = socket(info->ai_family, info->ai_socktype, info->ai_protocol); + if (sock < 0) { + perror("socket"); + return 1; + } + + result = bind(sock, info->ai_addr, info->ai_addrlen); + if (result < 0) { + perror("bind"); + return 1; + } + + if (listen(sock, SOMAXCONN)) { + perror("listen"); + return 1; + } + + memset(&subscr_events, 0, sizeof(subscr_events)); + subscr_events.sctp_association_event = 1; + result = setsockopt(sock, IPPROTO_SCTP, SCTP_EVENTS, &subscr_events, + sizeof_up_to(struct sctp_event_subscribe, + sctp_association_event)); + + memset(&hints, 0, sizeof(struct addrinfo)); + hints.ai_protocol = IPPROTO_SCTP; + hints.ai_socktype = SOCK_SEQPACKET; + + result = getaddrinfo("127.0.0.1", TEST_PORTS[!index], &hints, &info); + if (result < 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(result)); + return 1; + } + + for (i = 0; i < ITERATIONS; i++) { + printf("[%i] ITERATION %i...\n", index, i); + + /* synchronize */ + result = write(pipes[index][PIPE_W], &byte, 1); + if (result < 0) { + perror("pipe"); + return 1; + } + result = read(pipes[index][PIPE_R], &byte, 1); + if (result < 0) { + perror("pipe"); + return 1; + } + + result = connect(sock, info->ai_addr, info->ai_addrlen); + if (result < 0 && errno != EISCONN) { + perror("connect"); + return 1; + } + + /* Get assoc_id for sctp_peeloff() */ + flags = 0; + result = sctp_recvmsg(sock, data, sizeof(data), + NULL, 0, NULL, &flags); + if (result < 0) { + perror("sctp_recvmsg"); + return 1; + } + + if ((flags & (MSG_NOTIFICATION | MSG_EOR)) != (MSG_NOTIFICATION | MSG_EOR)) { + fprintf(stderr, "[%i] Invalid sctp_recvmsg response FLAGS: %x\n", index, flags); + return 1; + } + + notif = (union sctp_notification *)data; + if (notif->sn_header.sn_type != SCTP_ASSOC_CHANGE) { + fprintf(stderr, "[%i] Invalid sctp_recvmsg response type: %x\n", index, notif->sn_header.sn_type); + return 1; + } + assoc_id = notif->sn_assoc_change.sac_assoc_id; + psock = sctp_peeloff(sock, assoc_id); + if (psock < 0) { + perror("sctp_peeloff"); + return 1; + } + + data[0] = 42; + result = sctp_sendmsg(psock, data, 1, NULL, 0, + 0, 0, 0, 0, 0); + if (result < 0) { + perror("sctp_sendmsg"); + return 1; + } + + result = sctp_recvmsg(psock, data, sizeof(data), + NULL, 0, NULL, NULL); + if (result < 0) { + perror("sctp_recvmsg"); + return 1; + } + + if (data[0] != 42) { + fprintf(stderr, "[%i] Invalid sctp_recvmsg response: %d\n", index, (int)data[0]); + return 1; + } + + close(psock); + printf("[%i] ITERATION %i SUCCESS!\n", index, i); + } + close(sock); + return 0; +} diff --git a/kernel/sctp_peeloff_corner_case/runtest.sh b/kernel/sctp_peeloff_corner_case/runtest.sh new file mode 100755 index 0000000..befc319 --- /dev/null +++ b/kernel/sctp_peeloff_corner_case/runtest.sh @@ -0,0 +1,100 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2024 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function installDepsYum() { + local yum="$1"; shift + + if "$yum" install --help | grep -q -- --skip-unavailable; then + "$yum" install -y --skip-unavailable $* + elif "$yum" install --help | grep -q -- --skip-broken; then + "$yum" install -y --skip-broken $* + else + for req in $*; do + if ! rpm -q --quiet --whatprovides "$req"; then + "$yum" install -y "$req" || true + fi + done + fi +} + +function installDeps() { + if [ -e /run/ostree-booted ]; then + for item in "$@"; do + if ! rpm -q --quiet --whatprovides "$item"; then + rpm-ostree --apply-live -y install "$item" + fi + done + elif type yum >/dev/null; then + installDepsYum yum "$@" + elif type dnf >/dev/null; then + installDepsYum dnf "$@" + fi +} + +function check_avc_begin() { + sleep 1.1 + date +'%x %T' + sleep 1.1 +} + +function check_avc_end() { + marker="marker-$RANDOM" + + auditctl -m "$marker" + + for (( i = 0; i < 100; i++ )); do + if ausearch -i -m user -ts $1 2>/dev/null +component: + - kernel +framework: beakerlib +require: + - make + - gcc + - lksctp-tools-devel + - audit + - kernel-modules +recommend: + - kernel-modules-extra +duration: 10m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-8 + because: RHEL-7 and below don't have SCTP SELinux support +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2048251 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2015525 diff --git a/kernel/sctp_peer_label_bug/runtest.sh b/kernel/sctp_peer_label_bug/runtest.sh new file mode 100755 index 0000000..96973c2 --- /dev/null +++ b/kernel/sctp_peer_label_bug/runtest.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function check_avc_begin() { + sleep 1.1 + date +'%x %T' + sleep 1.1 +} + +function check_avc_end() { + marker="marker-$RANDOM" + + auditctl -m "$marker" + + for (( i = 0; i < 100; i++ )); do + if ausearch -i -m user -ts $1 2>/dev/null flag" 0 "Wait for the server to start listening" + rlRun "./sctp_bz2048251_client 127.0.0.1 9999" 0 "Run the client" + rlRun "wait" 0 "Wait for the server to exit" + + rlRun "check_avc_end \"\$audit_ts\"" 1 "Check if there are AVC denials" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f sctp_bz2048251_client sctp_bz2048251_server flag" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c b/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c new file mode 100644 index 0000000..03fbd09 --- /dev/null +++ b/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c @@ -0,0 +1,109 @@ +#include "sctp_common.h" + +static void usage(char *progname) +{ + fprintf(stderr, + "usage: %s [-v] addr port\n" + "\nWhere:\n\t" + + "-v Print context and ip options information.\n\t" + "addr IPv4 or IPv6 address (e.g. 127.0.0.1 or ::1).\n\t" + "port Port for accessing server.\n", progname); + exit(1); +} + +int main(int argc, char **argv) +{ + int opt, sock, result; + struct addrinfo hints, *serverinfo; + bool verbose = false; + struct timeval tm; + socklen_t sinlen; + struct sockaddr_storage sin; + + while ((opt = getopt(argc, argv, "v")) != -1) { + switch (opt) { + case 'v': + verbose = true; + break; + default: + usage(argv[0]); + } + } + + if ((argc - optind) != 2) + usage(argv[0]); + + memset(&hints, 0, sizeof(struct addrinfo)); + hints.ai_protocol = IPPROTO_SCTP; + hints.ai_socktype = SOCK_SEQPACKET; + + result = getaddrinfo(argv[optind], argv[optind + 1], &hints, + &serverinfo); + if (result < 0) { + fprintf(stderr, "Client getaddrinfo: %s\n", + gai_strerror(result)); + exit(2); + } + + sock = socket(serverinfo->ai_family, serverinfo->ai_socktype, + serverinfo->ai_protocol); + if (sock < 0) { + perror("Client socket"); + exit(3); + } + + /* + * These timeouts are set to test whether the peer { recv } completes + * or not when the permission is denied. + */ + tm.tv_sec = 4; + tm.tv_usec = 0; + result = setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO, &tm, sizeof(tm)); + if (result < 0) { + perror("Client setsockopt: SO_SNDTIMEO"); + exit(4); + } + + result = setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, &tm, sizeof(tm)); + if (result < 0) { + perror("Client setsockopt: SO_RCVTIMEO"); + exit(5); + } + + if (listen(sock, SOMAXCONN)) { + perror("Client listen"); + close(sock); + exit(1); + } + + /* Subscribe to assoc_id events */ + result = set_subscr_events(sock, off, on, off, off); + if (result < 0) { + perror("Client setsockopt: SCTP_EVENTS"); + return 1; + } + + result = open_assoc(sock, serverinfo->ai_addr, serverinfo->ai_addrlen, + verbose); + if (result) { + close(sock); + exit(result); + } + + result = receive_assoc(sock, &sin, &sinlen, verbose); + if (result) { + close(sock); + exit(result); + } + + result = open_assoc(sock, serverinfo->ai_addr, serverinfo->ai_addrlen, + verbose); + if (result) { + close(sock); + exit(result); + } + + close(sock); + exit(0); +} diff --git a/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c b/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c new file mode 100644 index 0000000..2af11f6 --- /dev/null +++ b/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c @@ -0,0 +1,132 @@ +#include "sctp_common.h" + +static void usage(char *progname) +{ + fprintf(stderr, + "usage: %s [-4] [-f file] [-v] port\n" + "\nWhere:\n\t" + "-4 Listen on IPv4 addresses only.\n\t" + "-f Write a line to the file when listening starts.\n\t" + " \"nopeer\" message to client, otherwise the peer context\n\t" + " will be retrieved and sent to client.\n\t" + "-v Print context and ip options information.\n\t" + "port Listening port.\n", progname); + exit(1); +} + +int main(int argc, char **argv) +{ + int opt, sock, result; + socklen_t sinlen; + struct sockaddr_storage sin; + struct addrinfo hints, *res; + char *flag_file = NULL; + bool verbose = false, ipv4 = false; + unsigned short port; + + while ((opt = getopt(argc, argv, "4f:v")) != -1) { + switch (opt) { + case '4': + ipv4 = true; + break; + case 'f': + flag_file = optarg; + break; + case 'v': + verbose = true; + break; + default: + usage(argv[0]); + } + } + + if ((argc - optind) != 1) + usage(argv[0]); + + port = atoi(argv[optind]); + if (!port) + usage(argv[0]); + + memset(&hints, 0, sizeof(struct addrinfo)); + hints.ai_flags = AI_PASSIVE; + hints.ai_protocol = IPPROTO_SCTP; + + if (ipv4) + hints.ai_family = AF_INET; + else + hints.ai_family = AF_INET6; + + /* sctp_peeloff(3) must be from 1 to Many style socket */ + hints.ai_socktype = SOCK_SEQPACKET; + + result = getaddrinfo(NULL, argv[optind], &hints, &res); + if (result < 0) { + fprintf(stderr, "Server getaddrinfo: %s\n", + gai_strerror(result)); + exit(1); + } + + sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol); + if (sock < 0) { + perror("Server socket"); + exit(1); + } + + result = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); + if (result < 0) { + perror("Server setsockopt: SO_REUSEADDR"); + close(sock); + exit(1); + } + + result = bind(sock, res->ai_addr, res->ai_addrlen); + if (result < 0) { + perror("Server bind"); + close(sock); + exit(1); + } + + if (listen(sock, SOMAXCONN)) { + perror("Server listen"); + close(sock); + exit(1); + } + + /* Subscribe to assoc_id events */ + result = set_subscr_events(sock, off, on, off, off); + if (result < 0) { + perror("Client setsockopt: SCTP_EVENTS"); + return 1; + } + + if (flag_file) { + FILE *f = fopen(flag_file, "w"); + if (!f) { + perror("Flag file open"); + exit(1); + } + fprintf(f, "listening\n"); + fclose(f); + } + + result = receive_assoc(sock, &sin, &sinlen, verbose); + if (result) { + close(sock); + exit(result); + } + + result = open_assoc(sock, (struct sockaddr *)&sin, sinlen, verbose); + if (result) { + close(sock); + exit(result); + } + + result = receive_assoc(sock, &sin, &sinlen, verbose); + if (result) { + close(sock); + exit(result); + } + + close(sock); + exit(0); +} diff --git a/kernel/sctp_peer_label_bug/sctp_common.c b/kernel/sctp_peer_label_bug/sctp_common.c new file mode 100644 index 0000000..f8c6fbf --- /dev/null +++ b/kernel/sctp_peer_label_bug/sctp_common.c @@ -0,0 +1,384 @@ +#include "sctp_common.h" + +#define member_size(type, member) sizeof(((type *)0)->member) +#define sizeof_up_to(type, member) (offsetof(type, member) + member_size(type, member)) + +void print_addr_info(struct sockaddr *sin, char *text) +{ + struct sockaddr_in *addr4; + struct sockaddr_in6 *addr6; + char addr_str[INET6_ADDRSTRLEN + 1]; + + switch (sin->sa_family) { + case AF_INET: + addr4 = (struct sockaddr_in *)sin; + inet_ntop(sin->sa_family, + (void *)&addr4->sin_addr, + addr_str, INET6_ADDRSTRLEN + 1); + printf("%s IPv4 addr %s\n", text, addr_str); + break; + case AF_INET6: + addr6 = (struct sockaddr_in6 *)sin; + if (IN6_IS_ADDR_V4MAPPED(&addr6->sin6_addr)) { + inet_ntop(AF_INET, + (void *)&addr6->sin6_addr.s6_addr32[3], + addr_str, INET6_ADDRSTRLEN + 1); + printf("%s IPv6->IPv4 MAPPED addr %s\n", + text, addr_str); + } else if (IN6_IS_ADDR_LINKLOCAL(&addr6->sin6_addr)) { + inet_ntop(sin->sa_family, + (void *)&addr6->sin6_addr, + addr_str, INET6_ADDRSTRLEN + 1); + printf("%s IPv6 local link addr %s scope_id %d\n", + text, addr_str, + ((struct sockaddr_in6 *)addr6)->sin6_scope_id); + } else { + inet_ntop(sin->sa_family, + (void *)&addr6->sin6_addr, + addr_str, INET6_ADDRSTRLEN + 1); + printf("%s IPv6 addr %s\n", text, + addr_str); + } + break; + default: + printf("%s Unknown IP family %d\n", text, sin->sa_family); + break; + } +} + +int set_subscr_events(int fd, int data_io, int assoc, int addr, int shutd) +{ + struct sctp_event_subscribe subscr_events; + + memset(&subscr_events, 0, sizeof(subscr_events)); + subscr_events.sctp_data_io_event = data_io; + subscr_events.sctp_association_event = assoc; + subscr_events.sctp_address_event = addr; + subscr_events.sctp_shutdown_event = shutd; + + /* + * Truncate optlen to just the fields we touch to avoid errors when + * the uapi headers are newer than the running kernel. + */ + return setsockopt(fd, IPPROTO_SCTP, SCTP_EVENTS, &subscr_events, + sizeof_up_to(struct sctp_event_subscribe, + sctp_shutdown_event)); +} + +/* + * Currently only SCTP_ASSOC_CHANGE, SCTP_PEER_ADDR_CHANGE and + * SCTP_SHUTDOWN_EVENT are enabled via set_subscr_events(). + */ +int handle_event(void *buf, char *cmp_addr, sctp_assoc_t *assoc_id, + bool verbose, char *text) +{ + union sctp_notification *snp = buf; + char addrbuf[INET6_ADDRSTRLEN]; + struct sockaddr_in *sin; + struct sockaddr_in6 *sin6; + const char *ap; + struct sctp_paddr_change *spc; + struct sctp_assoc_change *sac; + struct sctp_remote_error *sre; + struct sctp_send_failed *ssf; + struct sctp_authkey_event *auth_event; + + switch (snp->sn_header.sn_type) { + case SCTP_ASSOC_CHANGE: + sac = &snp->sn_assoc_change; + + if (verbose) + printf("%s SCTP_ASSOC_CHANGE event for assoc_id: %d ERR: 0x%x\n", + text, sac->sac_assoc_id, sac->sac_error); + + if (assoc_id) + *assoc_id = sac->sac_assoc_id; + break; + case SCTP_PEER_ADDR_CHANGE: + spc = &snp->sn_paddr_change; + + if (verbose) + /* + * Not all spc_error codes are errors - linux/sctp.h + * (e.g. SCTP_HEARTBEAT_SUCCESS = 0x02) + */ + printf("%s SCTP_PEER_ADDR_CHANGE event for assoc_id: %d ERR: 0x%x\n", + text, spc->spc_assoc_id, spc->spc_error); + + if (spc->spc_aaddr.ss_family == AF_INET) { + sin = (struct sockaddr_in *) &spc->spc_aaddr; + ap = inet_ntop(AF_INET, &sin->sin_addr, addrbuf, + INET6_ADDRSTRLEN); + } else { + sin6 = (struct sockaddr_in6 *) &spc->spc_aaddr; + ap = inet_ntop(AF_INET6, &sin6->sin6_addr, addrbuf, + INET6_ADDRSTRLEN); + } + if (verbose) /* Print additional address details */ + print_addr_info((struct sockaddr *)&spc->spc_aaddr, + "Peer Address change:\n\t"); + + switch (spc->spc_state) { + case SCTP_ADDR_AVAILABLE: + if (verbose) + printf("\t%s is available\n", text); + break; + case SCTP_ADDR_UNREACHABLE: + if (verbose) + printf("\t%s is not available - Error: 0x%x\n", + text, spc->spc_error); + break; + case SCTP_ADDR_REMOVED: + if (verbose) + printf("\t%s was removed\n", text); + break; + case SCTP_ADDR_ADDED: + if (verbose) + printf("\t%s was added\n", text); + break; + case SCTP_ADDR_MADE_PRIM: + if (verbose) + printf("\t%s is primary\n", text); + if (cmp_addr) { + if (!strcmp(ap, cmp_addr)) { + if (verbose) + printf("\t%s and is now the new primary\n", text); + + return EVENT_ADDR_MATCH; + } + } + break; + case SCTP_ADDR_CONFIRMED: + if (verbose) + printf("\t%s is confirmed\n", text); + break; + default: + if (verbose) + printf("%s unknown state: %d\n", text, + spc->spc_state); + break; + } + break; + case SCTP_SEND_FAILED: + ssf = &snp->sn_send_failed; + + if (verbose) + printf("%s SCTP_SEND_FAILED event assoc_id: %d ERR: 0x%x\n", + text, ssf->ssf_assoc_id, ssf->ssf_error); + break; + case SCTP_REMOTE_ERROR: + sre = &snp->sn_remote_error; + if (verbose) /* Error in network byte order - linux/sctp.h */ + printf("%s SCTP_REMOTE_ERROR event ERR: 0x%x\n", + text, ntohs(sre->sre_error)); + break; + case SCTP_SHUTDOWN_EVENT: + if (verbose) + printf("%s SCTP_SHUTDOWN_EVENT\n", text); + + return EVENT_SHUTDOWN; + case SCTP_PARTIAL_DELIVERY_EVENT: + if (verbose) + printf("%s SCTP_PARTIAL_DELIVERY_EVENT\n", text); + break; + case SCTP_ADAPTATION_INDICATION: + if (verbose) + printf("%s SCTP_ADAPTATION_INDICATION event\n", text); + break; + case SCTP_AUTHENTICATION_INDICATION: + auth_event = &snp->sn_authkey_event; + + if (verbose) { + printf("%s SCTP_AUTHENTICATION_INDICATION event\n" + "\tauth_event->auth_type: 0x%x\n" + "\tauth_event->auth_flags: 0x%x\n" + "\tauth_event->auth_length: 0x%x\n" + "\tauth_event->auth_keynumber: 0x%x\n" + "\tauth_event->auth_indication: 0x%x\n" + "\tauth_event->auth_assoc_id: %d\n", + text, auth_event->auth_type, + auth_event->auth_flags, + auth_event->auth_length, + auth_event->auth_keynumber, + auth_event->auth_indication, + auth_event->auth_assoc_id); + } + /* SCTP_AUTH_NO_AUTH defined in linux/sctp.h */ + if (auth_event->auth_indication == SCTP_AUTH_NO_AUTH) + return EVENT_NO_AUTH; + break; + case SCTP_SENDER_DRY_EVENT: + if (verbose) + printf("%s SCTP_SENDER_DRY_EVENT\n", text); + break; + case SCTP_STREAM_RESET_EVENT: + if (verbose) + printf("%s SCTP_STREAM_RESET_EVENT\n", text); + break; + case SCTP_ASSOC_RESET_EVENT: + if (verbose) + printf("%s SCTP_ASSOC_RESET_EVENT\n", text); + break; + case SCTP_STREAM_CHANGE_EVENT: + if (verbose) + printf("%s SCTP_STREAM_CHANGE_EVENT\n", text); + break; + case SCTP_SEND_FAILED_EVENT: + if (verbose) + printf("%s SCTP_SEND_FAILED_EVENT\n", text); + break; + default: + fprintf(stderr, "%s unknown event: 0x%x\n", text, + snp->sn_header.sn_type); + break; + } + + return EVENT_OK; +} + +int receive_assoc(int sock, struct sockaddr_storage *sin, socklen_t *sinlen, + int verbose) +{ + int result, peeloff_sk = 0, flags; + sctp_assoc_t assoc_id = 0; + char *peerlabel, msglabel[256]; + + *sinlen = sizeof(*sin); + flags = 0; + + result = sctp_recvmsg(sock, msglabel, sizeof(msglabel), + (struct sockaddr *)sin, sinlen, + NULL, &flags); + if (result < 0) { + perror("Server sctp_recvmsg-1"); + return 1; + } + + if (verbose) + print_addr_info((struct sockaddr *)sin, + "Server SEQPACKET recvmsg"); + + if (!(flags & MSG_NOTIFICATION) || !(flags & MSG_EOR)) { + printf("Invalid sctp_recvmsg response FLAGS: %x\n", + flags); + return 1; + } + + handle_event(msglabel, NULL, &assoc_id, + verbose, "Peeloff Server"); + if (assoc_id <= 0) { + printf("Server Invalid association ID: %d\n", + assoc_id); + return 1; + } + peeloff_sk = sctp_peeloff(sock, assoc_id); + if (peeloff_sk < 0) { + perror("Server sctp_peeloff"); + return 1; + } + if (verbose) { + printf("Server sctp_peeloff(3) on sk: %d with association ID: %d\n", + peeloff_sk, assoc_id); + } + + /* Now get the client msg on peeloff socket */ + result = sctp_recvmsg(peeloff_sk, msglabel, sizeof(msglabel), + (struct sockaddr *)sin, sinlen, + NULL, &flags); + if (result < 0) { + perror("Server sctp_recvmsg-2"); + close(peeloff_sk); + return 1; + } + + if (verbose) { + print_addr_info((struct sockaddr *)sin, + "Server SEQPACKET peeloff recvmsg"); + printf("peeloff association ID: %d\n", + assoc_id); + } + + peerlabel = strdup("nopeer"); + + printf("Server PEELOFF peer label: %s\n", peerlabel); + + result = sctp_sendmsg(peeloff_sk, peerlabel, + strlen(peerlabel), + NULL, 0, + 0, 0, 0, 0, 0); + if (result < 0) { + perror("Server sctp_sendmsg"); + close(peeloff_sk); + close(sock); + exit(1); + } + + if (verbose) + printf("Server PEELOFF sent: %s\n", peerlabel); + + free(peerlabel); + + close(peeloff_sk); + return 0; +} + +int open_assoc(int sock, struct sockaddr *sin, socklen_t sinlen, + int verbose) +{ + int result, peeloff_sk = 0, flags; + sctp_assoc_t assoc_id = 0; + char byte = 0x41, label[1024]; + + /* otherwise we might connect too fast */ + sleep(1); + + result = connect(sock, sin, sinlen); + if (result < 0) { + perror("Client connect"); + return 1; + } + + /* Get assoc_id for sctp_peeloff() */ + flags = 0; + result = sctp_recvmsg(sock, label, sizeof(label), + NULL, 0, NULL, &flags); + if (result < 0) { + perror("Client sctp_recvmsg-1"); + return 1; + } + + if ((flags & (MSG_NOTIFICATION | MSG_EOR)) != (MSG_NOTIFICATION | MSG_EOR)) { + printf("Invalid sctp_recvmsg response FLAGS: %x\n", flags); + return 1; + } + handle_event(label, NULL, &assoc_id, verbose, "Peeloff Client"); + if (assoc_id <= 0) { + printf("Client Invalid association ID: %d\n", assoc_id); + return 1; + } + + peeloff_sk = sctp_peeloff(sock, assoc_id); + if (peeloff_sk < 0) { + perror("Client sctp_peeloff"); + return 1; + } + + result = sctp_sendmsg(peeloff_sk, &byte, 1, NULL, 0, + 0, 0, 0, 0, 0); + if (result < 0) { + perror("Client sctp_sendmsg"); + close(peeloff_sk); + return 1; + } + + result = sctp_recvmsg(peeloff_sk, label, sizeof(label), + NULL, 0, NULL, NULL); + if (result < 0) { + perror("Client sctp_recvmsg"); + close(peeloff_sk); + return 1; + } + + close(peeloff_sk); + return 0; +} diff --git a/kernel/sctp_peer_label_bug/sctp_common.h b/kernel/sctp_peer_label_bug/sctp_common.h new file mode 100644 index 0000000..aeec4d2 --- /dev/null +++ b/kernel/sctp_peer_label_bug/sctp_common.h @@ -0,0 +1,38 @@ +#ifndef _GNU_SOURCE +#define _GNU_SOURCE /* For poll(2) POLLRDHUP - Detect client close(2) */ +#endif + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +enum event_ret { + EVENT_OK, + EVENT_ADDR_MATCH, + EVENT_SHUTDOWN, + EVENT_NO_AUTH +}; + +void print_addr_info(struct sockaddr *sin, char *text); +int set_subscr_events(int fd, int data_io, int assoc, int addr, int shutd); +int handle_event(void *buf, char *cmp_addr, sctp_assoc_t *assoc_id, + bool verbose, char *text); + +static const int on = 1, off = 0; + +int receive_assoc(int sock, struct sockaddr_storage *sin, socklen_t *sinlen, + int verbose); +int open_assoc(int sock, struct sockaddr *sin, socklen_t sinlen, int verbose); diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf index 358efb6..d3875ba 100644 --- a/kernel/selinux-testsuite/main.fmf +++ b/kernel/selinux-testsuite/main.fmf @@ -1,10 +1,24 @@ -path: /kernel/selinux-testsuite - summary: Wrapper for selinux-testuite description: | This TC runs a functional test suite for the LSM-based SELinux security module. -duration: 60m -tier: 2 -adjust: -- enabled: false - when: distro < rhel-5 +contact: Milos Malik +component: + - kernel + - selinux-policy +framework: beakerlib +duration: 1h +tier: 1 +enabled: true +tag: + - fusa +adjust+: + - enabled: false + when: distro < rhel-6 + - enabled: false + when: arch = i386 +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +id: f491d519-a7cd-4acf-8405-67a6afcc678a diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index a3ca98f..cefb9e1 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="24bb5c0090710767ff187f1682e5bf355166caa3" +DEFAULT_COMMIT="72e60b6018321a3da9d5e328477e29ee7366e498" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. @@ -44,7 +44,7 @@ DEFAULT_PULLS="" DEFAULT_PATCHES="" # Optional test parameter - location of testuite git. -GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"} +GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} # Optional test parameter - timeout for detecting lost packets NETWORK_TIMEOUT=${NETWORK_TIMEOUT:-4} @@ -70,27 +70,21 @@ else PIPEFAIL_DISABLE="" fi -if rlIsRHEL 5 ; then - # On RHEL-5 sort -V doesn't work, so just pretend we have the oldest kernel - function kver_ge() { false; } - function kver_lt() { true; } - function kver_le() { true; } - function kver_gt() { false; } -else - function version_le() { - { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2" - } +function version_le() { + { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2" +} - function kver_ge() { version_le "$1" "$(uname -r)"; } - function kver_lt() { ! kver_ge "$1"; } - function kver_le() { version_le "$(uname -r)" "$1"; } - function kver_gt() { ! kver_le "$1"; } -fi +function kver_ge() { version_le "$1" "$(uname -r)"; } +function kver_lt() { ! kver_ge "$1"; } +function kver_le() { version_le "$(uname -r)" "$1"; } +function kver_gt() { ! kver_le "$1"; } function installDepsYum() { local yum="$1"; shift - if "$yum" --help | grep -q -- --skip-broken; then + if "$yum" install --help | grep -q -- --skip-unavailable; then + "$yum" install -y --skip-unavailable $* + elif "$yum" install --help | grep -q -- --skip-broken; then "$yum" install -y --skip-broken $* else for req in $*; do @@ -102,7 +96,13 @@ function installDepsYum() { } function installDeps() { - if type yum >/dev/null; then + if [ -e /run/ostree-booted ]; then + for item in "$@"; do + if ! rpm -q --quiet --whatprovides "$item"; then + rpm-ostree --apply-live -y install "$item" + fi + done + elif type yum >/dev/null; then installDepsYum yum "$@" elif type dnf >/dev/null; then installDepsYum dnf "$@" @@ -121,25 +121,34 @@ function boolSet() { rlJournalStart rlPhaseStartSetup "Install" + # Determine the base kernel package name and version corresponding + # to the currently running kernel. Use this information to derive + # the correct kernel subpackages to install. + if KERNEL_CORE_NVRA="$(rpm -qf "/boot/vmlinuz-$(uname -r)")"; then + KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" + KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" + + KERNEL_PKG_VRA="${KERNEL_CORE_NVRA#$KERNEL_CORE_N-}" + KERNEL_PKG_BASE="${KERNEL_CORE_N%-core}" + + rlLog "Detected kernel package base name '$KERNEL_PKG_BASE' and version-release.arch '$KERNEL_PKG_VRA'" + KERNEL_PKGS=" + $KERNEL_PKG_BASE-modules-extra-$KERNEL_PKG_VRA + $KERNEL_PKG_BASE-devel-$KERNEL_PKG_VRA + " + else + rlLog "Detected non-RPM running kernel - no extra kernel packages will be installed" + KERNEL_PKGS="" + fi + # We need to install the kernel-* packages by ourselves, since we need # the same versions as the running kernel. And since we already need a # reliable package install function, let's just install all the # dependencies here. Thus we don't need to maintain duplicate lists of # package requirements in many places (RH repo, Fedora kernel dist-git, # CKI). - PKG_SUFFIX="" - KERNEL_VERSION="$(uname -r)" - PKG_VERSION="${KERNEL_VERSION%+debug}" - if [ "$PKG_VERSION" != "$KERNEL_VERSION" ]; then - rlLog "Detected debug kernel running." - PKG_SUFFIX="-debug" - fi - REQUIRES=" - kernel$PKG_SUFFIX-modules-extra-$PKG_VERSION - kernel-rt$PKG_SUFFIX-modules-extra-$PKG_VERSION - kernel$PKG_SUFFIX-devel-$PKG_VERSION - kernel-rt$PKG_SUFFIX-devel-$PKG_VERSION + $KERNEL_PKGS /usr/bin/unbuffer attr audit @@ -180,13 +189,12 @@ rlJournalStart rdma-core-devel selinux-policy-devel setools-console - which xfsprogs-devel " rlRun "installDeps \$REQUIRES" 0 "Install requires" # The CRB repo with libbpf-devel might not be enabled on RHEL - if rlIsRHEL '>=8'; then + if rlIsRHEL '>=8' && ! [ -e /run/ostree-booted ]; then for repo in "rhel-CRB" "beaker-CRB"; do rpm -q libbpf-devel &>/dev/null && break rlRun "dnf install --enablerepo $repo -y libbpf-devel" 0-255 @@ -198,18 +206,15 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm audit rlFileBackup /etc/selinux/semanage.conf - # running the testsuite in /tmp causes permission denied messages - # rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - # rlRun "pushd $TmpDir" + # run the testsuite in /root to avoid problems with other paths + rlRun "pushd /root" - if ! rlIsRHEL 5 ; then - # version_le() sanity check: - rlRun "version_le 4.10 4.10" - rlRun "version_le 4.10 4.10.0" - rlRun "version_le 4.10 4.10.1" - rlRun "! version_le 4.10 4.9" - rlRun "! version_le 4.10.0 4.10" - fi + # version_le() sanity check: + rlRun "version_le 4.10 4.10" + rlRun "version_le 4.10 4.10.0" + rlRun "version_le 4.10 4.10.1" + rlRun "! version_le 4.10 4.9" + rlRun "! version_le 4.10.0 4.10" if [ -d /sys/fs/selinux ]; then selinuxfs=/sys/fs/selinux @@ -258,24 +263,23 @@ rlJournalStart for pull in $GIT_PULLS; do ref="refs/pull/$pull/head" if ! rlRun "git fetch origin $ref:$ref" 0; then - rlRun "git checkout $GIT_BRANCH" 0 - rlLogWarning "PR merge failed, falling back to GIT_BRANCH" - break + rlLogFatal "PR merge failed!" + rlPhaseEnd + exit 127 fi if ! rlRun "git merge --no-edit $ref" 0; then - rlRun "git merge --abort" 0 - rlRun "git checkout $GIT_BRANCH" 0 - rlLogWarning "PR merge failed, falling back to GIT_BRANCH" - break + rlLogFatal "PR merge failed!" + rlPhaseEnd + exit 127 fi done $PIPEFAIL_ENABLE for pwseries in $GIT_PATCHES; do url="https://patchwork.kernel.org/series/$pwseries/mbox/" if ! rlRun "curl $url | git am -"; then - rlRun "git checkout $GIT_BRANCH" 0 - rlLogWarning "Applying patch failed, falling back to GIT_BRANCH" - break + rlLogFatal "Applying patch failed!" + rlPhaseEnd + exit 127 fi done $PIPEFAIL_DISABLE @@ -305,34 +309,49 @@ rlJournalStart } | rlRun "tee -a tests/tun_tap/tun_common.h" 0 \ "Harden tun_tap test against missing defs" + # needed to avoid a flood of AVCs when run via restraint + # (RHEL-6 doesn't have unconfined_service_t) + if ! rlIsRHEL '<7'; then + rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0 + rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0 + else + rlRun "sed -i '/install_t/d' policy/test_policy.if" 0 + "RHEL 6 doesn't have install_t" + fi + exclude_tests="" force_tests="" for file in ./tests/nnp*/execnnp.c; do - rlRun "sed -i 's/3.18/3.9/' $file" 0 \ + rlRun "sed -i 's/3\.18/3.9/' $file" 0 \ "Fix up kernel version in nnp test" done - if rlIsRHEL 5 ; then - rlRun "sed -i '/unconfined_devpts_t/d' policy/test_policy.if" 0 - - rlRun "sed -i 's/read_file_perms/r_file_perms/' policy/*.te" 0 - rlRun "sed -i 's/mmap_file_perms/rx_file_perms/' policy/*.te" 0 - rlRun "sed -i 's/list_dir_perms/r_dir_perms/' policy/*.te" 0 - rlRun "sed -i 's/ open / /' policy/*.te" 0 - - rlRun "sed -i 's/^sysadm_bin_spec_domtrans_to/userdom_sysadm_bin_spec_domtrans_to/' policy/*.te" 0 - - rlRun "sed -i 's/^corecmd_exec_bin(\(.*\))$/corecmd_exec_bin(\1)\ncorecmd_exec_sbin(\1)/' policy/*.te" 0 - rlRun "sed -i 's/^corecmd_bin_entry_type(\(.*\))$/corecmd_bin_entry_type(\1)\ncorecmd_sbin_entry_type(\1)/' policy/*.te" 0 - rlRun "sed -i 's/^userdom_search_user_home_dirs(\(.*\))$/userdom_search_user_home_dirs(user, \1)/' policy/*.te" 0 - fi if rlIsRHEL "<8.2"; then rlRun "sed -i '/SUBDIRS += bpf/d;/export CFLAGS += -DHAVE_BPF/d' tests/Makefile" 0 \ "RHEL < 8.2 doesn't ship libbpf => disable BPF subtests" fi + if rlIsRHEL "<9"; then + # CONFIG_KEY_DH_OPERATIONS not enabled on RHEL-8 :( + # on RHEL-7, KEYCTL_DH_COMPUTE is not defined in the header + exclude_tests+=" keys" + fi rlRun "sed -i 's/tm\.tv_sec = [0-9]*;/tm.tv_sec = $NETWORK_TIMEOUT;/' ./tests/*/*.c" 0 \ "Tweak timeout in networking tests" # 2 secs is too little for SCTP test + if [ -e /run/ostree-booted ]; then + # Fixed by https://github.com/fedora-selinux/selinux-policy/pull/2029, + # but may not be in all distro streams. + rlRun "tee -a policy/test_global.te" 0 \ + "Work around missing policy rules" <>policy/test_mmap.te <<<'allow_map(test_no_execmem_t, tmpfs_t, file)'" fi + # work around non-functional ext4 native quota support on + # RHEL-7 + if kver_lt 4.18; then + rlRun "sed -i 's/3.6/4.18/g' tests/{fs_,}filesystem/test" + fi + if kver_ge 4.18; then force_tests+=" sctp" fi @@ -376,18 +401,61 @@ rlJournalStart rlRun "sed -i 's/SCTP_SEND_FAILED_EVENT/SCTP_STREAM_CHANGE_EVENT + 1/g' tests/sctp/*.c" 0 \ "Fix SCTP test compilation on old RHEL kernels" fi - # CONFIG_KEYS_DH_COMPUTE not enabled on RHEL-8 :( - exclude_tests+=" keys" + if kver_lt 4.18.0-252; then + # 8a4d5985551b [security] selinux: Add xfs quota command types + script1='s/\$test_count += 62;/$test_count = 55;/g' + script2='s/\$quota_checks += 1;/$quota_checks = 0;/g' + # for some reason this is needed for older RHEL 7 versions... + script3='s/\$test_count += 69;/$test_count = 55;/g' + rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \ + "Apply workaround for missing XFS quota checks" + fi + if kver_lt 4.18.0-314; then + # a17f0671017f selinux: vsock: Set SID for socket returned by accept() + exclude_tests+=" vsock_socket" + fi - # Needs: - # e4cfa05e9bfe ("selinux: Add xfs quota command types") - # (not backported to any RHEL at this point - TODO update the check once it is) - script1='s/\$test_count += 62;/$test_count = 55;/g' - script2='s/\$quota_checks += 1;/$quota_checks = 0;/g' - # for some reason this is needed for older RHEL 7 versions... - script3='s/\$test_count += 69;/$test_count = 55;/g' - rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \ - "Apply workaround for missing XFS quota checks" + sctp_client_peeloff=0 + if kver_ge 4.18.0-305.39.1 && kver_lt 4.18.0-306; then + sctp_client_peeloff=1 + fi + if kver_ge 4.18.0-348.19.1 && kver_lt 4.18.0-349; then + sctp_client_peeloff=1 + fi + if kver_ge 4.18.0-372.1.1 && kver_lt 5.14; then + sctp_client_peeloff=1 + fi + if kver_ge 5.14.0-70.15.1 && kver_lt 5.14.0-71; then + sctp_client_peeloff=1 + fi + if kver_ge 5.14.0-84; then + sctp_client_peeloff=1 + fi + if [ "$sctp_client_peeloff" -eq 1 ]; then + rlRun "sed -i 's/5\.18/4.18/g' tests/sctp/test" 0 \ + "Fix up kernel version in sctp test" + fi + + # TODO: wait for 786fc12457268cc9b555dde6c22ae7300d4b40e1 + # to be backported + #if kver_ge 5.14.0-326; then + # force_tests+=" inet_socket/mptcp" + #fi + + if ! grep -q 'CONFIG_SCSI_ISCSI_ATTRS=y' "/lib/modules/$(uname -r)/config"; then + rlRun "sed -i -e 's/runcon -t test_netlink_iscsi_socket_t/true/' \ + -e 's/runcon -t test_no_netlink_iscsi_socket_t/false/' \ + tests/netlink_socket/test" 0 \ + "Apply workaround for disabled CONFIG_SCSI_ISCSI_ATTRS" + fi + + if ! grep -q 'CONFIG_QFMT_V2=y' "/lib/modules/$(uname -r)/config"; then + # patch the filesystem tests to not do quota tests on ext4 + rlRun "sed -i -e 's/\`uname -r\`/\"3.0\"/' \ + -e 's/\\(elsif ( \$fs_type eq \"nfs4\" or \$fs_type eq \"nfs\"\\)/\\1 or \$fs_type eq \"ext4\"/' \ + tests/filesystem/test tests/fs_filesystem/test" 0 \ + "Apply workaround for disabled CONFIG_QFMT_V2" + fi fi # CKI mainline kernels don't ship with module build infrastructure @@ -415,24 +483,6 @@ rlJournalStart "Force applicable tests: $force_tests" fi - if ! modprobe sctp 2>/dev/null; then - script1='s/runcon -t test_sctp_socket_t/true/g' - script2='s/runcon -t test_no_sctp_socket_t/false/g' - rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \ - "No SCTP support => fix up extended_socket_class test" - fi - - # on aarch64 and s390x the kernel support for Bluetooth is turned - # off so we disable the Bluetooth socket tests there - case "$(rlGetPrimaryArch)" in - aarch64|s390x) - script1='s/runcon -t test_bluetooth_socket_t/true/g' - script2='s/runcon -t test_no_bluetooth_socket_t/false/g' - rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \ - "No Bluetooth support => fix up extended_socket_class test" - ;; - esac - # Initialize report. rlRun "echo 'Remote: $GIT_URL' >results.log" 0 rlRun "echo 'Branch: $GIT_BRANCH' >>results.log" 0 @@ -483,6 +533,8 @@ rlJournalStart rlRun "sleep 5" 0 rlRun "dmesg | grep -i \"rcu_sched detected stalls\"" 1 + + rlRun "popd" 0 "Leave /root" rlFileRestore rlPhaseEnd rlJournalPrintText diff --git a/kernel/selinuxfs_dentry_softlockup/main.fmf b/kernel/selinuxfs_dentry_softlockup/main.fmf new file mode 100644 index 0000000..5043c2e --- /dev/null +++ b/kernel/selinuxfs_dentry_softlockup/main.fmf @@ -0,0 +1,18 @@ +summary: Test soft lockup on selinuxfs dentry lookup +description: | + Verifies that traversing selinuxfs while policy is being reloaded doesn't + cause a deadlock in the kernel. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - policycoreutils + - findutils +duration: 5m +tier: 2 +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1510603 +extra-hardware: | + keyvalue = PROCESSORS >= 2 diff --git a/kernel/selinuxfs_dentry_softlockup/runtest.sh b/kernel/selinuxfs_dentry_softlockup/runtest.sh new file mode 100755 index 0000000..779df6d --- /dev/null +++ b/kernel/selinuxfs_dentry_softlockup/runtest.sh @@ -0,0 +1,37 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + rlPhaseEnd + + rlPhaseStartTest + rlAssertGreaterOrEqual "Ensure the machine has at least two cores" \ + "$(nproc)" 2 + + rlRun "(cd /sys/fs/selinux; while true; do find >/dev/null 2>&1; done) &" + rlRun "while true; do load_policy; sleep 0.1; done &" + + function check_soft_lockup() { + for (( i = 0; i < 60; i++ )); do + dmesg | grep 'BUG: soft lockup' && return 1 + sleep 1 + done + return 0 + } + rlRun "check_soft_lockup" 0 "Wait and see if soft lockup appears in dmesg" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "kill \$(jobs -p)" 0 "Terminate background jobs" + rlRun "wait" 0 "Wait for background jobs to terminate" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/setsebool-deadlock/Makefile b/kernel/setsebool-deadlock/Makefile new file mode 100644 index 0000000..e6e0bfb --- /dev/null +++ b/kernel/setsebool-deadlock/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: audit policycoreutils" + +run: + chmod +x runtest.sh + TEST=/SELinux/kernel/setsebool-deadlock ./runtest.sh diff --git a/kernel/setsebool-deadlock/main.fmf b/kernel/setsebool-deadlock/main.fmf new file mode 100644 index 0000000..e83260e --- /dev/null +++ b/kernel/setsebool-deadlock/main.fmf @@ -0,0 +1,23 @@ +summary: Regression test for deadlock when changing booleans +description: | + Verify that setting booleans with SELinux audit exclude rules present + doesn't deadlock itself. + WARNING: This test will lockup the machine if the bug is present! + https://bugzilla.redhat.com/show_bug.cgi?id=1924230 +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- audit +- policycoreutils +duration: 5m +tier: 3 +enabled: true +adjust+: + - enabled: false + when: distro < fedora-34 + because: some kernels on Fedora 33 and below don't have the fix + - enabled: false + when: distro ~< rhel-8.4 + because: not expected to be fixed in RHEL-8 below 8.4 diff --git a/kernel/setsebool-deadlock/runtest.sh b/kernel/setsebool-deadlock/runtest.sh new file mode 100755 index 0000000..20239b4 --- /dev/null +++ b/kernel/setsebool-deadlock/runtest.sh @@ -0,0 +1,43 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function boolGet() { + getsebool "$1" | cut -d ' ' -f 3 +} +function boolSet() { + getsebool "$1" &>/dev/null || return 0 + setsebool "$1" "$2" || return 1 + [ "$(boolGet "$1")" == "$2" ] +} + +TEST_BOOLEAN="domain_can_mmap_files" + +rlJournalStart + rlPhaseStartSetup + rlRun "bool_default=\$(boolGet domain_can_mmap_files)" 0 \ + "Get the initial boolean value" + rlRun "auditctl -a exclude,never -F subj_user=sysadm_u" 0 \ + "Add an audit rule that triggers the bug" + rlPhaseEnd + + rlPhaseStartTest + rlRun "setsebool domain_can_mmap_files $(( 1 - $bool_default )) &" 0 \ + "Start setsebool in the background (it may hang)" + rlRun "sleep 5s" 0 "Give it a grace period of 5 seconds" + rlRun "test \$(jobs -r | wc -l) -eq 0" 0 "Check that it has exited" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "auditctl -d exclude,never -F subj_user=sysadm_u" 0 \ + "Remove the audit rule" + rlRun "boolSet domain_can_mmap_files $bool_default" 0 \ + "Restore the boolean value" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/synflood/main.fmf b/kernel/synflood/main.fmf index 94c46d0..a0304ef 100644 --- a/kernel/synflood/main.fmf +++ b/kernel/synflood/main.fmf @@ -8,7 +8,9 @@ component: - kernel framework: beakerlib require: -- library(distribution/epel) +- type: library + url: https://github.com/beakerlib/epel.git + name: /epel - /usr/bin/nc - perf - git @@ -18,12 +20,16 @@ require: recommend: - /usr/sbin/hping3 duration: 1h -enabled: true +# currently disabled due to being unreliable +enabled: false tier: 3 -adjust: - enabled: false +adjust+: + - enabled: false when: distro < rhel-8 because: The test doesn't work well on RHEL-7 + - enabled: false + when: arch = s390x + because: No machines likely available with required HW configuration extra-hardware: | keyvalue = PROCESSORS >= 64 hostrequire = diff --git a/kernel/synflood/runtest.sh b/kernel/synflood/runtest.sh index aaaf8ab..8e33ceb 100755 --- a/kernel/synflood/runtest.sh +++ b/kernel/synflood/runtest.sh @@ -7,6 +7,9 @@ # Include Beakerlib environment . /usr/share/beakerlib/beakerlib.sh || exit 1 +# Set this parameter to 1 to also generate a flamegraph. +GENERATE_FLAMEGRAPH="${GENERATE_FLAMEGRAPH:-0}" + TEST_PORT=8080 FG_URL="https://github.com/brendangregg/FlameGraph" @@ -26,13 +29,15 @@ if [ $(nproc) -lt 64 ]; then rlPhaseEnd else rlPhaseStartSetup - rlImport "distribution/epel" + rlImport "epel/epel" rlRun "command -v hping3 || epelyum install -y hping3" 0 \ "Make sure hping3 is installed (EPEL-only on RHEL)" rlRun "uname -r" - rlRun "git clone $FG_URL $FG_DIR" + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlRun "git clone $FG_URL $FG_DIR" + fi rlPhaseEnd rlPhaseStartTest @@ -64,10 +69,14 @@ else rlPhaseEnd rlPhaseStartCleanup - rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" + rlFileSubmit "flamegraph.svg" + rlRun "rm -f flamegraph.svg" + fi rlRun "xz -T0 perf.data" - for file in "perf.data.xz" "flamegraph.svg" "perf-report.txt"; do + for file in "perf.data.xz" "perf-report.txt"; do rlFileSubmit "$file" rlRun "rm -f $file" done diff --git a/kernel/sysctl-avcs/main.fmf b/kernel/sysctl-avcs/main.fmf new file mode 100644 index 0000000..968e37e --- /dev/null +++ b/kernel/sysctl-avcs/main.fmf @@ -0,0 +1,22 @@ +summary: Test for unexpected denials from sysctl -a +description: | + Verifes that running sysctl -a doesn't trigger unexpected capability + checks that would result in AVC denials even when access is allowed. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - selinux-policy-devel +duration: 10m +tier: 2 +check: + - avc +enabled: true +adjust+: + - enabled: false + when: distro < rhel-9 + because: RHEL-8 and below are not worth supporting by this test +link: + - verifies: https://issues.redhat.com/browse/RHEL-135610 + - verifies: https://issues.redhat.com/browse/RHEL-145590 diff --git a/kernel/sysctl-avcs/runtest.sh b/kernel/sysctl-avcs/runtest.sh new file mode 100755 index 0000000..b8129a9 --- /dev/null +++ b/kernel/sysctl-avcs/runtest.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2026 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + + SE_ROLE="$(secon -r --pid $$)" + SE_TYPE="$(secon -t --pid $$)" + + rlRun "make -f /usr/share/selinux/devel/Makefile test_policy.pp M4PARAM='-D TEST_ROLE=$SE_ROLE -D TEST_TYPE=$SE_TYPE'" 0 \ + "Build the test policy" + rlRun "semodule -i test_policy.pp" 0 "Load test policy" + rlPhaseEnd + + rlPhaseStartTest + rlRun "runcon -t test_domain_t sysctl -a" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semodule -r test_policy" 0 "Unload test policy" + rlRun "make -f /usr/share/selinux/devel/Makefile clean" 0 \ + "Clean the test policy" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/sysctl-avcs/test_policy.te b/kernel/sysctl-avcs/test_policy.te new file mode 100644 index 0000000..bf53caa --- /dev/null +++ b/kernel/sysctl-avcs/test_policy.te @@ -0,0 +1,37 @@ +policy_module(test_policy,1.0.0) + +type test_domain_t; +domain_type(test_domain_t) + +corecmd_bin_entry_type(test_domain_t) +kernel_read_all_sysctls(test_domain_t) +kernel_read_security_state(test_domain_t) +fs_read_binfmt_misc(test_domain_t) +fs_search_auto_mountpoints(test_domain_t) + +# No interface for this in policy: +require { + type binfmt_misc_fs_t; +} +list_dirs_pattern(test_domain_t, binfmt_misc_fs_t, binfmt_misc_fs_t) + +# Some BPF sysctls can only be read with CAP_SYS_ADMIN, so we need to silence +# it. +dontaudit test_domain_t self:capability sys_admin; + +require { + type TEST_TYPE; + role TEST_ROLE; +} +allow TEST_TYPE test_domain_t:process transition; +role TEST_ROLE types test_domain_t; + +allow test_domain_t TEST_TYPE:fd use; +allow test_domain_t TEST_TYPE:fifo_file rw_inherited_fifo_file_perms; +allow test_domain_t TEST_TYPE:process { sigchld }; + +files_search_tmp(test_domain_t) + +term_use_all_terms(test_domain_t) + +userdom_search_user_tmp_dirs(test_domain_t) diff --git a/kernel/wrong-rules-after-setsebool/Makefile b/kernel/wrong-rules-after-setsebool/Makefile new file mode 100644 index 0000000..1b54785 --- /dev/null +++ b/kernel/wrong-rules-after-setsebool/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: policycoreutils setools-console" + +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/kernel/wrong-rules-after-setsebool/main.fmf b/kernel/wrong-rules-after-setsebool/main.fmf new file mode 100644 index 0000000..4dfcd12 --- /dev/null +++ b/kernel/wrong-rules-after-setsebool/main.fmf @@ -0,0 +1,20 @@ +summary: Regression test for broken rules after setting booleans +description: | + Test that conditional rules are not broken after changing SELinux booleans. + + Originally discovered in: + https://src.fedoraproject.org/tests/selinux/pull-request/203#comment-71053 +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- policycoreutils +- setools-console +duration: 5m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test diff --git a/kernel/wrong-rules-after-setsebool/runtest.sh b/kernel/wrong-rules-after-setsebool/runtest.sh new file mode 100755 index 0000000..6aad544 --- /dev/null +++ b/kernel/wrong-rules-after-setsebool/runtest.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + rlPhaseEnd + + rlPhaseStartTest + rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \ + tee sesearch-before.txt" + rlRun "setsebool ftpd_anon_write=off ftpd_connect_all_unreserved=off \ + ftpd_connect_db=off ftpd_full_access=off" + rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \ + tee sesearch-after.txt" + rlAssertNotDiffer "sesearch-before.txt" "sesearch-after.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f sesearch-before.txt sesearch-after.txt" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/xfrm-refcount-underflow/main.fmf b/kernel/xfrm-refcount-underflow/main.fmf new file mode 100644 index 0000000..a08b332 --- /dev/null +++ b/kernel/xfrm-refcount-underflow/main.fmf @@ -0,0 +1,22 @@ +summary: XFRM refcount underflow test +description: | + Test that allocating and deallocating XFRM state and/or policy + structures doesn't lead to selinux_xfrm_refcount imbalance and + underflow. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +recommend: + - systemtap +duration: 15m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test +link: + - verifies: https://issues.redhat.com/browse/RHEL-27751 +extra-nitrate: TC#0617218 +id: d2bfb49c-fe12-48b5-8f17-8edf6f93810a diff --git a/kernel/xfrm-refcount-underflow/runtest.sh b/kernel/xfrm-refcount-underflow/runtest.sh new file mode 100755 index 0000000..42392ba --- /dev/null +++ b/kernel/xfrm-refcount-underflow/runtest.sh @@ -0,0 +1,78 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2024 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function installDepsYum() { + local yum="$1"; shift + + if "$yum" install --help | grep -q -- --skip-unavailable; then + "$yum" install -y --skip-unavailable $* + elif "$yum" install --help | grep -q -- --skip-broken; then + "$yum" install -y --skip-broken $* + else + for req in $*; do + if ! rpm -q --quiet --whatprovides "$req"; then + "$yum" install -y "$req" || true + fi + done + fi +} + +function installDeps() { + if type yum >/dev/null; then + installDepsYum yum "$@" + elif type dnf >/dev/null; then + installDepsYum dnf "$@" + fi +} + +rlJournalStart + rlPhaseStartSetup + # Determine the base kernel package name and version corresponding + # to the currently running kernel. Use this information to derive + # the correct kernel subpackages to install. + if KERNEL_CORE_NVRA="$(rpm -qf "/boot/vmlinuz-$(uname -r)")"; then + KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" + KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" + + KERNEL_PKG_VRA="${KERNEL_CORE_NVRA#$KERNEL_CORE_N-}" + KERNEL_PKG_BASE="${KERNEL_CORE_N%-core}" + + rlLog "Detected kernel package base name '$KERNEL_PKG_BASE' and version-release.arch '$KERNEL_PKG_VRA'" + KERNEL_PKGS="$KERNEL_PKG_BASE-devel-$KERNEL_PKG_VRA" + else + rlLog "Detected non-RPM running kernel - no extra kernel packages will be installed" + KERNEL_PKGS="" + fi + + rlRun "installDeps systemtap $KERNEL_PKGS" 0 "Install requires" + rlPhaseEnd + + rlPhaseStartTest + function dump_xfrm_refcount() { + local refcount_addr="0x$(grep selinux_xfrm_refcount /proc/kallsyms | cut -f 1 -d ' ')" + stap -e "probe begin { + printf(\"%i\\n\", atomic_read($refcount_addr)) + exit() + }" + } + rlRun "dump_xfrm_refcount" + rlAssertEquals "Assert that XFRM refcount is zero at the beginning" \ + "$(dump_xfrm_refcount)" 0 + rlRun "ip xfrm policy add src 127.0.0.1 dst 127.0.0.1 proto tcp dir out tmpl proto ah mode transport level required" 0 \ + "Add a dummy XFRM policy entry" + rlRun "ip xfrm state add src 127.0.0.1 dst 127.0.0.1 proto ah spi 0x200 auth sha1 0123456789012345" 0 \ + "Add a dummy XFRM state entry" + rlRun "ip xfrm policy flush" 0 "Clear XFRM policy entries" + rlRun "ip xfrm state flush" 0 "Clear XFRM state entries" + rlRun "dump_xfrm_refcount" + rlAssertEquals "Assert that XFRM refcount is still zero" \ + "$(dump_xfrm_refcount)" 0 + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/libselinux/container-selinux_crond/main.fmf b/libselinux/container-selinux_crond/main.fmf index 40f9694..8078bd8 100644 --- a/libselinux/container-selinux_crond/main.fmf +++ b/libselinux/container-selinux_crond/main.fmf @@ -1,2 +1,21 @@ -path: /libselinux/container-selinux_crond -tier: 2 +summary: Does installing container-selinux break crond? +description: | + Does installing container-selinux break crond? + See https://bugzilla.redhat.com/show_bug.cgi?id=1862823 + and https://bugzilla.redhat.com/show_bug.cgi?id=1879368 +contact: Vit Mojzis +component: + - libselinux +recommend: + - cronie + - container-selinux + - libselinux-utils + - policycoreutils +duration: 10m +tag: + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1862823 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1879368 +extra-summary: /CoreOS/libselinux/Regression/container-selinux_crond +extra-task: /CoreOS/libselinux/Regression/container-selinux_crond diff --git a/libselinux/container-selinux_crond/runtest.sh b/libselinux/container-selinux_crond/runtest.sh index 071537e..0963796 100755 --- a/libselinux/container-selinux_crond/runtest.sh +++ b/libselinux/container-selinux_crond/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" @@ -36,7 +35,7 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} rlAssertRpm cronie - rlAssertRpm container-selinux + rlRun "rpm -qa | grep -e container-selinux -e selinux-policy" rlRun "setenforce 1" rlRun "sestatus" OUTPUT_FILE=`mktemp` diff --git a/libselinux/get_default_context/main.fmf b/libselinux/get_default_context/main.fmf index 229106f..55bc274 100644 --- a/libselinux/get_default_context/main.fmf +++ b/libselinux/get_default_context/main.fmf @@ -1,2 +1,36 @@ -path: /libselinux/get_default_context -tier: 1 +summary: Does get_default_context_with_rolelevel work as expected? +description: | + Perform lookup of a default context for system_u:system_r:crond_t. This should + return context derived from "system_r:system_cronjob_t", but fails, + because of a kernel bug, when libselinux uses security_compute_user + (deprecated). + See https://bugzilla.redhat.com/show_bug.cgi?id=1879368 +contact: Milos Malik +component: + - libselinux +recommend: + - python3 + - python3-libselinux + - libselinux + - libselinux-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1879368 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1884282 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0608317 +extra-summary: /CoreOS/libselinux/Regression/get_default_context +extra-task: /CoreOS/libselinux/Regression/get_default_context diff --git a/libselinux/get_default_context/runtest.sh b/libselinux/get_default_context/runtest.sh index 14c57fe..94feae4 100755 --- a/libselinux/get_default_context/runtest.sh +++ b/libselinux/get_default_context/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" @@ -40,7 +39,7 @@ rlJournalStart rlRun "sestatus" rlPhaseEnd - if rlIsRHEL ">=8.3" || rlIsFedora; then + if rlIsRHEL ">=8.3" || rlIsFedora || rlIsCentOS ">=8.3" ; then rlPhaseStartTest "#1879368" rlRun "cat ./reproducer.py" rlRun "./reproducer.py" 0 diff --git a/libselinux/getpolicyload/main.fmf b/libselinux/getpolicyload/main.fmf new file mode 100644 index 0000000..0c19ee2 --- /dev/null +++ b/libselinux/getpolicyload/main.fmf @@ -0,0 +1,23 @@ +summary: basic test for the getpolicyload program +test: ./runtest.sh +framework: beakerlib +component: + - libselinux +recommend: + - libselinux + - libselinux-utils + - policycoreutils +duration: 5m +enabled: true +tag: + - NoRHIVOS +link: + - relates: https://issues.redhat.com/browse/RHEL-16233 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the getpolicyload program is not available there + - enabled: false + when: distro < fedora-40 + because: the getpolicyload program is not available there +extra-nitrate: TC#0615981 diff --git a/libselinux/getpolicyload/runtest.sh b/libselinux/getpolicyload/runtest.sh new file mode 100755 index 0000000..1954763 --- /dev/null +++ b/libselinux/getpolicyload/runtest.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm libselinux + rlAssertRpm libselinux-utils + rlAssertRpm policycoreutils + rlRun "sestatus" + rlPhaseEnd + + rlPhaseStartTest + for CMD in "semodule -R" "semodule -B" "semodule --refresh" "load_policy" "load_policy -i" ; do + BEFORE=`getpolicyload` + rlRun "getpolicyload" + rlRun "${CMD}" + AFTER=`getpolicyload` + rlRun "getpolicyload" + rlAssertGreater "the number of policy loads increased" ${AFTER} ${BEFORE} + done + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + diff --git a/libselinux/getsebool/main.fmf b/libselinux/getsebool/main.fmf index 9227c9b..9621457 100644 --- a/libselinux/getsebool/main.fmf +++ b/libselinux/getsebool/main.fmf @@ -1,2 +1,27 @@ -path: /libselinux/getsebool -tier: 1 +summary: Does getsebool work as expected? +description: |+ + Does getsebool work as expected? + +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - f32friendly + - f33friendly + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402140 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0549303 +extra-summary: /CoreOS/libselinux/Sanity/getsebool +extra-task: /CoreOS/libselinux/Sanity/getsebool diff --git a/libselinux/matchpathcon-in-chroot-env/Makefile b/libselinux/matchpathcon-in-chroot-env/Makefile new file mode 100644 index 0000000..0028f3e --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +# Description: Does matchpathcon work correctly in chroot environment? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE test-script.sh test-script.py + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x test-script.sh || chmod a+x test-script.sh + test -x test-script.py || chmod a+x test-script.py + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does matchpathcon work correctly in chroot environment?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: libselinux" >> $(METADATA) + @echo "Requires: policycoreutils libselinux libselinux-utils python3-libselinux" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2295428" >> $(METADATA) # Fedora 41 + @echo "Bug: RHEL-46558" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/libselinux/matchpathcon-in-chroot-env/PURPOSE b/libselinux/matchpathcon-in-chroot-env/PURPOSE new file mode 100644 index 0000000..7cbb17e --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +Author: Milos Malik + +Does matchpathcon work correctly in chroot environment? + diff --git a/libselinux/matchpathcon-in-chroot-env/main.fmf b/libselinux/matchpathcon-in-chroot-env/main.fmf new file mode 100644 index 0000000..8bc4d6f --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/main.fmf @@ -0,0 +1,28 @@ +summary: Does matchpathcon work correctly in chroot environment? +description: | + Does matchpathcon work correctly in chroot environment? + +contact: Milos Malik +component: + - libselinux +test: ./runtest.sh +framework: beakerlib +recommend: + - libselinux + - libselinux-utils + - python3-libselinux + - policycoreutils +duration: 15m +enabled: true +tier: 1 +tag: + - targeted + - CI-Tier-1 + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2295428 + - verifies: https://issues.redhat.com/browse/RHEL-46558 +extra-summary: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +extra-task: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +extra-nitrate: TC#0617627 +id: 649c1bfa-1739-4d87-8799-f37fd30499f4 diff --git a/libselinux/matchpathcon-in-chroot-env/runtest.sh b/libselinux/matchpathcon-in-chroot-env/runtest.sh new file mode 100755 index 0000000..5a98804 --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/runtest.sh @@ -0,0 +1,73 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +# Description: Does matchpathcon work correctly in chroot environment? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libselinux" +CHROOT_DIR=`mktemp -d` +INSTALL_OPTION="" +if yum --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if yum install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if yum install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi +# detect release version +test -e /etc/os-release && os_release='/etc/os-release' || os_release='/usr/lib/os-release' +. "${os_release}" +INSTALL_OPTION="${INSTALL_OPTION} --releasever ${VERSION_ID}" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-utils + rlPhaseEnd + + rlPhaseStartTest "bz#2295428 + RHEL-46558" + rlRun "yum -y install filesystem libselinux libselinux-utils python3-libselinux policycoreutils --installroot=${CHROOT_DIR} ${INSTALL_OPTION}" + rlRun "dmesg -c >& /dev/null" + rlRun "cp ./test-script.sh ${CHROOT_DIR}/usr/bin/" + rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.sh" + rlRun "grep -i -e 'segmentation' -e 'fault' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun "cp ./test-script.py ${CHROOT_DIR}/usr/bin/" + rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.py" + rlRun "grep -i -e 'segmentation' -e 'fault' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun "dmesg" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf ${CHROOT_DIR}" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/libselinux/matchpathcon-in-chroot-env/test-script.py b/libselinux/matchpathcon-in-chroot-env/test-script.py new file mode 100755 index 0000000..630741f --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/test-script.py @@ -0,0 +1,8 @@ +#!/usr/bin/python3 + +import selinux +try: + selinux.matchpathcon("/dev", 16384) +except FileNotFoundError as e: + print(e) + diff --git a/libselinux/matchpathcon-in-chroot-env/test-script.sh b/libselinux/matchpathcon-in-chroot-env/test-script.sh new file mode 100755 index 0000000..77ee72f --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/test-script.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +sestatus +matchpathcon /dev ; true + diff --git a/libselinux/python-bindings/Makefile b/libselinux/python-bindings/Makefile index f2068e4..9ba0613 100644 --- a/libselinux/python-bindings/Makefile +++ b/libselinux/python-bindings/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: python3-libselinux" >> $(METADATA) + @echo "Requires: python3-libselinux python3-pip" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libselinux/python-bindings/main.fmf b/libselinux/python-bindings/main.fmf index 03cdc91..8a2b690 100644 --- a/libselinux/python-bindings/main.fmf +++ b/libselinux/python-bindings/main.fmf @@ -1,8 +1,12 @@ -path: /libselinux/python-bindings summary: Import selinux python module, check its metadata -description: | - The test compares rpm version with python module metadata version and - tries to use selinux python module in a simple operation -adjust: -- enabled: false - when: distro < rhel-8 +description: '' +contact: Petr Lautrbach +component: + - libselinux +recommend: + - python3-libselinux + - python3-pip +tag: + - NoRHIVOS +extra-summary: /CoreOS/libselinux/Sanity/python-bindings +extra-task: /CoreOS/libselinux/Sanity/python-bindings diff --git a/libselinux/python-bindings/runtest.sh b/libselinux/python-bindings/runtest.sh index a8e9b11..fcf2890 100755 --- a/libselinux/python-bindings/runtest.sh +++ b/libselinux/python-bindings/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="python3-libselinux" @@ -47,13 +46,14 @@ rlJournalStart rlPhaseStartTest "Import selinux module and try selinux.is_selinux_enabled()" rlRun "python3 -c 'import selinux'" 0 - rlRun "python3 -c 'import selinux; rc = selinux.is_selinux_enabled(); sys.exit(rc)'" 0,1 - rlRun "PYTHON_SELINUX_ENABLED=$?" - if selinuxenabled; then - rlAssertEquals "SELinux is enabled" $PYTHON_SELINUX_ENABLED 1 - else - rlAssertNotEquals "SELinux is disabled" $PYTHON_SELINUX_ENABLED 0 - fi + rlRun "python3 -c 'import selinux, sys; rc = selinux.is_selinux_enabled(); sys.exit(rc)'" 0,1 + + rlRun "PYTHON_SELINUX_ENABLED=$?" + if selinuxenabled; then + rlAssertEquals "SELinux is enabled" $PYTHON_SELINUX_ENABLED 1 + else + rlAssertNotEquals "SELinux is disabled" $PYTHON_SELINUX_ENABLED 0 + fi rlPhaseEnd rlPhaseStartCleanup diff --git a/libselinux/realpath_not_final-function/PURPOSE b/libselinux/realpath_not_final-function/PURPOSE index 8305d70..8fcf56a 100644 --- a/libselinux/realpath_not_final-function/PURPOSE +++ b/libselinux/realpath_not_final-function/PURPOSE @@ -1,3 +1,61 @@ PURPOSE of /CoreOS/libselinux/Sanity/realpath_not_final-function Description: Test realpath_not_final function Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on log file content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Test +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:17:21 ] :: [ BEGIN ] :: Running './test NULL' +/usr/share/beakerlib/testing.sh: line 896: 39526 Segmentation fault (core dumped) ./test NULL +:: [ 06:17:22 ] :: [ PASS ] :: Command './test NULL' (Expected 139, got 139) +:: [ 06:17:22 ] :: [ BEGIN ] :: Running './test /somedir/somefile NULL' +symlink_realpath(/somedir/somefile) realpath() failed: No such file or directory +Executing: realpath_not_final(/somedir/somefile, resolved_path) +realpath_not_final: /somedir +:: [ 06:17:22 ] :: [ PASS ] :: Command './test /somedir/somefile NULL' (Expected 255, got 255) +:: [ 06:17:22 ] :: [ BEGIN ] :: Running './test NULL NULL' +/usr/share/beakerlib/testing.sh: line 896: 39584 Segmentation fault (core dumped) ./test NULL NULL +:: [ 06:17:23 ] :: [ PASS ] :: Command './test NULL NULL' (Expected 139, got 139) +:: [ 06:17:23 ] :: [ BEGIN ] :: Running './test /tmp | tee output' +Executing: realpath_not_final(/tmp, resolved_path) +realpath_not_final: /tmp +:: [ 06:17:23 ] :: [ PASS ] :: Command './test /tmp | tee output' (Expected 0, got 0) +:: [ 06:17:23 ] :: [ BEGIN ] :: Running 'grep 'realpath_not_final: /tmp' output' +realpath_not_final: /tmp +:: [ 06:17:23 ] :: [ PASS ] :: Command 'grep 'realpath_not_final: /tmp' output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test //tmp | tee output' +Executing: realpath_not_final(//tmp, resolved_path) +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command './test //tmp | tee output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test ///tmp | tee output' +Executing: realpath_not_final(///tmp, resolved_path) +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command './test ///tmp | tee output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test ////tmp | tee output' +Executing: realpath_not_final(////tmp, resolved_path) +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command './test ////tmp | tee output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 3s +:: Assertions: 11 good, 0 bad +:: RESULT: PASS (Test) diff --git a/libselinux/realpath_not_final-function/main.fmf b/libselinux/realpath_not_final-function/main.fmf index 52d16d0..e22cf47 100644 --- a/libselinux/realpath_not_final-function/main.fmf +++ b/libselinux/realpath_not_final-function/main.fmf @@ -1 +1,31 @@ -path: /libselinux/realpath_not_final-function +summary: Test realpath_not_final function +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc + - gcc +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - fusa +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1404644 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0544859 +extra-summary: /CoreOS/libselinux/Sanity/realpath_not_final-function +extra-task: /CoreOS/libselinux/Sanity/realpath_not_final-function diff --git a/libselinux/selabel-functions/PURPOSE b/libselinux/selabel-functions/PURPOSE index aa07643..d718413 100644 --- a/libselinux/selabel-functions/PURPOSE +++ b/libselinux/selabel-functions/PURPOSE @@ -1,3 +1,73 @@ PURPOSE of /CoreOS/libselinux/Sanity/selabel-functions Description: Test selabel functions Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on log file content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: selabel_lookup and selabel_lookup_raw +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:17:59 ] :: [ INFO ] :: Handle +:: [ 06:17:59 ] :: [ BEGIN ] :: Running './test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle' +/usr/share/beakerlib/testing.sh: line 896: 45881 Segmentation fault (core dumped) ./test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle +:: [ 06:18:00 ] :: [ PASS ] :: Command './test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) +:: [ 06:18:00 ] :: [ BEGIN ] :: Running './test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle' +/usr/share/beakerlib/testing.sh: line 896: 45913 Segmentation fault (core dumped) ./test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle +:: [ 06:18:01 ] :: [ PASS ] :: Command './test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) +:: [ 06:18:02 ] :: [ BEGIN ] :: Running './test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle' +/usr/share/beakerlib/testing.sh: line 896: 45945 Segmentation fault (core dumped) ./test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle +:: [ 06:18:03 ] :: [ PASS ] :: Command './test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) +:: [ 06:18:03 ] :: [ BEGIN ] :: Running './test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle' +/usr/share/beakerlib/testing.sh: line 896: 45977 Segmentation fault (core dumped) ./test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle +:: [ 06:18:04 ] :: [ PASS ] :: Command './test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) +:: [ 06:18:04 ] :: [ INFO ] :: Path +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_FILE NULL NULL 0 0 NULL 0' +selabel_lookup - ERROR: Invalid argument +selabel_lookup_raw - ERROR: Invalid argument +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_FILE, &selabel_option, 4) +Executing: selabel_lookup(hnd, &selabel_context, (null), 0) +Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_FILE NULL NULL 0 0 NULL 0' (Expected 22, got 22) +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0' +selabel_lookup - ERROR: Invalid argument +selabel_lookup_raw - ERROR: Invalid argument +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_MEDIA, &selabel_option, 4) +Executing: selabel_lookup(hnd, &selabel_context, (null), 0) +Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0' (Expected 22, got 22) +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_X NULL NULL 0 0 NULL 0' +selabel_lookup - ERROR: Invalid argument +selabel_lookup_raw - ERROR: Invalid argument +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_X, &selabel_option, 4) +Executing: selabel_lookup(hnd, &selabel_context, (null), 0) +Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_X NULL NULL 0 0 NULL 0' (Expected 22, got 22) +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_DB NULL NULL 0 0 NULL 0' +selabel_lookup - ERROR: Invalid argument +selabel_lookup_raw - ERROR: Invalid argument +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_DB, &selabel_option, 4) +Executing: selabel_lookup(hnd, &selabel_context, (null), 0) +Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_DB NULL NULL 0 0 NULL 0' (Expected 22, got 22) +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_ANDROID_PROP NULL NULL 0 0 NULL 0' +selabel_open - ERROR: Operation not supported +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_ANDROID_PROP, &selabel_option, 4) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_ANDROID_PROP NULL NULL 0 0 NULL 0' (Expected 255, got 255) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 6s +:: Assertions: 9 good, 0 bad +:: RESULT: PASS (selabel_lookup and selabel_lookup_raw) diff --git a/libselinux/selabel-functions/main.fmf b/libselinux/selabel-functions/main.fmf index 222b1c8..c61f519 100644 --- a/libselinux/selabel-functions/main.fmf +++ b/libselinux/selabel-functions/main.fmf @@ -1 +1,31 @@ -path: /libselinux/selabel-functions +summary: Test selabel functions +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc + - gcc +enabled: true +duration: 10m +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f33friendly + - targeted + - fusa +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390909 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0536014 +extra-summary: /CoreOS/libselinux/Sanity/selabel-functions +extra-task: /CoreOS/libselinux/Sanity/selabel-functions diff --git a/libselinux/selabel-functions/runtest.sh b/libselinux/selabel-functions/runtest.sh index 64d593f..6a9c404 100755 --- a/libselinux/selabel-functions/runtest.sh +++ b/libselinux/selabel-functions/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" diff --git a/libselinux/selabel-functions/test_best.c b/libselinux/selabel-functions/test_best.c index 7eca4f4..ffa1ade 100644 --- a/libselinux/selabel-functions/test_best.c +++ b/libselinux/selabel-functions/test_best.c @@ -13,9 +13,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_SUBSET, NULL }, + { SELABEL_OPT_UNUSED, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_BASEONLY, (char *) 1 } + { SELABEL_OPT_UNUSED, NULL } }; if (argc < 8) { @@ -52,11 +52,11 @@ int main (int argc, char **argv) } // set subset - if (strcmp(argv[3], "NULL") == 0) { - selabel_option[1].value = NULL; - } - else { - selabel_option[1].value = argv[3]; + if (backend == SELABEL_CTX_FILE) { + selabel_option[1].type = SELABEL_OPT_SUBSET; + if (strcmp(argv[3], "NULL") != 0) { + selabel_option[1].value = argv[3]; + } } // set validate @@ -68,11 +68,11 @@ int main (int argc, char **argv) } // set baseonly - if (strcmp(argv[5], "0") == 0) { - selabel_option[3].value = NULL; - } - else { - selabel_option[3].value = (char *) 1; + if (backend == SELABEL_CTX_FILE) { + selabel_option[3].type = SELABEL_OPT_BASEONLY; + if (strcmp(argv[5], "0") != 0) { + selabel_option[3].value = (char *) 1; + } } printf("selabel_options: "); diff --git a/libselinux/selabel-functions/test_lookup.c b/libselinux/selabel-functions/test_lookup.c index ee0caaa..268e460 100644 --- a/libselinux/selabel-functions/test_lookup.c +++ b/libselinux/selabel-functions/test_lookup.c @@ -13,9 +13,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_SUBSET, NULL }, + { SELABEL_OPT_UNUSED, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_BASEONLY, (char *) 1 } + { SELABEL_OPT_UNUSED, NULL } }; if (argc < 8) { @@ -53,11 +53,11 @@ int main (int argc, char **argv) } // set subset - if (strcmp(argv[3], "NULL") == 0) { - selabel_option[1].value = NULL; - } - else { - selabel_option[1].value = argv[3]; + if (backend == SELABEL_CTX_FILE) { + selabel_option[1].type = SELABEL_OPT_SUBSET; + if (strcmp(argv[3], "NULL") != 0) { + selabel_option[1].value = argv[3]; + } } // set validate @@ -69,11 +69,11 @@ int main (int argc, char **argv) } // set baseonly - if (strcmp(argv[5], "0") == 0) { - selabel_option[3].value = NULL; - } - else { - selabel_option[3].value = (char *) 1; + if (backend == SELABEL_CTX_FILE) { + selabel_option[3].type = SELABEL_OPT_BASEONLY; + if (strcmp(argv[5], "0") != 0) { + selabel_option[3].value = (char *) 1; + } } printf("selabel_options: "); diff --git a/libselinux/selabel-functions/test_open.c b/libselinux/selabel-functions/test_open.c index 87f61ee..f19f720 100644 --- a/libselinux/selabel-functions/test_open.c +++ b/libselinux/selabel-functions/test_open.c @@ -14,9 +14,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_SUBSET, NULL }, + { SELABEL_OPT_UNUSED, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_BASEONLY, (char *) 1 } + { SELABEL_OPT_UNUSED, NULL } }; if (argc < 6) { @@ -49,12 +49,12 @@ int main (int argc, char **argv) } // set subset - if (strcmp(argv[3], "NULL") == 0) { - selabel_option[1].value = NULL; - } - else { - selabel_option[1].value = argv[3]; - } + if (backend == SELABEL_CTX_FILE) { + selabel_option[1].type = SELABEL_OPT_SUBSET; + if (strcmp(argv[3], "NULL") != 0) { + selabel_option[1].value = argv[3]; + } + } // set validate if (strcmp(argv[4], "0") == 0) { @@ -65,12 +65,12 @@ int main (int argc, char **argv) } // set baseonly - if (strcmp(argv[5], "0") == 0) { - selabel_option[3].value = NULL; - } - else { - selabel_option[3].value = (char *) 1; - } + if (backend == SELABEL_CTX_FILE) { + selabel_option[3].type = SELABEL_OPT_BASEONLY; + if (strcmp(argv[5], "0") != 0) { + selabel_option[3].value = (char *) 1; + } + } if (argc == 7) { nopt = strtol(argv[6], NULL, 10); diff --git a/libselinux/selabel-functions/test_partial.c b/libselinux/selabel-functions/test_partial.c index 4513cfa..dd60016 100644 --- a/libselinux/selabel-functions/test_partial.c +++ b/libselinux/selabel-functions/test_partial.c @@ -13,9 +13,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_SUBSET, NULL }, + { SELABEL_OPT_UNUSED, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_BASEONLY, (char *) 1 } + { SELABEL_OPT_UNUSED, NULL } }; if (argc < 7) { @@ -52,11 +52,11 @@ int main (int argc, char **argv) } // set subset - if (strcmp(argv[3], "NULL") == 0) { - selabel_option[1].value = NULL; - } - else { - selabel_option[1].value = argv[3]; + if (backend == SELABEL_CTX_FILE) { + selabel_option[1].type = SELABEL_OPT_SUBSET; + if (strcmp(argv[3], "NULL") != 0) { + selabel_option[1].value = argv[3]; + } } // set validate @@ -68,11 +68,11 @@ int main (int argc, char **argv) } // set baseonly - if (strcmp(argv[5], "0") == 0) { - selabel_option[3].value = NULL; - } - else { - selabel_option[3].value = (char *) 1; + if (backend == SELABEL_CTX_FILE) { + selabel_option[3].type = SELABEL_OPT_BASEONLY; + if (strcmp(argv[5], "0") != 0) { + selabel_option[3].value = (char *) 1; + } } printf("selabel_options: "); diff --git a/libselinux/selabel_lookup-and-local-changes/main.fmf b/libselinux/selabel_lookup-and-local-changes/main.fmf new file mode 100644 index 0000000..ed09439 --- /dev/null +++ b/libselinux/selabel_lookup-and-local-changes/main.fmf @@ -0,0 +1,24 @@ +summary: Test selabel_lookup with local fcontext modifications +description: We need to be sure that different of local fcontext modifications are consistently resolved +test: ./test.sh +framework: beakerlib +contact: Petr Lautrbach +component: + - libselinux +require: + - libselinux-utils + - policycoreutils-python-utils +enabled: true +duration: 10m +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2360183 +id: 586ca788-80fa-4ec6-8cea-36fe7520388b diff --git a/libselinux/selabel_lookup-and-local-changes/test.sh b/libselinux/selabel_lookup-and-local-changes/test.sh new file mode 100755 index 0000000..1a944b7 --- /dev/null +++ b/libselinux/selabel_lookup-and-local-changes/test.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PATHS="/rc.d/init.d/test42XYZ-selabel +/usr/bin/test42XYZ-selabel_lookup +/var/lib/test42XYZ-selabel_lookup/bestmatch" + +PATHSPECS='/rc\.d/init\.d/test42XYZ-(selabel|lookup) +/usr/bin/test42XYZ-selabel_lookup +/var/lib/test42XYZ-selabel_lookup(/.*)?' + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlPhaseEnd + + rlPhaseStartTest + echo -n '' > test-selabel-lookup.cil + for pathspec in $PATHSPECS; do + echo "(filecon \"${pathspec}\" file (system_u object_r shell_exec_t ((s0) (s0))))" >> test-selabel-lookup.cil + done + rlRun "cat test-selabel-lookup.cil" + rlRun "semodule -i test-selabel-lookup.cil" + for path in $PATHS; do + rlRun -s "selabel_lookup -b file -k ${path}" + rlAssertGrep shell_exec_t $rlRun_LOG + done + for pathspec in $PATHSPECS; do + rlRun "semanage fcontext -a -t bin_t '${pathspec}'" + done + rlRun "semanage fcontext -l -C" + for path in $PATHS; do + rlRun -s "selabel_lookup -b file -k ${path}" + rlAssertGrep bin_t $rlRun_LOG + + echo $? + rlRun "matchpathcon ${path}" + done + for pathspec in $PATHSPECS; do + rlRun "semanage fcontext -d -t bin_t '${pathspec}'" + done + rlRun "semodule -r test-selabel-lookup" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd diff --git a/libselinux/selinux_boolean_sub-function/PURPOSE b/libselinux/selinux_boolean_sub-function/PURPOSE index 289e8e7..a34845b 100644 --- a/libselinux/selinux_boolean_sub-function/PURPOSE +++ b/libselinux/selinux_boolean_sub-function/PURPOSE @@ -1,3 +1,57 @@ PURPOSE of /CoreOS/libselinux/Sanity/selinux_boolean_sub-function Description: Test selinux_boolean_sub function Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on log file content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Test +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:19:03 ] :: [ BEGIN ] :: Running './test NULL | tee output' +Executing: selinux_boolean_sub((null)) +selinux_boolean_sub: (null) +:: [ 06:19:04 ] :: [ PASS ] :: Command './test NULL | tee output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: (null)' output' +selinux_boolean_sub: (null) +:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: (null)' output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test my_nonexisting_record | tee output' +Executing: selinux_boolean_sub(my_nonexisting_record) +selinux_boolean_sub: my_nonexisting_record +:: [ 06:19:04 ] :: [ PASS ] :: Command './test my_nonexisting_record | tee output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: my_nonexisting_record' output' +selinux_boolean_sub: my_nonexisting_record +:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: my_nonexisting_record' output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test allow_auditadm_exec_content | tee output' +Executing: selinux_boolean_sub(allow_auditadm_exec_content) +selinux_boolean_sub: auditadm_exec_content +:: [ 06:19:04 ] :: [ PASS ] :: Command './test allow_auditadm_exec_content | tee output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: auditadm_exec_content' output' +selinux_boolean_sub: auditadm_exec_content +:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: auditadm_exec_content' output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test allow_domain_fd_use | tee output' +Executing: selinux_boolean_sub(allow_domain_fd_use) +selinux_boolean_sub: domain_fd_use +:: [ 06:19:04 ] :: [ PASS ] :: Command './test allow_domain_fd_use | tee output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: domain_fd_use' output' +selinux_boolean_sub: domain_fd_use +:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: domain_fd_use' output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test virt_sandbox_use_nfs | tee output' +Executing: selinux_boolean_sub(virt_sandbox_use_nfs) +selinux_boolean_sub: virt_use_nfs +:: [ 06:19:04 ] :: [ PASS ] :: Command './test virt_sandbox_use_nfs | tee output' (Expected 0, got 0) +:: [ 06:19:05 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: virt_use_nfs' output' +selinux_boolean_sub: virt_use_nfs +:: [ 06:19:05 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: virt_use_nfs' output' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 2s +:: Assertions: 10 good, 0 bad +:: RESULT: PASS (Test) diff --git a/libselinux/selinux_boolean_sub-function/main.fmf b/libselinux/selinux_boolean_sub-function/main.fmf index efc0f9f..e370b46 100644 --- a/libselinux/selinux_boolean_sub-function/main.fmf +++ b/libselinux/selinux_boolean_sub-function/main.fmf @@ -1 +1,29 @@ -path: /libselinux/selinux_boolean_sub-function +summary: Test selinux_boolean_sub function +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc + - gcc +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - fusa +tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0544857 +extra-summary: /CoreOS/libselinux/Sanity/selinux_boolean_sub-function +extra-task: /CoreOS/libselinux/Sanity/selinux_boolean_sub-function diff --git a/libselinux/selinux_restorecon-functions/Makefile b/libselinux/selinux_restorecon-functions/Makefile index 631f5a8..f826c98 100644 --- a/libselinux/selinux_restorecon-functions/Makefile +++ b/libselinux/selinux_restorecon-functions/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: libselinux libselinux-devel glibc strace" >> $(METADATA) + @echo "Requires: libselinux libselinux-devel glibc strace gcc" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libselinux/selinux_restorecon-functions/PURPOSE b/libselinux/selinux_restorecon-functions/PURPOSE index 8a2f7ba..a51df62 100644 --- a/libselinux/selinux_restorecon-functions/PURPOSE +++ b/libselinux/selinux_restorecon-functions/PURPOSE @@ -1,3 +1,40 @@ PURPOSE of /CoreOS/libselinux/Sanity/selinux_restorecon-functions Description: Test functions in selinux_restorecon.c Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on log files content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: /sys directory +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:19:36 ] :: [ BEGIN ] :: Calling selinux_restorecon on /tmp :: actually running 'strace -ostrace.out -s 64 ./test_restorecon /var/log RECURSE NOCHANGE' +Running selinux_restorecon("/var/log", 0x00000a); +:: [ 06:19:36 ] :: [ PASS ] :: Calling selinux_restorecon on /tmp (Expected 0, got 0) +:: [ 06:19:37 ] :: [ BEGIN ] :: Running 'grep -E "security\.(restorecon_last|sehash)" strace.out' +getxattr("/var/log", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/journal", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/journal/9f26e28ec0b04e2bbb812e4227ff5bb3", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/chrony", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/private", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/audit", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +:: [ 06:19:37 ] :: [ PASS ] :: Command 'grep -E "security\.(restorecon_last|sehash)" strace.out' (Expected 0, got 0) +:: [ 06:19:37 ] :: [ BEGIN ] :: Calling selinux_restorecon on /sys :: actually running 'strace -ostrace.out -s 64 ./test_restorecon /sys RECURSE NOCHANGE' +Running selinux_restorecon("/sys", 0x00000a); +:: [ 06:19:55 ] :: [ PASS ] :: Calling selinux_restorecon on /sys (Expected 0, got 0) +:: [ 06:19:55 ] :: [ BEGIN ] :: Running 'grep -E "security\.(restorecon_last|sehash)" strace.out' +:: [ 06:19:55 ] :: [ PASS ] :: Command 'grep -E "security\.(restorecon_last|sehash)" strace.out' (Expected 1, got 1) +:: [ 06:19:55 ] :: [ BEGIN ] :: Running 'rm -f strace.out' +:: [ 06:19:55 ] :: [ PASS ] :: Command 'rm -f strace.out' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 19s +:: Assertions: 5 good, 0 bad +:: RESULT: PASS (/sys directory) diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index 29aaadf..f6e1a3e 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -1 +1,30 @@ -path: /libselinux/selinux_restorecon-functions +summary: Test functions in selinux_restorecon.c +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc + - gcc + - strace + - gcc +enabled: true +duration: 10m +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - targeted + - fusa +tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0535421 +extra-summary: /CoreOS/libselinux/Sanity/selinux_restorecon-functions +extra-task: /CoreOS/libselinux/Sanity/selinux_restorecon-functions diff --git a/libselinux/selinux_restorecon-functions/runtest.sh b/libselinux/selinux_restorecon-functions/runtest.sh index 2f1b7bd..b09e6f4 100755 --- a/libselinux/selinux_restorecon-functions/runtest.sh +++ b/libselinux/selinux_restorecon-functions/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" @@ -112,8 +111,8 @@ rlJournalStart rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir" 0 "Calling selinux_restorecon" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep var_log_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep var_log_t" 1 @@ -122,8 +121,8 @@ rlJournalStart rlRun "grep \"\\\"$TmpDir/a/bfile\\\"\" strace_xattr.out | grep var_log_t" 1 rlRun "grep \"\\\"$TmpDir/a/b/cfile\\\"\" strace_xattr.out | grep var_log_t" 1 - rlLogInfo "Checking lsetxattr calls" - rlRun "grep lsetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking setxattr calls" + rlRun "grep setxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep user_home_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep user_home_t" 1 @@ -144,8 +143,8 @@ rlJournalStart rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon with RECURSE flag" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep var_log_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep var_log_t" @@ -154,8 +153,8 @@ rlJournalStart rlRun "grep \"\\\"$TmpDir/a/bfile\\\"\" strace_xattr.out | grep var_log_t" rlRun "grep \"\\\"$TmpDir/a/b/cfile\\\"\" strace_xattr.out | grep var_log_t" - rlLogInfo "Checking lsetxattr calls" - rlRun "grep lsetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking setxattr calls" + rlRun "grep setxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep user_home_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep user_home_t" @@ -176,8 +175,8 @@ rlJournalStart rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE NOCHANGE" 0 "Calling selinux_restorecon with NOCHANGE flag" - rlLogInfo "Checking lsetxattr calls" - rlRun "grep lsetxattr strace.out" 1 + rlLogInfo "Checking setxattr calls" + rlRun "grep setxattr strace.out" 1 rlRun "rm -f strace.out" @@ -204,8 +203,8 @@ rlJournalStart # run restorecon first time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon for the first time" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -217,8 +216,8 @@ rlJournalStart # run restorecon second time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon for the second time" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux" 1 + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux" 1 rlRun "rm -f strace.out" rlRun "rm -f strace_xattr.out" @@ -232,8 +231,8 @@ rlJournalStart # run restorecon first time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon for the first time" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -245,8 +244,8 @@ rlJournalStart # run restorecon second time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE IGNORE_DIGEST" 0 "Calling selinux_restorecon for the second time" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -267,8 +266,8 @@ rlJournalStart # empty exclude list rlRun "strace -ostrace.out -s 64 ./test_exclude_list EMPTY $TmpDir" 0 "Calling selinux_restorecon_set_exclude_list with empty list" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -280,8 +279,8 @@ rlJournalStart # exclude $TmpDir/a rlRun "strace -ostrace.out -s 64 ./test_exclude_list $TmpDir/a $TmpDir" 0 "Calling selinux_restorecon_set_exclude_list" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" 1 @@ -302,8 +301,8 @@ rlJournalStart # default sehandle rlRun "strace -ostrace.out -s 64 ./test_sehandle DEFAULT $TmpDir" 0 "Calling selinux_restorecon_set_sehandle with default handle" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -315,8 +314,8 @@ rlJournalStart # custom sehandle rlRun "strace -ostrace.out -s 64 ./test_sehandle CUSTOM $TmpDir" 0 "Calling selinux_restorecon_set_sehandle with custom handle" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" diff --git a/libselinux/selinux_sestatus-functions/Makefile b/libselinux/selinux_sestatus-functions/Makefile index d3ad9e8..0693800 100644 --- a/libselinux/selinux_sestatus-functions/Makefile +++ b/libselinux/selinux_sestatus-functions/Makefile @@ -41,7 +41,6 @@ build: $(BUILT_FILES) clean: rm -f *~ $(BUILT_FILES) - include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile @@ -53,7 +52,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: libselinux libselinux-devel glibc" >> $(METADATA) + @echo "Requires: libselinux libselinux-devel glibc gcc" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @@ -61,3 +60,4 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) rhts-lint $(METADATA) + diff --git a/libselinux/selinux_sestatus-functions/PURPOSE b/libselinux/selinux_sestatus-functions/PURPOSE index c638364..26011d7 100644 --- a/libselinux/selinux_sestatus-functions/PURPOSE +++ b/libselinux/selinux_sestatus-functions/PURPOSE @@ -1,3 +1,79 @@ PURPOSE of /CoreOS/libselinux/Sanity/selinux_sestatus-functions Description: Test sestatus.c functions Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on res.txt file content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Test +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:20:25 ] :: [ BEGIN ] :: Running './test > res.txt' +:: [ 06:20:25 ] :: [ PASS ] :: Command './test > res.txt' (Expected 0, got 0) +:: [ 06:20:25 ] :: [ BEGIN ] :: Running 'cat res.txt' +(before open) selinux_status_getenforce -1 +(before open) selinux_status_policyload -1 +(before open) selinux_status_deny_unknown -1 +(before open) selinux_status_updated -1 +selinux_status_open 0 +selinux_status_getenforce 1 +selinux_status_policyload 7 +selinux_status_deny_unknown 0 +selinux_status_updated 0 +selinux_status_close void +:: [ 06:20:26 ] :: [ LOG ] :: Output of 'cat res.txt': +:: [ 06:20:26 ] :: [ LOG ] :: --------------- OUTPUT START --------------- +:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_getenforce -1 +:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_policyload -1 +:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_deny_unknown -1 +:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_updated -1 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_open 0 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_getenforce 1 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_policyload 7 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_deny_unknown 0 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_updated 0 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_close void +:: [ 06:20:26 ] :: [ LOG ] :: --------------- OUTPUT END --------------- +:: [ 06:20:26 ] :: [ PASS ] :: Command 'cat res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_getenforce -1" res.txt' +(before open) selinux_status_getenforce -1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_getenforce -1" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_policyload -1" res.txt' +(before open) selinux_status_policyload -1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_policyload -1" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_deny_unknown -1" res.txt' +(before open) selinux_status_deny_unknown -1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_deny_unknown -1" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_updated -1" res.txt' +(before open) selinux_status_updated -1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_updated -1" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "selinux_status_open 0" res.txt' +selinux_status_open 0 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "selinux_status_open 0" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "selinux_status_getenforce 1" res.txt' +selinux_status_getenforce 1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "selinux_status_getenforce 1" res.txt' (Expected 0, got 0) +:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep -E "selinux_status_policyload [0-9]" res.txt' +selinux_status_policyload 7 +:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep -E "selinux_status_policyload [0-9]" res.txt' (Expected 0, got 0) +:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_deny_unknown 0" res.txt' +selinux_status_deny_unknown 0 +:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_deny_unknown 0" res.txt' (Expected 0, got 0) +:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_updated 0" res.txt' +selinux_status_updated 0 +:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_updated 0" res.txt' (Expected 0, got 0) +:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_close void" res.txt' +selinux_status_close void +:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_close void" res.txt' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 2s +:: Assertions: 12 good, 0 bad +:: RESULT: PASS (Test) diff --git a/libselinux/selinux_sestatus-functions/main.fmf b/libselinux/selinux_sestatus-functions/main.fmf index 53e4ba1..cb94b2f 100644 --- a/libselinux/selinux_sestatus-functions/main.fmf +++ b/libselinux/selinux_sestatus-functions/main.fmf @@ -1 +1,30 @@ -path: /libselinux/selinux_sestatus-functions +summary: Test sestatus.c functions +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc + - gcc +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - fusa +tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0535409 +extra-summary: /CoreOS/libselinux/Sanity/selinux_sestatus-functions +extra-task: /CoreOS/libselinux/Sanity/selinux_sestatus-functions diff --git a/libselinux/selinux_set_callback/main.fmf b/libselinux/selinux_set_callback/main.fmf index 3d61e91..e60ab41 100644 --- a/libselinux/selinux_set_callback/main.fmf +++ b/libselinux/selinux_set_callback/main.fmf @@ -1 +1,32 @@ -path: /libselinux/selinux_set_callback +summary: Test selinux_set_callback function +description: '' +contact: Milos Malik +component: + - libselinux +test: ./runtest.sh +framework: beakerlib +recommend: + - libselinux + - gcc + - glibc + - libselinux-devel +duration: 5m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - NoRHIVOS +tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0540241 +extra-summary: /CoreOS/libselinux/Sanity/selinux_set_callback +extra-task: /CoreOS/libselinux/Sanity/selinux_set_callback diff --git a/libselinux/selinux_set_callback/test_callback.c b/libselinux/selinux_set_callback/test_callback.c index 240bd11..9a4cd62 100644 --- a/libselinux/selinux_set_callback/test_callback.c +++ b/libselinux/selinux_set_callback/test_callback.c @@ -58,8 +58,8 @@ int main (int argc, char **argv) { } printf("calling avc_audit to call audit and log functions\n"); - - avc_init("", NULL, NULL, NULL, NULL); + + avc_open(NULL, 0); struct security_id ssid = { "asdf", 5 }; struct security_id tsid = { "asdf", 5 }; @@ -99,11 +99,9 @@ int main (int argc, char **argv) { if (enforcing == 1) { security_setenforce(0); - security_setenforce(1); } else { security_setenforce(1); - security_setenforce(0); } // triggers callbacks @@ -123,5 +121,14 @@ int main (int argc, char **argv) { // triggers callbacks avc_has_perm_noaudit(&ssid, &tsid, 0, 1, NULL, &avd); + printf("switch enforcing back to %d\n", enforcing); + enforcing = security_getenforce(); + if (enforcing == 1) { + security_setenforce(0); + } + else { + security_setenforce(1); + } + return exit_code; } diff --git a/libselinux/setenforce/PURPOSE b/libselinux/setenforce/PURPOSE index de8a77e..dd776a1 100644 --- a/libselinux/setenforce/PURPOSE +++ b/libselinux/setenforce/PURPOSE @@ -3,3 +3,43 @@ Author: Milos Malik Does setenforce work as expected? Does it produce correct audit messages? +Inputs + +Various setups related to setenforce + +Outputs + +Test passes or fail based on ausearch resutls + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: basic use +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 1' +:: [ 06:20:45 ] :: [ PASS ] :: Command 'setenforce 1' (Expected 0, got 0) +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'grep 1 /sys/fs/selinux/enforce' +1 +:: [ 06:20:45 ] :: [ PASS ] :: Command 'grep 1 /sys/fs/selinux/enforce' (Expected 0, got 0) +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 0' +:: [ 06:20:45 ] :: [ PASS ] :: Command 'setenforce 0' (Expected 0, got 0) +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'grep 0 /sys/fs/selinux/enforce' +0 +:: [ 06:20:45 ] :: [ PASS ] :: Command 'grep 0 /sys/fs/selinux/enforce' (Expected 0, got 0) +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 1' +:: [ 06:20:46 ] :: [ PASS ] :: Command 'setenforce 1' (Expected 0, got 0) +:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=1.*old_enforcing=0'' +type=MAC_STATUS msg=audit(03/10/2025 06:20:45.979:2609) : enforcing=1 old_enforcing=0 auid=root ses=10 enabled=1 old-enabled=1 lsm=selinux res=yes +:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=1.*old_enforcing=0'' (Expected 0, got 0) +:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=0.*old_enforcing=1'' +type=MAC_STATUS msg=audit(03/10/2025 06:20:45.759:2608) : enforcing=0 old_enforcing=1 auid=root ses=10 enabled=1 old-enabled=1 lsm=selinux res=yes +:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=0.*old_enforcing=1'' (Expected 0, got 0) +:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=SYSCALL.*comm=setenforce'' +type=SYSCALL msg=audit(03/10/2025 06:20:45.759:2608) : arch=aarch64 syscall=write success=yes exit=1 a0=0x3 a1=0xffffd04eebc0 a2=0x1 a3=0xff78bbc00020 items=0 ppid=75829 pid=79376 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10 comm=setenforce exe=/usr/sbin/setenforce subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SYSCALL msg=audit(03/10/2025 06:20:45.979:2609) : arch=aarch64 syscall=write success=yes exit=1 a0=0x3 a1=0xffffc38319d0 a2=0x1 a3=0xff32e45b8020 items=0 ppid=75829 pid=79426 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10 comm=setenforce exe=/usr/sbin/setenforce subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=SYSCALL.*comm=setenforce'' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 7s +:: Assertions: 8 good, 0 bad +:: RESULT: PASS (basic use) diff --git a/libselinux/setenforce/main.fmf b/libselinux/setenforce/main.fmf index 11ebcd7..7b178b8 100644 --- a/libselinux/setenforce/main.fmf +++ b/libselinux/setenforce/main.fmf @@ -1 +1,35 @@ -path: /libselinux/setenforce +summary: Does setenforce work as expected? Does it produce correct audit messages? +description: |+ + Does setenforce work as expected? Does it produce correct audit messages? + +contact: Milos Malik +component: + - libselinux +recommend: + - audit + - libselinux + - libselinux-utils + - e2fsprogs +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - fusa +tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false + - when: distro >= rhel-10 + recommend+: + - audit-rules + because: since RHEL 10 package audit was split and early packages have wrong dependency +extra-nitrate: TC#0543754 +extra-summary: /CoreOS/libselinux/Sanity/setenforce +extra-task: /CoreOS/libselinux/Sanity/setenforce diff --git a/libselinux/setenforce/runtest.sh b/libselinux/setenforce/runtest.sh index a4140d3..7bddb5d 100755 --- a/libselinux/setenforce/runtest.sh +++ b/libselinux/setenforce/runtest.sh @@ -50,6 +50,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "basic use" + rlRun "which auditctl" 0 "'auditctl' have to be present for proper functioning, failing test otherwise" START_DATE_TIME=`date "+%m/%d/%Y %T"` sleep 1 rlRun "setenforce 1" diff --git a/libselinux/setfiles-in-chroot-env/Makefile b/libselinux/setfiles-in-chroot-env/Makefile new file mode 100644 index 0000000..7d5c948 --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/Makefile @@ -0,0 +1,66 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libselinux/Regression/setfiles-in-chroot-env +# Description: Does setfiles work correctly in chroot environment? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libselinux/Regression/setfiles-in-chroot-env +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE test-script.sh + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x test-script.sh || chmod a+x test-script.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does setfiles work correctly in chroot environment?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: libselinux" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: libselinux policycoreutils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2094683" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/libselinux/setfiles-in-chroot-env/PURPOSE b/libselinux/setfiles-in-chroot-env/PURPOSE new file mode 100644 index 0000000..5402a21 --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/libselinux/Regression/setfiles-in-chroot-env +Author: Milos Malik + +Does setfiles work correctly in chroot environment? + diff --git a/libselinux/setfiles-in-chroot-env/main.fmf b/libselinux/setfiles-in-chroot-env/main.fmf new file mode 100644 index 0000000..9c3dae5 --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/main.fmf @@ -0,0 +1,22 @@ +summary: Does setfiles work correctly in chroot environment? +description: | + Does setfiles work correctly in chroot environment? + +contact: Milos Malik +component: + - libselinux +test: ./runtest.sh +framework: beakerlib +recommend: + - libselinux + - policycoreutils +duration: 15m +enabled: true +tag: + - targeted + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094683 +extra-summary: /CoreOS/libselinux/Regression/setfiles-in-chroot-env +extra-task: /CoreOS/libselinux/Regression/setfiles-in-chroot-env +extra-nitrate: TC#0613958 diff --git a/libselinux/setfiles-in-chroot-env/runtest.sh b/libselinux/setfiles-in-chroot-env/runtest.sh new file mode 100755 index 0000000..0ddda9b --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/runtest.sh @@ -0,0 +1,67 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libselinux/Regression/setfiles-in-chroot-env +# Description: Does setfiles work correctly in chroot environment? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libselinux" +CHROOT_DIR=`mktemp -d` +INSTALL_OPTION="" +if yum --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if yum install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if yum install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi +# detect release version +test -e /etc/os-release && os_release='/etc/os-release' || os_release='/usr/lib/os-release' +. "${os_release}" +INSTALL_OPTION="${INSTALL_OPTION} --releasever ${VERSION_ID}" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm policycoreutils + rlPhaseEnd + + rlPhaseStartTest "bz#2094683" + rlRun "yum -y install filesystem policycoreutils selinux-policy-targeted --installroot=${CHROOT_DIR} ${INSTALL_OPTION}" + rlRun "cp ./test-script.sh ${CHROOT_DIR}/usr/bin/" + rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.sh" + rlRun "grep -i -e 'no such file or directory' -e 'not set context' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf ${CHROOT_DIR}" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/libselinux/setfiles-in-chroot-env/test-script.sh b/libselinux/setfiles-in-chroot-env/test-script.sh new file mode 100755 index 0000000..d20ba83 --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/test-script.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +sestatus +ls -lZ / +/usr/sbin/setfiles -F /etc/selinux/targeted/contexts/files/file_contexts / +ls -lZ / + diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf index a23f02f..08b1b92 100644 --- a/libselinux/validatetrans/main.fmf +++ b/libselinux/validatetrans/main.fmf @@ -1,4 +1,47 @@ -path: /libselinux/validatetrans -adjust: -- enabled: false - when: distro < fedora-32 +summary: Does the validatetrans tool work as expected? +description: |+ + Does the validatetrans tool work as expected? + +contact: Milos Malik +component: + - libselinux +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - f33friendly + - targeted + - NoRHIVOS +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the validatetrans program is not available there + - enabled: false + when: distro < Fedora-32 + continue: false +extra-nitrate: TC#0606254 +extra-summary: /CoreOS/libselinux/Sanity/validatetrans +extra-task: /CoreOS/libselinux/Sanity/validatetrans diff --git a/libselinux/validatetrans/runtest.sh b/libselinux/validatetrans/runtest.sh index 2b201df..ab468eb 100755 --- a/libselinux/validatetrans/runtest.sh +++ b/libselinux/validatetrans/runtest.sh @@ -27,21 +27,20 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" rlJournalStart # validatetrans utility is available since Fedora 32 - if ! rlIsRHEL ">8" && ! rlIsFedora ">31"; then + if ! rlIsRHEL ">8" && ! rlIsFedora ">31" && ! rlIsCentOS ">8" ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlAssertRpm ${PACKAGE} rlRun "rpm -qf `which validatetrans`" rlRun "rpm -qf `which seinfo`" @@ -86,11 +85,11 @@ rlJournalStart rlPhaseStartTest "incomplete or invalid parameters" # first context incomplete - rlRun "validatetrans unconfined_u:object_r:bin_t: unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'" + rlRun "validatetrans unconfined_u:object_r:bin_t: unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i -e 'invalid argument' -e 'invalid source context'" # second context incomplete - rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t: file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'" + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t: file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i -e 'invalid argument' -e 'invalid target context'" # third context incomplete - rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t: 2>&1 | grep -i 'invalid argument'" + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t: 2>&1 | grep -i -e 'invalid argument' -e 'invalid new context'" # invalid target class rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 xyz unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid class'" rlPhaseEnd diff --git a/libsemanage/cross-device-link-in-containers/Makefile b/libsemanage/cross-device-link-in-containers/Makefile new file mode 100644 index 0000000..d9930e4 --- /dev/null +++ b/libsemanage/cross-device-link-in-containers/Makefile @@ -0,0 +1,65 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libsemanage/Regression/cross-device-link-in-containers +# Description: Does rebuild of policy affect layered containers? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsemanage/Regression/cross-device-link-in-containers +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does rebuild of policy affect layered containers?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: libsemanage" >> $(METADATA) + @echo "Requires: libsemanage podman policycoreutils selinux-policy libselinux-utils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2068085" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-70632" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/libsemanage/cross-device-link-in-containers/PURPOSE b/libsemanage/cross-device-link-in-containers/PURPOSE new file mode 100644 index 0000000..1f8a6d1 --- /dev/null +++ b/libsemanage/cross-device-link-in-containers/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/libsemanage/Regression/cross-device-link-in-containers +Author: Milos Malik + +Description: Does rebuild of policy affect layered containers? + diff --git a/libsemanage/cross-device-link-in-containers/main.fmf b/libsemanage/cross-device-link-in-containers/main.fmf new file mode 100644 index 0000000..834fcf4 --- /dev/null +++ b/libsemanage/cross-device-link-in-containers/main.fmf @@ -0,0 +1,31 @@ +summary: Does rebuild of policy affect layered containers? +description: |+ + Does rebuild of policy affect layered containers? + +contact: Milos Malik +component: + - libsemanage +recommend: + - libsemanage + - podman + - policycoreutils + - selinux-policy + - libselinux-utils +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068085 + - verifies: https://issues.redhat.com/browse/RHEL-70632 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/libsemanage/Regression/cross-device-link-in-containers +extra-task: /CoreOS/libsemanage/Regression/cross-device-link-in-containers +extra-nitrate: TC#0613557 diff --git a/libsemanage/cross-device-link-in-containers/runtest.sh b/libsemanage/cross-device-link-in-containers/runtest.sh new file mode 100755 index 0000000..bcf74b5 --- /dev/null +++ b/libsemanage/cross-device-link-in-containers/runtest.sh @@ -0,0 +1,87 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libsemanage/Regression/cross-device-link-in-containers +# Description: Does rebuild of policy affect layered containers? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libsemanage" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm podman + rlRun "semodule -lfull | grep -e container -e podman" + rlRun "getsebool -a | grep -e container -e podman" + rlRun "mkdir selinux1 selinux2" + rlPhaseEnd + + rlPhaseStartTest "bz#2068085" + rlRun "pushd selinux1" + if rlIsCentOS 8 || rlIsRHEL 8 ; then + STREAM_ID="centos/centos:stream8" + elif rlIsCentOS 9 || rlIsRHEL 9 ; then + STREAM_ID="centos/centos:stream9" + elif rlIsCentOS 10 || rlIsRHEL 10 ; then + STREAM_ID="centos/centos:stream10" + else + STREAM_ID="fedora/fedora:rawhide" + fi +cat <> ./Dockerfile +FROM quay.io/${STREAM_ID} +RUN dnf install -y selinux-policy selinux-policy-targeted +EOF + rlRun "cat ./Dockerfile" + rlRun -s "podman build -t localhost/selinux . --no-cache" + rlAssertGrep "^complete" $rlRun_LOG -i + rlAssertGrep "^commit" $rlRun_LOG -i + rlAssertNotGrep "not supported" $rlRun_LOG -i + rlRun "popd" + + rlRun "pushd selinux2" +cat <> ./Dockerfile +FROM localhost/selinux +RUN semodule -B +EOF + rlRun "cat ./Dockerfile" + rlRun -s "podman build -t localhost/selinux2 . --no-cache" + rlAssertNotGrep "error" $rlRun_LOG -i + rlAssertNotGrep "failed" $rlRun_LOG -i + rlAssertNotGrep "not supported" $rlRun_LOG -i + rlRun "popd" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf selinux1 selinux2" + rlRun "podman images" + for ID in `podman images -q` ; do + rlRun "podman rmi $ID" + done + rlRun "podman images" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/libsemanage/sanity-tests/Makefile b/libsemanage/sanity-tests/Makefile index 23ef6ac..3d8ffa9 100644 --- a/libsemanage/sanity-tests/Makefile +++ b/libsemanage/sanity-tests/Makefile @@ -51,7 +51,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Test libsemanage functions" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 60m" >> $(METADATA) + @echo "TestTime: 2h" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) @echo "Requires: libsemanage libsemanage-devel gcc CUnit CUnit-devel checkpolicy policycoreutils-python-utils" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/libsemanage/sanity-tests/main.fmf b/libsemanage/sanity-tests/main.fmf index 9c7a7e1..e5e8f4f 100644 --- a/libsemanage/sanity-tests/main.fmf +++ b/libsemanage/sanity-tests/main.fmf @@ -1 +1,44 @@ -path: /libsemanage/sanity-tests +summary: Test libsemanage functions +description: '' +contact: Milos Malik +component: + - libsemanage +recommend: + - libsemanage + - libsemanage-devel + - gcc + - CUnit + - CUnit-devel + - checkpolicy + - policycoreutils-python-utils +duration: 2h +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - f31friendly + - f32friendly + - failinfedora + - rhel8-buildroot + - rhel8-crb + - rhel9-buildroot + - targeted +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1636973 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false + - enabled: false + when: distro == rhel-7 and arch == s390x + continue: false + - enabled: false + when: distro == rhel-alt-7 and arch == s390x + continue: false +extra-nitrate: TC#0547810 +extra-summary: /CoreOS/libsemanage/Sanity/sanity-tests +extra-task: /CoreOS/libsemanage/Sanity/sanity-tests diff --git a/libsemanage/sanity-tests/runtest.sh b/libsemanage/sanity-tests/runtest.sh index 0b1785b..b615086 100755 --- a/libsemanage/sanity-tests/runtest.sh +++ b/libsemanage/sanity-tests/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libsemanage" @@ -35,7 +34,7 @@ rlJournalStart rlPhaseStartSetup rlRun "rlImport --all" || rlDie - rlRun "rlCheckMakefileRequires" || rlDie + rlRun "rlCheckDependencies" || rlDie VERS=$(rpm -q $PACKAGE | cut -f 2 -d '-') VERS_MAJOR=$(echo $VERS | cut -f 1 -d '.') diff --git a/libsemanage/sanity-tests/tests/test_handle.c b/libsemanage/sanity-tests/tests/test_handle.c index 810014d..a508043 100644 --- a/libsemanage/sanity-tests/tests/test_handle.c +++ b/libsemanage/sanity-tests/tests/test_handle.c @@ -102,12 +102,8 @@ void test_connect(void) { void test_disconnect(void) { setup_handle(SH_NULL); - CU_ASSERT_SIGNAL(semanage_disconnect(sh), SIGABRT); - helper_handle_create(); - CU_ASSERT_SIGNAL(semanage_disconnect(sh), SIGABRT); - helper_connect(); CU_ASSERT(semanage_disconnect(sh) >= 0); diff --git a/libsemanage/semanage-handle-functions/Makefile b/libsemanage/semanage-handle-functions/Makefile new file mode 100644 index 0000000..c49dbe0 --- /dev/null +++ b/libsemanage/semanage-handle-functions/Makefile @@ -0,0 +1,63 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libsemanage/Sanity/semanage-handle-functions +# Description: Test functions from handle.h +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsemanage/Sanity/semanage-handle-functions +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE functions.c test_*.c + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Jan Zarsky " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test functions from handle.h" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: libsemanage" >> $(METADATA) + @echo "Requires: libsemanage libsemanage-devel glibc gcc" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/libsemanage/semanage-handle-functions/PURPOSE b/libsemanage/semanage-handle-functions/PURPOSE new file mode 100644 index 0000000..09a8e19 --- /dev/null +++ b/libsemanage/semanage-handle-functions/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/libsemanage/Sanity/semanage-handle-functions +Description: Test functions from handle.h +Author: Jan Zarsky diff --git a/libsemanage/semanage-handle-functions/functions.c b/libsemanage/semanage-handle-functions/functions.c new file mode 100644 index 0000000..7722c09 --- /dev/null +++ b/libsemanage/semanage-handle-functions/functions.c @@ -0,0 +1,132 @@ +#include +#include +#include +#include +#include + +void check_result_int(const char *expected, int real) { + int exp = strtol(expected, NULL, 10); + + if (exp != real) { + fprintf(stderr, "Expected %d but got %d\n", exp, real); + exit(1); + } +} + +semanage_handle_t *test_handle_create() { + semanage_handle_t *sh = NULL; + + sh = semanage_handle_create(); + printf("semanage_handle_create(): %p\n", (void *) sh); + + if (sh == NULL) { + perror("semanage_handle_create"); + exit(1); + } + + return sh; +} + +int test_connect(semanage_handle_t *sh) { + int result = semanage_connect(sh); + printf("semanage_connect(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_connect"); + exit(1); + } + + return result; +} + +int test_disconnect(semanage_handle_t *sh) { + int result = semanage_disconnect(sh); + printf("semanage_disconnect(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_disconnect"); + exit(1); + } + + return result; +} + +int test_begin_transaction(semanage_handle_t *sh) { + int result = semanage_begin_transaction(sh); + printf("semanage_begin_transaction(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_begin_transaction"); + exit(1); + } + + return result; +} + +int test_commit(semanage_handle_t *sh) { + int result = semanage_commit(sh); + printf("semanage_commit(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_commit"); + exit(1); + } + + return result; +} + +#define STATE_INIT 1 +#define STATE_HANDLE 2 +#define STATE_CONN 3 +#define STATE_TRANS 4 + +int get_state(const char *state_str) { + if (strcmp(state_str, "init") == 0) + return STATE_INIT; + if (strcmp(state_str, "handle") == 0) + return STATE_HANDLE; + if (strcmp(state_str, "conn") == 0) + return STATE_CONN; + if (strcmp(state_str, "trans") == 0) + return STATE_TRANS; + + return 0; +} + +semanage_handle_t * get_handle(const char *state_str) { + int state; + semanage_handle_t *sh = NULL; + + state = get_state(state_str); + + if (state >= STATE_INIT) + sh = NULL; + + if (state >= STATE_HANDLE) + sh = test_handle_create(); + + if (state >= STATE_CONN) + test_connect(sh); + + if (state >= STATE_TRANS) + test_begin_transaction(sh); + + return sh; +} + +void destroy_handle(semanage_handle_t *sh, const char *state_str) { + int state; + + state = get_state(state_str); + + if (state >= STATE_TRANS) + test_commit(sh); + + if (state >= STATE_CONN) + test_disconnect(sh); + + if (state >= STATE_HANDLE) { + semanage_handle_destroy(sh); + printf("semanage_handle_destroy(%p)\n", (void *) sh); + } +} diff --git a/libsemanage/semanage-handle-functions/main.fmf b/libsemanage/semanage-handle-functions/main.fmf new file mode 100644 index 0000000..0c6e3c5 --- /dev/null +++ b/libsemanage/semanage-handle-functions/main.fmf @@ -0,0 +1,32 @@ +summary: Test functions from handle.h +description: '' +contact: Milos Malik +component: + - libsemanage +test: ./runtest.sh +framework: beakerlib +recommend: + - libsemanage + - libsemanage-devel + - glibc + - gcc +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - f31friendly + - f32friendly + - rhel8-buildroot + - rhel9-buildroot +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0546220 +extra-summary: /CoreOS/libsemanage/Sanity/semanage-handle-functions +extra-task: /CoreOS/libsemanage/Sanity/semanage-handle-functions diff --git a/libsemanage/semanage-handle-functions/plan.txt b/libsemanage/semanage-handle-functions/plan.txt new file mode 100644 index 0000000..521a914 --- /dev/null +++ b/libsemanage/semanage-handle-functions/plan.txt @@ -0,0 +1,29 @@ + init handle conn trans +semanage_set_root x ok ok ok - +semanage_root x ok ok ok - +semanage_handle_create x ok - - - +semanage_set_rebuild fail ok ok - +semanage_set_reload fail ok ok - +semanage_get_hll_compiler_path fail ? ? - +semanage_set_create_store fail ok ok - should be called after connect +semanage_get_disable_dontaudit fail ? ? - +semanage_set_disable_dontaudit fail ? ? - +semanage_get_preserve_tunables fail ? ? - +semanage_set_preserve_tunables fail ? ? - +semanage_get_ignore_module_cache fail ? ? - +semanage_set_ignore_module_cache fail ? ? - +semanage_set_check_contexts fail ok ok - +semanage_get_default_priority fail ok ok - +semanage_set_default_priority fail ok ok - +semanage_is_connected x fail ok ok - +semanage_select_store fail ok ok - should be called before connect +semanage_set_store_root fail ok ok - +semanage_is_managed x fail ok fail - +semanage_mls_enabled x fail ? ok - +semanage_connect x fail ok ? - +semanage_access_check x fail ok ? - +semanage_disconnect x fail fail ok - ok when disconnected twice +semanage_handle_destroy x fail ok ok - +semanage_begin_transaction x fail fail ok ok ok when begin twice +semanage_commit x fail fail fail ok +semanage_reload_policy fail ? ? ? diff --git a/libsemanage/semanage-handle-functions/runtest.sh b/libsemanage/semanage-handle-functions/runtest.sh new file mode 100755 index 0000000..e29a22b --- /dev/null +++ b/libsemanage/semanage-handle-functions/runtest.sh @@ -0,0 +1,120 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libsemanage/Sanity/semanage-handle-functions +# Description: Test functions from handle.h +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libsemanage" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-devel + rlAssertRpm "glibc" + rlAssertRpm "gcc" + + if rlIsRHEL ">=7" || rlIsFedora || rlIsCentOS ">=7" ; then + rlRun -l "gcc test_root.c -o test_root -lsemanage -Wall -Wextra -std=c99" + fi + + rlRun -l "gcc test_handle_create.c -o test_handle_create -lsemanage -Wall -Wextra -Wno-unused-parameter -std=c99" + rlRun -l "gcc test_access_check.c -o test_access_check -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_is_managed.c -o test_is_managed -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_connect.c -o test_connect -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_is_connected.c -o test_is_connected -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_mls_enabled.c -o test_mls_enabled -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_transaction.c -o test_transaction -lsemanage -Wall -Wextra -std=c99" + + ERR_FAIL=1 + ERR_ABORT=134 + rlPhaseEnd + + if rlIsRHEL ">=7" || rlIsFedora || rlIsCentOS ">=7" ; then + rlPhaseStartTest "semanage_root, semanage_test_root" + rlRun "./test_root init" + rlRun "./test_root handle" + rlRun "./test_root conn" + rlRun "./test_root init /somepath" + rlRun "./test_root handle /somepath" + rlRun "./test_root conn /somepath" + rlPhaseEnd + fi + + rlPhaseStartTest "semanage_handle_create, semanage_handle_destroy" + rlRun "./test_handle_create init" + rlPhaseEnd + + rlPhaseStartTest "semanage_access_check" + rlRun "./test_access_check init" $ERR_ABORT + rlRun "./test_access_check handle 2" + rlRun "./test_access_check conn 2" + rlPhaseEnd + + rlPhaseStartTest "semanage_is_managed" + rlRun "./test_is_managed init" $ERR_ABORT + rlRun "./test_is_managed handle 1" + rlRun "./test_is_managed conn" $ERR_FAIL + rlPhaseEnd + + rlPhaseStartTest "semanage_connect, semanage_disconnect" + rlRun "./test_connect init" $ERR_ABORT + rlRun "./test_connect init reversed" $ERR_ABORT + rlRun "./test_connect handle" + rlRun "./test_connect handle twice" + # why does it work?? + rlRun "./test_connect conn" + rlPhaseEnd + + rlPhaseStartTest "semanage_is_connected" + rlRun "./test_is_connected init" $ERR_ABORT + rlRun "./test_is_connected handle 0" + rlRun "./test_is_connected conn 1" + rlPhaseEnd + + rlPhaseStartTest "semanage_mls_enabled" + rlRun "./test_mls_enabled init" $ERR_ABORT + rlRun "./test_mls_enabled handle" $ERR_ABORT + rlRun "./test_mls_enabled conn 1" + rlPhaseEnd + + rlPhaseStartTest "semanage_begin_transaction, semanage_commit" + rlRun "./test_transaction init" $ERR_ABORT + rlRun "./test_transaction init reversed" $ERR_ABORT + rlRun "./test_transaction handle" $ERR_ABORT + rlRun "./test_transaction handle reversed" $ERR_ABORT + rlRun "./test_transaction conn" + rlRun "./test_transaction conn twice" + rlRun "./test_transaction conn reversed" $ERR_FAIL + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f output test_root test_handle_create test_access_check \ + test_is_managed test_connect test_is_connected \ + test_mls_enabled test_transaction" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/libsemanage/semanage-handle-functions/test_access_check.c b/libsemanage/semanage-handle-functions/test_access_check.c new file mode 100644 index 0000000..8eb2530 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_access_check.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + int result = semanage_access_check(sh); + printf("semanage_access_check(%p): %d\n", (void *) sh, result); + + if (result < 0 || (result != 0 && result != SEMANAGE_CAN_READ + && result != SEMANAGE_CAN_WRITE)) { + perror("semanage_access_check"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], result); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_connect.c b/libsemanage/semanage-handle-functions/test_connect.c new file mode 100644 index 0000000..df403e0 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_connect.c @@ -0,0 +1,33 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + if (argc >= 3 && strcmp(argv[2], "reversed") == 0) { + test_disconnect(sh); + test_connect(sh); + } + else { + test_connect(sh); + test_disconnect(sh); + } + + if (argc >= 3 && strcmp(argv[2], "twice") == 0) { + test_disconnect(sh); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_handle_create.c b/libsemanage/semanage-handle-functions/test_handle_create.c new file mode 100644 index 0000000..65d164e --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_handle_create.c @@ -0,0 +1,15 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh = test_handle_create(); + + semanage_handle_destroy(sh); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_is_connected.c b/libsemanage/semanage-handle-functions/test_is_connected.c new file mode 100644 index 0000000..d428e48 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_is_connected.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + int result; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + result = semanage_is_connected(sh); + printf("semanage_is_connected(%p): %d\n", (void *) sh, result); + + if (result != 0 && result != 1) { + perror("semanage_is_connected"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], result); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_is_managed.c b/libsemanage/semanage-handle-functions/test_is_managed.c new file mode 100644 index 0000000..4d11cb0 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_is_managed.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + int result; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + result = semanage_is_managed(sh); + printf("semanage_is_managed(%p): %d\n", (void *) sh, result); + + if (result != 0 && result != 1) { + perror("semanage_is_managed"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], result); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_mls_enabled.c b/libsemanage/semanage-handle-functions/test_mls_enabled.c new file mode 100644 index 0000000..7e943f0 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_mls_enabled.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + int result; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + result = semanage_mls_enabled(sh); + printf("semanage_mls_enabled(%p): %d\n", (void *) sh, result); + + if (result != 0 && result != 1) { + perror("semanage_mls_enabled"); + exit(1); + } + + if (argc >= 4) + check_result_int(argv[3], result); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_root.c b/libsemanage/semanage-handle-functions/test_root.c new file mode 100644 index 0000000..5786348 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_root.c @@ -0,0 +1,53 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + const char *root; + int result; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + root = semanage_root(); + printf("semanage_root(): %s\n", root); + + if (root == NULL) { + perror("semanage_root"); + exit(1); + } + + if (argc >= 3) { + result = semanage_set_root(argv[2]); + printf("semanage_set_root(\"%s\"): %d\n", argv[2], result); + + if (root == NULL) { + perror("semanage_set_root"); + exit(1); + } + + root = semanage_root(); + printf("semanage_root(): %s\n", root); + + if (result != 0) { + perror("semanage_root"); + exit(1); + } + + if (strcmp(root, argv[2]) != 0) { + fprintf(stderr, "Expected \"%s\" but got \"%s\"\n", argv[2], root); + exit(1); + } + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_transaction.c b/libsemanage/semanage-handle-functions/test_transaction.c new file mode 100644 index 0000000..f1b0e10 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_transaction.c @@ -0,0 +1,34 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + if (argc >= 3 && strcmp(argv[2], "reversed") == 0) { + test_commit(sh); + test_begin_transaction(sh); + } + else if (argc >= 3 && strcmp(argv[2], "twice") == 0) { + test_begin_transaction(sh); + test_begin_transaction(sh); + test_commit(sh); + } + else { + test_begin_transaction(sh); + test_commit(sh); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-root-on-nfs/main.fmf b/libsemanage/semanage-root-on-nfs/main.fmf new file mode 100644 index 0000000..e115bf3 --- /dev/null +++ b/libsemanage/semanage-root-on-nfs/main.fmf @@ -0,0 +1,16 @@ +summary: Test semanage operation with /var/lib/selinux on NFS +test: ./test.sh +framework: beakerlib +component: libsemanage +require: + - nfs-utils + - policycoreutils-python-utils +duration: 10m +enabled: true +tag: + - NoRHIVOS + - avoidImageMode +link: + - verifies: https://issues.redhat.com/browse/RHEL-60503 +extra-nitrate: TC#0617969 +id: 2d20011e-cab6-43a6-8a82-9bb0a7c9736b diff --git a/libsemanage/semanage-root-on-nfs/test.sh b/libsemanage/semanage-root-on-nfs/test.sh new file mode 100755 index 0000000..d7c944a --- /dev/null +++ b/libsemanage/semanage-root-on-nfs/test.sh @@ -0,0 +1,44 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*- +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +STORE_ROOT=$( grep -E '^store-root' /etc/selinux/semanage.conf | tr -d ' ' | cut -d '=' -f 2 ) +if [ -z "$STORE_ROOT" ]; then + STORE_ROOT=/var/lib/selinux +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlAssertRpm nfs-utils + rlAssertRpm policycoreutils-python-utils + rlRun "mkdir -p /srv/nfs/selinux" + rlRun "cp -r $STORE_ROOT /srv/selinux" + rlRun "mount --bind /srv/selinux /srv/nfs/selinux" + rlRun "sed -i 's%.*rootdir.*=.*%rootdir=/srv/nfs%' /etc/nfs.conf" + rlRun "systemctl enable nfs-server --now" + rlRun "cat > /etc/exports < +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsemanage/Sanity/semanage-seuser-functions +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE functions.c test_*.c + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Jan Zarsky " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test semanage_seuser_* functions" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: libsemanage" >> $(METADATA) + @echo "Requires: libsemanage libsemanage-devel glibc gcc" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/libsemanage/semanage-seuser-functions/PURPOSE b/libsemanage/semanage-seuser-functions/PURPOSE new file mode 100644 index 0000000..6b5201a --- /dev/null +++ b/libsemanage/semanage-seuser-functions/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/libsemanage/Sanity/semanage-seuser-functions +Description: Test semanage_seuser_* functions +Author: Jan Zarsky diff --git a/libsemanage/semanage-seuser-functions/functions.c b/libsemanage/semanage-seuser-functions/functions.c new file mode 100644 index 0000000..b4152ed --- /dev/null +++ b/libsemanage/semanage-seuser-functions/functions.c @@ -0,0 +1,263 @@ +#include +#include +#include +#include +#include + +void check_result_int(const char *expected, int real) { + int exp = strtol(expected, NULL, 10); + + if (exp != real) { + fprintf(stderr, "Expected %d but got %d\n", exp, real); + exit(1); + } +} + +semanage_handle_t *test_handle_create() { + semanage_handle_t *sh = NULL; + + sh = semanage_handle_create(); + printf("semanage_handle_create(): %p\n", (void *) sh); + + if (sh == NULL) { + perror("semanage_handle_create"); + exit(2); + } + + return sh; +} + +int test_connect(semanage_handle_t *sh) { + int result = semanage_connect(sh); + printf("semanage_connect(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_connect"); + exit(2); + } + + return result; +} + +int test_disconnect(semanage_handle_t *sh) { + int result = semanage_disconnect(sh); + printf("semanage_disconnect(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_disconnect"); + exit(2); + } + + return result; +} + +int test_begin_transaction(semanage_handle_t *sh) { + int result = semanage_begin_transaction(sh); + printf("semanage_begin_transaction(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_begin_transaction"); + exit(2); + } + + return result; +} + +int test_commit(semanage_handle_t *sh) { + int result = semanage_commit(sh); + printf("semanage_commit(%p): %d\n", (void *) sh, result); + + if (result < 0) { + perror("semanage_commit"); + exit(2); + } + + return result; +} + +semanage_seuser_key_t *test_get_key(semanage_handle_t *sh, const char *name) { + semanage_seuser_key_t *key; + int result = semanage_seuser_key_create(sh, name, &key); + printf("semanage_seuser_key_create(%p, %s, %p): %d\n", + (void *) sh, name, (void *) &key, result); + + if (key == NULL || result < 0) { + perror("semanage_seuser_key_create"); + exit(2); + } + + return key; +} + +semanage_seuser_t *test_get_seuser_nth(semanage_handle_t *sh, unsigned int index) { + int result; + semanage_seuser_t **records; + unsigned int count; + + result = semanage_seuser_list(sh, &records, &count); + printf("semanage_seuser_list(%p, %p, %p): %d\n", + (void *) sh, (void *) &records, (void *) &count, result); + + if (result < 0) { + perror("semanage_seuser_list"); + exit(2); + } + + if (count < index + 1) + exit(2); + + return records[index]; +} + +semanage_seuser_t *test_get_seuser_new(semanage_handle_t *sh) { + int result; + semanage_seuser_t *seuser; + + result = semanage_seuser_create(sh, &seuser); + printf("semanage_seuser_create(%p, %p): %d\n", + (void *) sh, (void *) seuser, result); + + if (result < 0) { + perror("semanage_seuser_create"); + exit(2); + } + + return seuser; +} + +semanage_seuser_t *test_get_seuser(semanage_handle_t *sh, const char *param) { + if (strcmp(param, "new") == 0) + return test_get_seuser_new(sh); + + if (strcmp(param, "first") == 0) + return test_get_seuser_nth(sh, 0); + + if (strcmp(param, "second") == 0) + return test_get_seuser_nth(sh, 1); + + fprintf(stderr, "Unknown seuser \"%s\" specified\n", param); + exit(2); +} + +void test_add_local_seuser(semanage_handle_t *sh, semanage_seuser_t *seuser) { + int result; + semanage_seuser_key_t *key; + + result = semanage_seuser_key_extract(sh, seuser, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_modify_local(sh, key, seuser); + printf("semanage_seuser_modify_local(%p, %p, %p): %d\n", + (void *) seuser, (void *) key, (void *) seuser, result); + + if (result < 0) { + perror("semanage_seuser_modify_local"); + exit(2); + } +} + +void test_del_local_seuser(semanage_handle_t *sh, semanage_seuser_t *seuser) { + int result; + semanage_seuser_key_t *key; + + result = semanage_seuser_key_extract(sh, seuser, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_del_local(sh, key); + printf("semanage_seuser_del_local(%p, %p): %d\n", + (void *) seuser, (void *) key, result); + + if (result < 0) { + perror("semanage_seuser_del_local"); + exit(2); + } +} + +#define STATE_INIT 1 +#define STATE_HANDLE 2 +#define STATE_CONN 3 +#define STATE_TRANS 4 + +int get_state(const char *state_str) { + if (strcmp(state_str, "init") == 0) + return STATE_INIT; + if (strcmp(state_str, "handle") == 0) + return STATE_HANDLE; + if (strcmp(state_str, "conn") == 0) + return STATE_CONN; + if (strcmp(state_str, "trans") == 0) + return STATE_TRANS; + + return 0; +} + +semanage_handle_t * get_handle(const char *state_str) { + int state; + semanage_handle_t *sh = NULL; + + state = get_state(state_str); + + if (state >= STATE_INIT) + sh = NULL; + + if (state >= STATE_HANDLE) + sh = test_handle_create(); + + if (state >= STATE_CONN) + test_connect(sh); + + if (state >= STATE_TRANS) + test_begin_transaction(sh); + + return sh; +} + +void destroy_handle(semanage_handle_t *sh, const char *state_str) { + int state; + + state = get_state(state_str); + + if (state >= STATE_TRANS) + test_commit(sh); + + if (state >= STATE_CONN) + test_disconnect(sh); + + if (state >= STATE_HANDLE) { + semanage_handle_destroy(sh); + printf("semanage_handle_destroy(%p)\n", (void *) sh); + } +} + +int strcmp_null(const char *str1, const char *str2) { + if (str1 == NULL && str2 == NULL) + return 0; + + if (str1 == NULL) { + if (strcmp(str2, "NULL") == 0) + return 0; + else + return -1; + } + + if (str2 == NULL) { + if (strcmp(str1, "NULL") == 0) + return 0; + else + return 1; + } + + return strcmp(str1, str2); +} diff --git a/libsemanage/semanage-seuser-functions/main.fmf b/libsemanage/semanage-seuser-functions/main.fmf new file mode 100644 index 0000000..58089d1 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/main.fmf @@ -0,0 +1,29 @@ +summary: Test semanage_seuser_* functions +description: '' +contact: Milos Malik +component: + - libsemanage +test: ./runtest.sh +framework: beakerlib +recommend: + - libsemanage + - libsemanage-devel + - glibc + - gcc +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - f32friendly + - f33friendly + - rhel8-buildroot + - targeted + - avoidImageMode +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0546750 +extra-summary: /CoreOS/libsemanage/Sanity/semanage-seuser-functions +extra-task: /CoreOS/libsemanage/Sanity/semanage-seuser-functions diff --git a/libsemanage/semanage-seuser-functions/runtest.sh b/libsemanage/semanage-seuser-functions/runtest.sh new file mode 100755 index 0000000..766a800 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/runtest.sh @@ -0,0 +1,257 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libsemanage/Sanity/semanage-seuser-functions +# Description: Test semanage_seuser_* functions +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libsemanage" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-devel + rlAssertRpm "glibc" + rlAssertRpm "gcc" + + for f in test_*.c ; do + out=$(echo -n $f | cut -d'.' -f1) + rlRun "gcc $f -o $out -lsemanage -Wall -Wextra -Werror -std=c99" + done + + POLICY_TYPE="$(grep -E '^SELINUXTYPE=' /etc/selinux/config | cut -d'=' -f2 | tr '[:upper:]' '[:lower:]' | tr -d ' ')" + + if rlIsFedora; then + SEUSERS_PATH="/var/lib/selinux/$POLICY_TYPE/active/seusers" + elif rlIsRHEL '<=7'; then + SEUSERS_PATH="/etc/selinux/$POLICY_TYPE/active/seusers" + if rlIsRHEL '<=6'; then + SEUSERS_PATH="/etc/selinux/$POLICY_TYPE/seusers" + fi + elif rlIsRHEL '>=8' || rlIsCentOS '>=8' ; then + SEUSERS_PATH="/var/lib/selinux/$POLICY_TYPE/active/seusers" + fi + + rlRun "cat $SEUSERS_PATH" + + SEUSERS_COUNT="$(cat $SEUSERS_PATH | grep -vE '^#|^$' | wc -l)" + rlRun "[[ \"$SEUSERS_COUNT\" -gt 0 ]]" + + SEUSERS="$(cat $SEUSERS_PATH | grep -vE '^#|^$' | cut -d':' -f1 | tr '\n' ' ')" + rlRun "[[ -n \"$SEUSERS\" ]]" + + first_line="$(cat $SEUSERS_PATH | grep -vE '^#|^$' | head -n 1)" + SEUSER="$(echo -n $first_line | cut -d':' -f1)" + rlRun "[[ -n \"$SEUSER\" ]]" + SEUSER_SENAME="$(echo -n $first_line | cut -d':' -f2)" + rlRun "[[ -n \"$SEUSER_SENAME\" ]]" + SEUSER_MLSRANGE="$(echo -n $first_line | cut -d':' -f3-4)" + rlRun "[[ -n \"$SEUSER_MLSRANGE\" ]]" + + SEUSER_NONEXISTENT="nonuser" + SEUSER_DEFAULT="__default__" + + ERR_FAIL=1 + ERR_ABORT=134 + ERR_SEGFAULT=139 + + # note: each test_*.c program takes first argument which specifies setup + # before executing specified function + # init semanage handle == NULL + # handle semanage handle obtained via semanage_handle_create + # conn connected via semanage_connect + # trans inside transaction, via semanage_begin_transaction + # program returns 1 on error in function, 2 on error in setup + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_key_create, semanage_seuser_key_free" + # FIXME + # rlRun "./test_key_create init $SEUSER" $ERR_ABORT,$ERR_SEGFAULT + # rlRun "./test_key_create handle $SEUSER" $ERR_FAIL + rlRun "./test_key_create conn $SEUSER" + rlRun "./test_key_create trans $SEUSER" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_key_extract" + # FIXME + #rlRun "./test_key_extract conn new" + rlRun "./test_key_extract conn first" + # FIXME + #rlRun "./test_key_extract trans new" + rlRun "./test_key_extract trans first" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_compare" + rlRun "./test_compare conn $SEUSER same" + rlRun "./test_compare conn $SEUSER_NONEXISTENT different" + rlRun "./test_compare trans $SEUSER same" + rlRun "./test_compare trans $SEUSER_NONEXISTENT different" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_compare2" + rlRun "./test_compare2 conn NULL 0" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 conn 0 NULL" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 conn NULL NULL" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 conn 0 0" + rlRun "./test_compare2 conn 0 1" + rlRun "./test_compare2 trans NULL 0" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 trans 0 NULL" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 trans NULL NULL" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 trans 0 0" + rlRun "./test_compare2 trans 0 1" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_count" + rlRun "./test_count init" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_count handle" $ERR_FAIL + rlRun "./test_count conn $SEUSERS_COUNT" + rlRun "./test_count trans $SEUSERS_COUNT" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_list" + rlRun "./test_list init" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_list handle" $ERR_FAIL + rlRun "./test_list conn $SEUSERS_COUNT $SEUSERS" + rlRun "./test_list trans $SEUSERS_COUNT $SEUSERS" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_iterate" + rlRun "./test_iterate init" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_iterate handle" $ERR_FAIL + rlRun "./test_iterate conn $SEUSERS" + rlRun "./test_iterate trans $SEUSERS" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_exists" + rlRun "./test_exists conn $SEUSER_NONEXISTENT 0" + rlRun "./test_exists conn $SEUSER_DEFAULT 1" + rlRun "./test_exists conn $USER 1" + rlRun "./test_exists trans $SEUSER_NONEXISTENT 0" + rlRun "./test_exists trans $SEUSER_DEFAULT 1" + rlRun "./test_exists trans $SEUSER 1" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_query" + rlRun "./test_query conn $SEUSER_NONEXISTENT" $ERR_FAIL + rlRun "./test_query conn $SEUSER_DEFAULT" + rlRun "./test_query conn $SEUSER" + rlRun "./test_query trans $SEUSER_NONEXISTENT" $ERR_FAIL + rlRun "./test_query trans $SEUSER_DEFAULT" + rlRun "./test_query trans $SEUSER" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_get_name" + rlRun "./test_get_name conn new NULL" + rlRun "./test_get_name conn first $SEUSER" + rlRun "./test_get_name trans new NULL" + rlRun "./test_get_name trans first $SEUSER" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_set_name" + name="someuser" + rlRun "./test_set_name conn $name" + rlRun "./test_set_name trans $name" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_get_sename" + rlRun "./test_get_sename conn new NULL" + rlRun "./test_get_sename conn first $SEUSER_SENAME" + rlRun "./test_get_sename trans new NULL" + rlRun "./test_get_sename trans first $SEUSER_SENAME" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_set_sename" + sename="someuser_u" + rlRun "./test_set_sename conn $sename" + rlRun "./test_set_sename trans $sename" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_get_mlsrange" + rlRun "./test_get_mlsrange conn new NULL" + rlRun "./test_get_mlsrange conn first $SEUSER_MLSRANGE" + rlRun "./test_get_mlsrange trans new NULL" + rlRun "./test_get_mlsrange trans first $SEUSER_MLSRANGE" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_set_mlsrange" + mlsrange="c0-s1:c0.c42" + rlRun "./test_set_mlsrange conn $mlsrange" + rlRun "./test_set_mlsrange trans $mlsrange" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_clone" + # FIXME + #rlRun "./test_clone conn new" + rlRun "./test_clone conn first" + # FIXME + #rlRun "./test_clone trans new" + rlRun "./test_clone trans first" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_create" + # FIXME + #rlRun "./test_create init" $ERR_ABORT,$ERR_SEGFAULT + #rlRun "./test_create handle" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_create conn" + rlRun "./test_create trans" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_modify_local" + # function requires transaction + #rlRun "./test_modify_local conn new" $ERR_FAIL + #rlRun "./test_modify_local conn first" $ERR_FAIL + #rlRun "./test_modify_local trans new" $ERR_FAIL + rlRun "./test_modify_local trans first" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_del_local" + # adding local seuser requires transaction + # FIXME + #rlRun "./test_del_local trans first new" + #rlRun "./test_del_local trans first second" + rlRun "./test_del_local trans first first" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_exists_local" + # adding local seuser requires transaction + rlRun "./test_exists_local trans first first 1" + rlRun "./test_exists_local trans first second 0" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_count_local" + # adding local seuser requires transaction + # FIXME + #rlRun "./test_count_local trans 0" + rlRun "./test_count_local trans 1" + rlRun "./test_count_local trans 2" + rlPhaseEnd + + rlPhaseStartCleanup + testfiles="$(ls -1 test_* | grep -v '\.c' | tr '\n' ' ')" + rlRun "rm -f $testfiles" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/libsemanage/semanage-seuser-functions/test_clone.c b/libsemanage/semanage-seuser-functions/test_clone.c new file mode 100644 index 0000000..8c2554f --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_clone.c @@ -0,0 +1,60 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_t *seuser_clone; + int result; + const char *str; + const char *str_clone; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + result = semanage_seuser_clone(sh, seuser, &seuser_clone); + printf("semanage_seuser_clone(%p, %p): %d\n", + (void *) seuser, (void *) seuser_clone, result); + + if (result < 0) { + perror("semanage_seuser_clone"); + exit(1); + } + + str = semanage_seuser_get_name(seuser); + str_clone = semanage_seuser_get_name(seuser_clone); + + if (strcmp(str, str_clone) != 0) { + fprintf(stderr, "Different in get_name\n"); + exit(1); + } + + str = semanage_seuser_get_sename(seuser); + str_clone = semanage_seuser_get_sename(seuser_clone); + + if (strcmp(str, str_clone) != 0) { + fprintf(stderr, "Different in get_sename\n"); + exit(1); + } + + str = semanage_seuser_get_mlsrange(seuser); + str_clone = semanage_seuser_get_mlsrange(seuser_clone); + + if (strcmp(str, str_clone) != 0) { + fprintf(stderr, "Different in get_mlsrange\n"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_compare.c b/libsemanage/semanage-seuser-functions/test_compare.c new file mode 100644 index 0000000..5615463 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_compare.c @@ -0,0 +1,44 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_key_t *key; + int result; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, "first"); + + key = test_get_key(sh, argv[2]); + + result = semanage_seuser_compare(seuser, key); + printf("semanage_seuser_compare(%p, %p): %d\n", + (void *) seuser, (void *) key, result); + + if (argc >= 4) { + if (strcmp(argv[3], "same") == 0 && result != 0) { + fprintf(stderr, "Expected same but got different\n"); + exit(1); + } + else if (strcmp(argv[3], "different") == 0 && result == 0) { + fprintf(stderr, "Expected different but got same\n"); + exit(1); + } + } + + semanage_seuser_key_free(key); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_compare2.c b/libsemanage/semanage-seuser-functions/test_compare2.c new file mode 100644 index 0000000..afeec07 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_compare2.c @@ -0,0 +1,54 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_t *seuser2; + int result; + int first = -1; + int second = -1; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + if (strcmp(argv[2], "NULL") == 0) { + seuser = NULL; + } + else { + first = strtol(argv[2], NULL, 10); + seuser = test_get_seuser_nth(sh, first); + } + + if (strcmp(argv[3], "NULL") == 0) { + seuser2 = NULL; + } + else { + second = strtol(argv[3], NULL, 10); + seuser2 = test_get_seuser_nth(sh, second); + } + + result = semanage_seuser_compare2(seuser, seuser2); + printf("semanage_seuser_compare(%p, %p): %d\n", + (void *) seuser, (void *) seuser2, result); + + if (first == second && result != 0) { + fprintf(stderr, "Expected same but got different\n"); + exit(1); + } + else if (first != second && result == 0) { + fprintf(stderr, "Expected different but got same\n"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_count.c b/libsemanage/semanage-seuser-functions/test_count.c new file mode 100644 index 0000000..7fabe4b --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_count.c @@ -0,0 +1,34 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + unsigned int response; + int result; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + result = semanage_seuser_count(sh, &response); + printf("semanage_seuser_count(%p, %p): %d, response: %u\n", + (void *) sh, (void *) &response, result, response); + + if (result < 0) { + perror("semanage_seuser_count"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], response); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_count_local.c b/libsemanage/semanage-seuser-functions/test_count_local.c new file mode 100644 index 0000000..f25ab6d --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_count_local.c @@ -0,0 +1,46 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + int result; + unsigned int response; + int num; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + num = strtol(argv[2], NULL, 10); + + for (int i = 0; i < num; i++) { + seuser = test_get_seuser_nth(sh, i); + + test_add_local_seuser(sh, seuser); + } + + result = semanage_seuser_count_local(sh, &response); + printf("semanage_seuser_count_local(%p, %p): %d, response: %d\n", + (void *) sh, (void *) &response, result, response); + + if (result < 0) { + perror("semanage_seuser_count_local"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], response); + + test_del_local_seuser(sh, seuser); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_create.c b/libsemanage/semanage-seuser-functions/test_create.c new file mode 100644 index 0000000..a5191a0 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_create.c @@ -0,0 +1,53 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + int result; + const char *str; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + result = semanage_seuser_create(sh, &seuser); + printf("semanage_seuser_create(%p, %p): %d\n", + (void *) sh, (void *) seuser, result); + + if (result < 0) { + perror("semanage_seuser_create"); + exit(1); + } + + str = semanage_seuser_get_name(seuser); + + if (str != NULL) { + fprintf(stderr, "Expected name == NULL, got %s\n", str); + exit(1); + } + + str = semanage_seuser_get_sename(seuser); + + if (str != NULL) { + fprintf(stderr, "Expected sename == NULL, got %s\n", str); + exit(1); + } + + str = semanage_seuser_get_mlsrange(seuser); + + if (str != NULL) { + fprintf(stderr, "Expected mlsrange == NULL, got %s\n", str); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_del_local.c b/libsemanage/semanage-seuser-functions/test_del_local.c new file mode 100644 index 0000000..eced74a --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_del_local.c @@ -0,0 +1,64 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_t *seuser_del; + semanage_seuser_key_t *key; + semanage_seuser_t **records; + int result; + unsigned int count; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + test_add_local_seuser(sh, seuser); + + seuser_del = test_get_seuser(sh, argv[3]); + + result = semanage_seuser_key_extract(sh, seuser_del, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser_del, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_del_local(sh, key); + printf("semanage_seuser_del_local(%p, %p): %d\n", + (void *) seuser, (void *) key, result); + + if (result < 0) { + perror("semanage_seuser_del_local"); + exit(1); + } + + result = semanage_seuser_list_local(sh, &records, &count); + printf("semanage_seuser_list_local(%p, %p, %p): %d\n", + (void *) sh, (void *) &records, (void *) &count, result); + + if (result < 0) { + perror("semanage_seuser_list_local"); + exit(2); + } + + if (count != 0) { + fprintf(stderr, "Number of local seusers is not 0!\n"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_exists.c b/libsemanage/semanage-seuser-functions/test_exists.c new file mode 100644 index 0000000..c0af3b2 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_exists.c @@ -0,0 +1,37 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_key_t *key; + int result; + int response; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + key = test_get_key(sh, argv[2]); + + result = semanage_seuser_exists(sh, key, &response); + printf("semanage_seuser_exists(%p, %p, %p): %d, response: %d\n", + (void *) sh, (void *) key, (void *) &response, result, response); + + if (result < 0) { + perror("semanage_seuser_exists"); + exit(1); + } + + if (argc >= 4) + check_result_int(argv[3], response); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_exists_local.c b/libsemanage/semanage-seuser-functions/test_exists_local.c new file mode 100644 index 0000000..165d5b3 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_exists_local.c @@ -0,0 +1,59 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_t *seuser_exists; + semanage_seuser_key_t *key; + int result; + int response; + int exp; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + seuser_exists = test_get_seuser(sh, argv[3]); + + test_add_local_seuser(sh, seuser); + + result = semanage_seuser_key_extract(sh, seuser_exists, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser_exists, (void *) &key, result); + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_exists_local(sh, key, &response); + printf("semanage_seuser_exists_local(%p, %p, %p): %d\n", + (void *) sh, (void *) key, (void *) &response, result); + + if (result < 0) { + perror("semanage_seuser_exists_local"); + exit(1); + } + + if (argc >= 5) { + exp = strtol(argv[4], NULL, 10); + + if (response != exp) { + fprintf(stderr, "Expected %d but got %d\n", exp, response); + exit(1); + } + } + + test_del_local_seuser(sh, seuser); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_get_mlsrange.c b/libsemanage/semanage-seuser-functions/test_get_mlsrange.c new file mode 100644 index 0000000..97172dc --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_get_mlsrange.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + const char *name = semanage_seuser_get_mlsrange(seuser); + printf("semanage_seuser_get_mlsrange(%p): %s\n", + (void *) seuser, name); + + if (strcmp_null(argv[3], name) != 0) { + fprintf(stderr, "Expected %s but got %s\n", argv[2], name); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_get_name.c b/libsemanage/semanage-seuser-functions/test_get_name.c new file mode 100644 index 0000000..95d9025 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_get_name.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + const char *name = semanage_seuser_get_name(seuser); + printf("semanage_seuser_get_name(%p): %s\n", + (void *) seuser, name); + + if (strcmp_null(argv[3], name) != 0) { + fprintf(stderr, "Expected %s but got %s\n", argv[2], name); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_get_sename.c b/libsemanage/semanage-seuser-functions/test_get_sename.c new file mode 100644 index 0000000..1ed7248 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_get_sename.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + const char *name = semanage_seuser_get_sename(seuser); + printf("semanage_seuser_get_sename(%p): %s\n", + (void *) seuser, name); + + if (strcmp_null(argv[3], name) != 0) { + fprintf(stderr, "Expected %s but got %s\n", argv[2], name); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_iterate.c b/libsemanage/semanage-seuser-functions/test_iterate.c new file mode 100644 index 0000000..533087a --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_iterate.c @@ -0,0 +1,49 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int counter = 0; + +int handler(const semanage_seuser_t *record, void *varg) { + char **args = (char **) varg; + + const char *name = semanage_seuser_get_name(record); + + if (strcmp(name, args[2 + counter++]) != 0) + return -1; + + return 0; +} + +int main (int argc, char **argv) { + semanage_handle_t *sh; + int result; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + char **param = NULL; + + if (argc >= 3) { + param = argv; + } + + result = semanage_seuser_iterate(sh, &handler, (void *) param); + printf("semanage_seuser_iterate(%p, %p, %p): %d\n", + (void *) sh, (void *) &handler, (void *) param, result); + + if (result < 0) { + perror("semanage_seuser_iterate"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_key_create.c b/libsemanage/semanage-seuser-functions/test_key_create.c new file mode 100644 index 0000000..8f3aaf5 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_key_create.c @@ -0,0 +1,39 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_key_t *key; + const char *name; + int result; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + if (strcmp(argv[2], "NULL") == 0) + name = NULL; + else + name = argv[2]; + + result = semanage_seuser_key_create(sh, name, &key); + printf("semanage_seuser_key_create(%p, %s, %p): %d\n", + (void *) sh, name, (void *) &key, result); + + if (result < 0 || key == NULL) { + perror("semanage_seuser_key_create"); + exit(1); + } + + semanage_seuser_key_free(key); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_key_extract.c b/libsemanage/semanage-seuser-functions/test_key_extract.c new file mode 100644 index 0000000..50658dc --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_key_extract.c @@ -0,0 +1,45 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_key_t *key; + int result; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + result = semanage_seuser_key_extract(sh, seuser, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(1); + } + + result = semanage_seuser_compare(seuser, key); + printf("semanage_seuser_compare(%p, %p): %d\n", + (void *) seuser, (void *) key, result); + + if (result != 0) { + perror("semanage_seuser_compare"); + exit(1); + } + + semanage_seuser_key_free(key); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_list.c b/libsemanage/semanage-seuser-functions/test_list.c new file mode 100644 index 0000000..ae06187 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_list.c @@ -0,0 +1,63 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t **records; + unsigned int count; + int result; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + result = semanage_seuser_list(sh, &records, &count); + printf("semanage_seuser_list(%p, %p, %p): %d", + (void *) sh, (void *) &records, (void *) &count, result); + + if (result < 0) { + perror("semanage_seuser_list"); + exit(1); + } + + printf(", count: %u, records: ", count); + + const char *name; + + for (unsigned int i = 0; i < count; i++) { + name = semanage_seuser_get_name(records[i]); + printf("%p (%s), ", (void *) records[i], name); + } + + printf("\n"); + + if (argc >= 3) { + unsigned int exp_count = strtoul(argv[2], NULL, 10); + + if (count != exp_count) { + printf("Expected %u but got %u\n", exp_count, count); + exit(1); + } + + const char *name; + + for (unsigned int i = 0; i < count; i++) { + name = semanage_seuser_get_name(records[i]); + + if (strcmp(name, argv[3 + i]) != 0) { + printf("Expected %s but got %s\n", name, argv[3 + i]); + exit(1); + } + } + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_modify_local.c b/libsemanage/semanage-seuser-functions/test_modify_local.c new file mode 100644 index 0000000..53a11f5 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_modify_local.c @@ -0,0 +1,64 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_key_t *key; + semanage_seuser_t **records; + int result; + unsigned int count; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + result = semanage_seuser_key_extract(sh, seuser, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_modify_local(sh, key, seuser); + printf("semanage_seuser_modify_local(%p, %p, %p): %d\n", + (void *) seuser, (void *) key, (void *) seuser, result); + + if (result < 0) { + perror("semanage_seuser_modify_local"); + exit(1); + } + + result = semanage_seuser_list_local(sh, &records, &count); + printf("semanage_seuser_list_local(%p, %p, %p): %d\n", + (void *) sh, (void *) &records, (void *) &count, result); + + if (result < 0) { + perror("semanage_seuser_list_local"); + exit(2); + } + + if (count != 1) { + fprintf(stderr, "Number of local seusers is %u, expected 1!\n", count); + exit(1); + } + + if (semanage_seuser_compare(records[0], key) != 0) { + fprintf(stderr, "Local seuser is different!\n"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_query.c b/libsemanage/semanage-seuser-functions/test_query.c new file mode 100644 index 0000000..10b4e27 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_query.c @@ -0,0 +1,50 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_key_t *key; + semanage_seuser_t *response; + int result; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + result = semanage_seuser_key_create(sh, argv[2], &key); + printf("semanage_seuser_key_create(%p, %s, %p): %d\n", + (void *) sh, argv[2], (void *) &key, result); + + if (result < 0 || key == NULL) { + perror("semanage_seuser_key_create"); + exit(2); + } + + result = semanage_seuser_query(sh, key, &response); + printf("semanage_seuser_query(%p, %p, %p): %d, response: %p\n", + (void *) sh, (void *) key, (void *) &response, result, (void *) response); + + if (result < 0) { + perror("semanage_seuser_query"); + exit(1); + } + + const char *name = semanage_seuser_get_name(response); + printf("semanage_seuser_get_name(%p): %s\n", + (void *) response, name); + + if (strcmp(argv[2], name) != 0) { + perror("semanage_seuser_get_name"); + exit(2); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_set_mlsrange.c b/libsemanage/semanage-seuser-functions/test_set_mlsrange.c new file mode 100644 index 0000000..48440ac --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_set_mlsrange.c @@ -0,0 +1,62 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *user; + int result; + const char *mlsrange; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + user = test_get_seuser(sh, "first"); + + if (strcmp(argv[2], "NULL") == 0) + mlsrange = NULL; + else + mlsrange = argv[2]; + + const char *old_mlsrange = semanage_seuser_get_mlsrange(user); + printf("semanage_seuser_get_mlsrange(%p): %s\n", + (void *) user, old_mlsrange); + + if (old_mlsrange == NULL) { + perror("semanage_seuser_get_mlsrange"); + exit(2); + } + + if (strcmp(old_mlsrange, mlsrange) == 0) { + printf("New mlsrange is the same\n"); + exit(2); + } + + result = semanage_seuser_set_mlsrange(sh, user, mlsrange); + printf("semanage_seuser_set_mlsrange(%p, %p, %s): %d\n", + (void *) sh, (void *) user, mlsrange, result); + + if (result < 0) { + perror("semanage_seuser_set_mlsrange"); + exit(1); + } + + const char *new_mlsrange = semanage_seuser_get_mlsrange(user); + printf("semanage_seuser_get_mlsrange(%p): %s\n", + (void *) user, new_mlsrange); + + if (strcmp(new_mlsrange, mlsrange) != 0) { + perror("semanage_seuser_get_mlsrange"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_set_name.c b/libsemanage/semanage-seuser-functions/test_set_name.c new file mode 100644 index 0000000..3e448e8 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_set_name.c @@ -0,0 +1,62 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *user; + int result; + const char *name; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + user = test_get_seuser(sh, "first"); + + if (strcmp(argv[2], "NULL") == 0) + name = NULL; + else + name = argv[2]; + + const char *old_name = semanage_seuser_get_name(user); + printf("semanage_seuser_get_name(%p): %s\n", + (void *) user, old_name); + + if (old_name == NULL) { + perror("semanage_seuser_get_name"); + exit(2); + } + + if (strcmp(old_name, name) == 0) { + printf("New name is the same\n"); + exit(2); + } + + result = semanage_seuser_set_name(sh, user, name); + printf("semanage_seuser_set_name(%p, %p, %s): %d\n", + (void *) sh, (void *) user, name, result); + + if (result < 0) { + perror("semanage_seuser_set_name"); + exit(1); + } + + const char *new_name = semanage_seuser_get_name(user); + printf("semanage_seuser_get_name(%p): %s\n", + (void *) user, new_name); + + if (strcmp(new_name, name) != 0) { + perror("semanage_seuser_get_name"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_set_sename.c b/libsemanage/semanage-seuser-functions/test_set_sename.c new file mode 100644 index 0000000..402c5b7 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_set_sename.c @@ -0,0 +1,62 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *user; + int result; + const char *name; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + user = test_get_seuser(sh, "first"); + + if (strcmp(argv[2], "NULL") == 0) + name = NULL; + else + name = argv[2]; + + const char *old_name = semanage_seuser_get_sename(user); + printf("semanage_seuser_get_sename(%p): %s\n", + (void *) user, old_name); + + if (old_name == NULL) { + perror("semanage_seuser_get_sename"); + exit(2); + } + + if (strcmp(old_name, name) == 0) { + printf("New name is the same\n"); + exit(2); + } + + result = semanage_seuser_set_sename(sh, user, name); + printf("semanage_seuser_set_sename(%p, %p, %s): %d\n", + (void *) sh, (void *) user, name, result); + + if (result < 0) { + perror("semanage_seuser_set_sename"); + exit(1); + } + + const char *new_name = semanage_seuser_get_sename(user); + printf("semanage_seuser_get_sename(%p): %s\n", + (void *) user, new_name); + + if (strcmp(new_name, name) != 0) { + perror("semanage_seuser_get_sename"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf b/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf new file mode 100644 index 0000000..2dce7fb --- /dev/null +++ b/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf @@ -0,0 +1,11 @@ +summary: Update a file context and relabel +test: ./test.sh +framework: beakerlib +require: + - python3-policycoreutils + - policycoreutils-python-utils + - python3-libsemanage + - setools-console +link: + - verifies: https://issues.redhat.com/browse/RHEL-73348 +id: f4ecd93d-d4bc-45fc-8386-193dd4f922e4 diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/test.sh b/libsemanage/semanage_setfiles-selinux_restorecon/test.sh new file mode 100755 index 0000000..b52efd9 --- /dev/null +++ b/libsemanage/semanage_setfiles-selinux_restorecon/test.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "set -o pipefail" + rlRun "source /etc/selinux/config" + rlRun "ETC_RW_T_LABEL=\"$(seinfo -t | grep etc_rw_t | head -1 | awk '{$1=$1};1')\"" + rlPhaseEnd + + rlPhaseStartTest + rlRun "mkdir -p $tmp/test/subtest | cut -d ' ' -f 1" + rlRun "ls -Zd $tmp/test $tmp/test/subtest | cut -d ' ' -f 1" + + rlRun "python3 update_context.py $tmp/test ${ETC_RW_T_LABEL} ${SELINUXTYPE}" + LABEL="system_u:object_r:${ETC_RW_T_LABEL}:s0" + LABEL_TEST=$(ls -Zd $tmp/test | cut -d ' ' -f 1) + LABEL_SUBTEST=$(ls -Zd $tmp/test/subtest | cut -d ' ' -f 1) + rlRun "ls -Zd $tmp/test $tmp/test/subtest" + rlAssertEquals "Is $tmp/test $LABEL?" "$LABEL_TEST" "$LABEL" + rlAssertEquals "Is $tmp/test/subtest $LABEL?" "$LABEL_SUBTEST" "$LABEL" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semanage fcontext -D" + rlRun "rm -rf $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py b/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py new file mode 100755 index 0000000..e58eac8 --- /dev/null +++ b/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py @@ -0,0 +1,21 @@ +#!/usr/bin/env python3 + +import sys +import selinux +import seobject + +def update_context(file_dir, new_context, selinux_policy): + suffix = '(/.*)?' + trans = seobject.semanageRecords(selinux_policy) + trans.start() + + fcon = seobject.fcontextRecords(trans) + fcon.add( + file_dir + suffix, + new_context, '', 's0', '') + trans.finish() + selinux.restorecon(file_dir, True, True, True) + + +if __name__ == "__main__": + update_context(sys.argv[1], sys.argv[2], sys.argv[3]) diff --git a/libsemanage/usepasswd-in-semanage-conf/Makefile b/libsemanage/usepasswd-in-semanage-conf/Makefile index 04e5715..f63aae5 100644 --- a/libsemanage/usepasswd-in-semanage-conf/Makefile +++ b/libsemanage/usepasswd-in-semanage-conf/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-devel" >> $(METADATA) + @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-devel shadow-utils" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libsemanage/usepasswd-in-semanage-conf/main.fmf b/libsemanage/usepasswd-in-semanage-conf/main.fmf index 7cd455b..0e37053 100644 --- a/libsemanage/usepasswd-in-semanage-conf/main.fmf +++ b/libsemanage/usepasswd-in-semanage-conf/main.fmf @@ -1,6 +1,34 @@ -path: /libsemanage/usepasswd-in-semanage-conf summary: Make sure usepasswd option in semanage.conf works properly -tier: 2 -adjust: -- enabled: false - when: distro < rhel-7 +description: |+ + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1871786 + + Make sure usepasswd option in semanage.conf works properly + +contact: Milos Malik +component: + - libsemanage +recommend: + - libselinux + - libselinux-utils + - libsemanage + - policycoreutils + - policycoreutils-python-utils + - selinux-policy + - selinux-policy-devel + - shadow-utils +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - targeted + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1871786 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0609005 +extra-summary: /CoreOS/libsemanage/Sanity/usepasswd-in-semanage-conf +extra-task: /CoreOS/libsemanage/Sanity/usepasswd-in-semanage-conf diff --git a/libsemanage/usepasswd-in-semanage-conf/runtest.sh b/libsemanage/usepasswd-in-semanage-conf/runtest.sh index 8aadf23..b1ec6fd 100755 --- a/libsemanage/usepasswd-in-semanage-conf/runtest.sh +++ b/libsemanage/usepasswd-in-semanage-conf/runtest.sh @@ -61,9 +61,9 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel duck-home" - rlRun "userdel duck-tmp" - rlRun "userdel duck-var-lib" + rlRun "userdel -f duck-home" + rlRun "userdel -f duck-tmp" + rlRun "userdel -f duck-var-lib" rlLog "SELinux users with home in / shoud not trigger a policy change" rlRun "useradd -Z unconfined_u -d /tmp duck-tmp" @@ -71,8 +71,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -Z duck-tmp" - rlRun "userdel -Z duck-var" + rlRun "userdel -fZ duck-tmp" + rlRun "userdel -fZ duck-var" rlLog "Other SELinux users should trigger a policy change" rlRun "useradd -Z unconfined_u duck-home" @@ -80,8 +80,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E 'duck-(home|var-home)'" 0 - rlRun "userdel -Z duck-home" - rlRun "userdel -Z duck-var-home" + rlRun "userdel -fZ duck-home" + rlRun "userdel -fZ duck-var-home" rlFileRestore rlPhaseEnd @@ -98,14 +98,14 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel duck-home" + rlRun "userdel -f duck-home" rlLog "Standard users with home in directory like /var/home should trigger a policy change" rlRun "useradd -d /var/home/duck duck-var-home" rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E '/var/home/'" 0 - rlRun "userdel duck-var-home" + rlRun "userdel -f duck-var-home" rlLog "Standard users with home in / shoud not trigger a policy change" rlRun "useradd -d /tmp duck-tmp" @@ -113,8 +113,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -Z duck-tmp" - rlRun "userdel -Z duck-var" + rlRun "userdel -fZ duck-tmp" + rlRun "userdel -fZ duck-var" rlLog "SELinux users with home in / shoud not trigger a policy change" rlRun "useradd -Z unconfined_u -d /tmp duck-tmp" @@ -122,8 +122,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -Z duck-tmp" - rlRun "userdel -Z duck-var" + rlRun "userdel -fZ duck-tmp" + rlRun "userdel -fZ duck-var" rlLog "Other SELinux users should trigger a policy change" rlRun "useradd -Z unconfined_u duck-home" @@ -131,8 +131,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E 'duck-(home|var-home)'" 0 - rlRun "userdel -Z duck-home" - rlRun "userdel -Z duck-var-home" + rlRun "userdel -fZ duck-home" + rlRun "userdel -fZ duck-var-home" rlFileRestore rlPhaseEnd diff --git a/libsemanage/verify-options-in-semanage-conf/Makefile b/libsemanage/verify-options-in-semanage-conf/Makefile index 3f94665..83b6c9a 100644 --- a/libsemanage/verify-options-in-semanage-conf/Makefile +++ b/libsemanage/verify-options-in-semanage-conf/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python selinux-policy selinux-policy-devel" >> $(METADATA) + @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-devel" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libsemanage/verify-options-in-semanage-conf/main.fmf b/libsemanage/verify-options-in-semanage-conf/main.fmf index 9444a6c..5b32f86 100644 --- a/libsemanage/verify-options-in-semanage-conf/main.fmf +++ b/libsemanage/verify-options-in-semanage-conf/main.fmf @@ -1,12 +1,40 @@ -path: /libsemanage/verify-options-in-semanage-conf summary: Are the verify options in semanage.conf honored? -description: | +description: |+ Are the verify options in semanage.conf honored? Tested options: verify kernel, verify module, verify linked Tested tools: semodule, semanage Positive and negative cases are tested. Original information found at http://selinuxproject.org/page/PolicyValidate + +contact: Milos Malik +component: + - libsemanage +recommend: + - libselinux + - libselinux-utils + - libsemanage + - policycoreutils + - policycoreutils-python-utils + - selinux-policy + - selinux-policy-devel +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesFAIL + - f32friendly + - f33friendly + - targeted tier: 1 -adjust: -- enabled: false - when: distro < rhel-6 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1400705 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0540246 +extra-summary: /CoreOS/libsemanage/Sanity/verify-options-in-semanage-conf +extra-task: /CoreOS/libsemanage/Sanity/verify-options-in-semanage-conf diff --git a/libsemanage/verify-options-in-semanage-conf/runtest.sh b/libsemanage/verify-options-in-semanage-conf/runtest.sh index c7891f3..c295509 100755 --- a/libsemanage/verify-options-in-semanage-conf/runtest.sh +++ b/libsemanage/verify-options-in-semanage-conf/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libsemanage" @@ -62,7 +61,7 @@ rlJournalStart rlAssertNotGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertNotGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei + rlAssertNotGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" rlPhaseEnd @@ -74,7 +73,7 @@ rlJournalStart rlAssertNotGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertNotGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei + rlAssertNotGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" rlPhaseEnd @@ -103,7 +102,7 @@ rlJournalStart rlAssertGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" 1 rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei + rlAssertGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" 1 rlPhaseEnd @@ -115,7 +114,7 @@ rlJournalStart rlAssertGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" 1 rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei + rlAssertGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" 1 rlPhaseEnd diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile new file mode 100644 index 0000000..b1cceb1 --- /dev/null +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile @@ -0,0 +1,72 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +# Description: The rpm scripts from libsepol uses out of date commands like telinit. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Amith Kumar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: The rpm scripts from libsepol uses out of date commands like telinit" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: libsepol" >> $(METADATA) + @echo "RunFor: libselinux" >> $(METADATA) + @echo "RunFor: libsemanage" >> $(METADATA) + @echo "Requires: libsepol" >> $(METADATA) + @echo "Requires: libsepol-devel" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-devel" >> $(METADATA) + @echo "Requires: libsemanage" >> $(METADATA) + @echo "Requires: libsemanage-devel" >> $(METADATA) + @echo "Requires: pkgconfig" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 1838257" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE new file mode 100644 index 0000000..21b5178 --- /dev/null +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE @@ -0,0 +1,11 @@ +PURPOSE of /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit + +Description: libsepol rpm scripts use deprecated telinit command + +Author: Amith Kumar + +Bugzilla links: +https://bugzilla.redhat.com/show_bug.cgi?id=1838257 + +Description of problem: +The rpm scripts from the rpm is using out of date commands like telinit. diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf new file mode 100644 index 0000000..d831b58 --- /dev/null +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf @@ -0,0 +1,27 @@ +summary: The rpm scripts from libsepol uses out of date commands like telinit +description: | + Description: libsepol rpm scripts use deprecated telinit command + + Author: Amith Kumar + + Bugzilla links: + https://bugzilla.redhat.com/show_bug.cgi?id=1838257 + + Description of problem: + The rpm scripts from the rpm is using out of date commands like telinit. +contact: Amith Kumar +component: + - libsepol +recommend: + - libsepol + - libsepol-devel + - libselinux + - libselinux-devel + - libsemanage + - libsemanage-devel + - pkgconfig +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838257 +extra-summary: /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +extra-task: /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +id: bfadc6af-3873-4dd9-a7af-3f97bd92e150 diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh new file mode 100755 index 0000000..adf27a2 --- /dev/null +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh @@ -0,0 +1,51 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +# Description: The rpm scripts from the rpm is using out of date commands like telinit. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE=libsepol +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlPhaseEnd + + if rlIsFedora '>=33' || rlIsRHEL ">=7" ; then + rlPhaseStartTest "libsepol rpm scripts use deprecated telinit command bz#1838257" + for COMPONENT in "libsepol" "libsemanage" "libselinux" ; do + rlRun "rpm -qa --scripts \*$COMPONENT\* 2>&1 | tee output_file" + rlAssertNotGrep "telinit" output_file + rlRun "rm -f output_file" + done + rlPhaseEnd + fi + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/libsepol/self-keyword-in-type-rules/main.fmf b/libsepol/self-keyword-in-type-rules/main.fmf new file mode 100644 index 0000000..5db34a4 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/main.fmf @@ -0,0 +1,28 @@ +summary: Test support for self keyword in type rules +description: | + Verifies that libsepol/checkmodule supports the self keyword in type rules. +contact: Ondrej Mosnacek +component: + - libsepol + - checkpolicy +framework: beakerlib +require: + - policycoreutils + - checkpolicy + - setools-console + - selinux-policy + - selinux-policy-devel + - diffutils +duration: 15m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-9.1 + because: RHEL-8 and below are not expected to support this + - enabled: false + when: distro < fedora-37 + because: This feature may not be available in F36 and below +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2069718 +extra-nitrate: TC#0613928 diff --git a/libsepol/self-keyword-in-type-rules/rules_expected.txt b/libsepol/self-keyword-in-type-rules/rules_expected.txt new file mode 100644 index 0000000..239acc4 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/rules_expected.txt @@ -0,0 +1,90 @@ +type_change test_a_t test_a_t:dir test_e_t; +type_change test_a_t test_a_t:file test_e_t; +type_change test_b_t test_b_t:dir test_e_t; +type_change test_b_t test_b_t:file test_e_t; +type_change test_c_t test_c_t:dir test_e_t; +type_change test_c_t test_c_t:file test_e_t; +type_change test_d_t test_d_t:dir test_e_t; +type_change test_d_t test_d_t:file test_e_t; +type_change test_h_t test_a_t:dir test_e_t; +type_change test_h_t test_a_t:file test_e_t; +type_change test_h_t test_b_t:dir test_e_t; +type_change test_h_t test_b_t:file test_e_t; +type_change test_h_t test_c_t:dir test_e_t; +type_change test_h_t test_c_t:file test_e_t; +type_change test_h_t test_d_t:dir test_e_t; +type_change test_h_t test_d_t:file test_e_t; +type_change test_h_t test_h_t:dir test_e_t; +type_change test_h_t test_h_t:file test_e_t; +type_member test_a_t test_a_t:dir test_e_t; +type_member test_a_t test_a_t:file test_e_t; +type_member test_b_t test_b_t:dir test_e_t; +type_member test_b_t test_b_t:file test_e_t; +type_member test_c_t test_c_t:dir test_e_t; +type_member test_c_t test_c_t:file test_e_t; +type_member test_d_t test_d_t:dir test_e_t; +type_member test_d_t test_d_t:file test_e_t; +type_member test_h_t test_a_t:dir test_e_t; +type_member test_h_t test_a_t:file test_e_t; +type_member test_h_t test_b_t:dir test_e_t; +type_member test_h_t test_b_t:file test_e_t; +type_member test_h_t test_c_t:dir test_e_t; +type_member test_h_t test_c_t:file test_e_t; +type_member test_h_t test_d_t:dir test_e_t; +type_member test_h_t test_d_t:file test_e_t; +type_member test_h_t test_h_t:dir test_e_t; +type_member test_h_t test_h_t:file test_e_t; +type_transition test_a_t test_a_t:dir test_e_t; +type_transition test_a_t test_a_t:dir test_f_t filename1; +type_transition test_a_t test_a_t:dir test_g_t filename2; +type_transition test_a_t test_a_t:file test_e_t; +type_transition test_a_t test_a_t:file test_f_t filename1; +type_transition test_a_t test_a_t:file test_g_t filename2; +type_transition test_b_t test_b_t:dir test_e_t; +type_transition test_b_t test_b_t:dir test_f_t filename1; +type_transition test_b_t test_b_t:dir test_g_t filename2; +type_transition test_b_t test_b_t:file test_e_t; +type_transition test_b_t test_b_t:file test_f_t filename1; +type_transition test_b_t test_b_t:file test_g_t filename2; +type_transition test_c_t test_c_t:dir test_e_t; +type_transition test_c_t test_c_t:dir test_f_t filename1; +type_transition test_c_t test_c_t:dir test_g_t filename2; +type_transition test_c_t test_c_t:file test_e_t; +type_transition test_c_t test_c_t:file test_f_t filename1; +type_transition test_c_t test_c_t:file test_g_t filename2; +type_transition test_d_t test_d_t:dir test_e_t; +type_transition test_d_t test_d_t:dir test_f_t filename1; +type_transition test_d_t test_d_t:dir test_g_t filename2; +type_transition test_d_t test_d_t:file test_e_t; +type_transition test_d_t test_d_t:file test_f_t filename1; +type_transition test_d_t test_d_t:file test_g_t filename2; +type_transition test_h_t test_a_t:dir test_e_t; +type_transition test_h_t test_a_t:dir test_f_t filename1; +type_transition test_h_t test_a_t:dir test_g_t filename2; +type_transition test_h_t test_a_t:file test_e_t; +type_transition test_h_t test_a_t:file test_f_t filename1; +type_transition test_h_t test_a_t:file test_g_t filename2; +type_transition test_h_t test_b_t:dir test_e_t; +type_transition test_h_t test_b_t:dir test_f_t filename1; +type_transition test_h_t test_b_t:dir test_g_t filename2; +type_transition test_h_t test_b_t:file test_e_t; +type_transition test_h_t test_b_t:file test_f_t filename1; +type_transition test_h_t test_b_t:file test_g_t filename2; +type_transition test_h_t test_c_t:dir test_e_t; +type_transition test_h_t test_c_t:dir test_f_t filename1; +type_transition test_h_t test_c_t:dir test_g_t filename2; +type_transition test_h_t test_c_t:file test_e_t; +type_transition test_h_t test_c_t:file test_f_t filename1; +type_transition test_h_t test_c_t:file test_g_t filename2; +type_transition test_h_t test_d_t:dir test_e_t; +type_transition test_h_t test_d_t:dir test_f_t filename1; +type_transition test_h_t test_d_t:dir test_g_t filename2; +type_transition test_h_t test_d_t:file test_e_t; +type_transition test_h_t test_d_t:file test_f_t filename1; +type_transition test_h_t test_d_t:file test_g_t filename2; +type_transition test_h_t test_h_t:dir test_e_t; +type_transition test_h_t test_h_t:dir test_f_t filename1; +type_transition test_h_t test_h_t:dir test_g_t filename2; +type_transition test_h_t test_h_t:file test_e_t; +type_transition test_h_t test_h_t:file test_f_t filename1; +type_transition test_h_t test_h_t:file test_g_t filename2; diff --git a/libsepol/self-keyword-in-type-rules/runtest.sh b/libsepol/self-keyword-in-type-rules/runtest.sh new file mode 100755 index 0000000..982a2e9 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/runtest.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +MODULES_BAD="test_self_tt_bad1 test_self_tt_bad2 test_self_tt_bad3 test_self_tt_bad4" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm "libsepol" + rlAssertRpm "checkpolicy" + rlAssertRpm "policycoreutils" + rlAssertRpm "selinux-policy" + rlPhaseEnd + + rlPhaseStartTest "Test good TE module" + rlRun "make -f /usr/share/selinux/devel/Makefile test_self_tt_good.pp" 0 \ + "Test that test_self_tt_good TE module can be built" + rlRun "semodule -i test_self_tt_good.pp" 0 \ + "Test that test_self_tt_good TE module can be installed" + rlRun "diff rules_expected.txt <(sesearch -T --type_change --type_member -rd -D 'test_[efg]_t' | sort)" 0 \ + "Test that the resulting binary policy rules match the expected ones" + rlRun "semodule -r test_self_tt_good" 0 \ + "Remove the test_self_tt_good TE module" + rlPhaseEnd + + rlPhaseStartTest "Test good CIL module" + rlRun "semodule -i test_self_tt_good.cil" 0 \ + "Test that test_self_tt_good CIL module can be installed" + rlRun "diff rules_expected.txt <(sesearch -T --type_change --type_member -rd -D 'test_[efg]_t' | sort)" 0 \ + "Test that the resulting binary policy rules match the expected ones" + rlRun "semodule -r test_self_tt_good" 0 \ + "Remove the test_self_tt_good CIL module" + rlPhaseEnd + + rlPhaseStartTest "Test bad TE modules" + for i in {1..8}; do + rlRun "make -f /usr/share/selinux/devel/Makefile test_self_tt_bad$i.pp" 0-2 \ + "Try to build test_self_tt_bad$i TE module" + rlRun "semodule -i test_self_tt_bad$i.pp" 1 \ + "Test that test_self_tt_bad$i TE module cannot be installed" + rlRun "semodule -r test_self_tt_bad$i" 1 \ + "Try to remove the test_self_tt_bad$i TE module" + done + rlPhaseEnd + + rlPhaseStartTest "Test bad CIL modules" + for i in {1..8}; do + rlRun "semodule -i test_self_tt_bad$i.cil" 1 \ + "Test that test_self_tt_bad$i CIL module cannot be installed" + rlRun "semodule -r test_self_tt_bad$i" 1 \ + "Try to remove the test_self_tt_bad$i CIL module" + done + rlPhaseEnd + + rlJournalPrintText +rlJournalEnd diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil new file mode 100644 index 0000000..a686a2b --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil @@ -0,0 +1,6 @@ +(type test_a_t) +(type test_b_t) +(type test_c_t) + +(typetransition test_a_t self file test_b_t) +(typetransition test_a_t self file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te new file mode 100644 index 0000000..a788670 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te @@ -0,0 +1,8 @@ +policy_module(test_self_tt_bad1,1.0) + +type test_a_t; +type test_b_t; +type test_c_t; + +type_transition test_a_t self:file test_b_t; +type_transition test_a_t self:file test_c_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil new file mode 100644 index 0000000..a1815b1 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil @@ -0,0 +1,6 @@ +(type test_a_t) +(type test_b_t) +(type test_c_t) + +(typetransition test_a_t self file test_b_t) +(typetransition test_a_t test_a_t file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te new file mode 100644 index 0000000..592880a --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te @@ -0,0 +1,8 @@ +policy_module(test_self_tt_bad2,1.0) + +type test_a_t; +type test_b_t; +type test_c_t; + +type_transition test_a_t self:file test_b_t; +type_transition test_a_t test_a_t:file test_c_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil new file mode 100644 index 0000000..850305b --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil @@ -0,0 +1,11 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t)) + +(typetransition test_attrib_1 self file test_b_t) +(typetransition test_a_t test_a_t file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te new file mode 100644 index 0000000..7be110a --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te @@ -0,0 +1,11 @@ +policy_module(test_self_tt_bad3,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t; +type test_d_t; + +type_transition test_attrib_1 self:file test_c_t; +type_transition test_a_t test_a_t:file test_d_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil new file mode 100644 index 0000000..0474094 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil @@ -0,0 +1,11 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t)) + +(typetransition test_a_t self file test_b_t) +(typetransition test_attrib_1 test_attrib_1 file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te new file mode 100644 index 0000000..2a2cd1e --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te @@ -0,0 +1,11 @@ +policy_module(test_self_tt_bad4,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t; +type test_d_t; + +type_transition test_a_t self:file test_c_t; +type_transition test_attrib_1 test_attrib_1:file test_d_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil new file mode 100644 index 0000000..6bd03d0 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil @@ -0,0 +1,6 @@ +(type test_a_t) +(type test_b_t) +(type test_c_t) + +(typetransition test_a_t self file "filename" test_b_t) +(typetransition test_a_t self file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te new file mode 100644 index 0000000..53391c7 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te @@ -0,0 +1,8 @@ +policy_module(test_self_tt_bad1,1.0) + +type test_a_t; +type test_b_t; +type test_c_t; + +type_transition test_a_t self:file test_b_t "filename"; +type_transition test_a_t self:file test_c_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil new file mode 100644 index 0000000..c7c9a12 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil @@ -0,0 +1,6 @@ +(type test_a_t) +(type test_b_t) +(type test_c_t) + +(typetransition test_a_t self file "filename" test_b_t) +(typetransition test_a_t test_a_t file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te new file mode 100644 index 0000000..e2c273d --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te @@ -0,0 +1,8 @@ +policy_module(test_self_tt_bad6,1.0) + +type test_a_t; +type test_b_t; +type test_c_t; + +type_transition test_a_t self:file test_b_t "filename"; +type_transition test_a_t test_a_t:file test_c_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil new file mode 100644 index 0000000..e84100f --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil @@ -0,0 +1,11 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t)) + +(typetransition test_attrib_1 self file "filename" test_b_t) +(typetransition test_a_t test_a_t file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te new file mode 100644 index 0000000..7b2f74e --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te @@ -0,0 +1,11 @@ +policy_module(test_self_tt_bad7,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t; +type test_d_t; + +type_transition test_attrib_1 self:file test_c_t "filename"; +type_transition test_a_t test_a_t:file test_d_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil new file mode 100644 index 0000000..b90d5a3 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil @@ -0,0 +1,11 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t)) + +(typetransition test_a_t self file "filename" test_b_t) +(typetransition test_attrib_1 test_attrib_1 file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te new file mode 100644 index 0000000..c649ec1 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te @@ -0,0 +1,11 @@ +policy_module(test_self_tt_bad8,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t; +type test_d_t; + +type_transition test_a_t self:file test_c_t "filename"; +type_transition test_attrib_1 test_attrib_1:file test_d_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil new file mode 100644 index 0000000..48dc17c --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil @@ -0,0 +1,56 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) +(type test_e_t) +(type test_f_t) +(type test_g_t) +(type test_h_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t test_c_t)) + +(classmap file_dir (set_1)) +(classmapping file_dir set_1 (file (all))) +(classmapping file_dir set_1 (dir (all))) + +(typetransition test_d_t self file_dir test_e_t) +(typetransition test_d_t self file_dir "filename1" test_f_t) +(typetransition test_d_t self file_dir "filename2" test_g_t) + +; duplicate equivalent rules should be allowed +(typetransition test_d_t test_d_t file_dir test_e_t) +(typetransition test_d_t test_d_t file_dir "filename1" test_f_t) +(typetransition test_d_t test_d_t file_dir "filename2" test_g_t) + +(typetransition test_attrib_1 self file_dir test_e_t) +(typetransition test_attrib_1 self file_dir "filename1" test_f_t) +(typetransition test_attrib_1 self file_dir "filename2" test_g_t) + +; CIL doesn't support inline type sets, so just add these rules +; to match the TE version +(typetransition test_h_t test_d_t file_dir test_e_t) +(typetransition test_h_t test_attrib_1 file_dir test_e_t) +(typetransition test_h_t self file_dir test_e_t) +(typetransition test_h_t test_d_t file_dir "filename1" test_f_t) +(typetransition test_h_t test_attrib_1 file_dir "filename1" test_f_t) +(typetransition test_h_t self file_dir "filename1" test_f_t) +(typetransition test_h_t test_d_t file_dir "filename2" test_g_t) +(typetransition test_h_t test_attrib_1 file_dir "filename2" test_g_t) +(typetransition test_h_t self file_dir "filename2" test_g_t) + +; test typechange and typemember as well +(typechange test_d_t self file_dir test_e_t) +(typechange test_d_t test_d_t file_dir test_e_t) +(typechange test_attrib_1 self file_dir test_e_t) +(typechange test_h_t test_d_t file_dir test_e_t) +(typechange test_h_t test_attrib_1 file_dir test_e_t) +(typechange test_h_t self file_dir test_e_t) + +(typemember test_d_t self file_dir test_e_t) +(typemember test_d_t test_d_t file_dir test_e_t) +(typemember test_attrib_1 self file_dir test_e_t) +(typemember test_h_t test_d_t file_dir test_e_t) +(typemember test_h_t test_attrib_1 file_dir test_e_t) +(typemember test_h_t self file_dir test_e_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_good.te b/libsepol/self-keyword-in-type-rules/test_self_tt_good.te new file mode 100644 index 0000000..4028741 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_good.te @@ -0,0 +1,42 @@ +policy_module(test_self_tt_good,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t, test_attrib_1; +type test_d_t; +type test_e_t; +type test_f_t; +type test_g_t; +type test_h_t; + +type_transition test_d_t self:{ file dir } test_e_t; +type_transition test_d_t self:{ file dir } test_f_t "filename1"; +type_transition test_d_t self:{ file dir } test_g_t "filename2"; + +# duplicate equivalent rules should be allowed +type_transition test_d_t test_d_t:{ file dir } test_e_t; +# ...but not for _filename_ transitions ¯\_(ツ)_/¯ +#type_transition test_d_t test_d_t:{ file dir } test_f_t "filename1"; +#type_transition test_d_t test_d_t:{ file dir } test_g_t "filename2"; + +type_transition test_attrib_1 self:{ file dir } test_e_t; +type_transition test_attrib_1 self:{ file dir } test_f_t "filename1"; +type_transition test_attrib_1 self:{ file dir } test_g_t "filename2"; + +# check this fancy syntax as well +type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t; +type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_f_t "filename1"; +type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_g_t "filename2"; + +# test type_change and type_member as well +type_change test_d_t self:{ file dir } test_e_t; +type_change test_d_t test_d_t:{ file dir } test_e_t; +type_change test_attrib_1 self:{ file dir } test_e_t; +type_change test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t; + +type_member test_d_t self:{ file dir } test_e_t; +type_member test_d_t test_d_t:{ file dir } test_e_t; +type_member test_attrib_1 self:{ file dir } test_e_t; +type_member test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t; diff --git a/libsepol/sepol_check_context/main.fmf b/libsepol/sepol_check_context/main.fmf index 3410cea..f0e3b5e 100644 --- a/libsepol/sepol_check_context/main.fmf +++ b/libsepol/sepol_check_context/main.fmf @@ -1,2 +1,30 @@ -path: /libsepol/sepol_check_context +summary: Does sepol_check_context() work as expected? +description: |+ + Does sepol_check_context() work as expected? + +contact: Milos Malik +component: + - libsepol +recommend: + - libsepol + - libsepol-devel + - gcc + - policycoreutils + - selinux-policy-devel +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - f32friendly + - f33friendly + - targeted + - avoidImageMode tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0554157 +extra-summary: /CoreOS/libsepol/Sanity/sepol_check_context +extra-task: /CoreOS/libsepol/Sanity/sepol_check_context diff --git a/libsepol/sepol_check_context/runtest.sh b/libsepol/sepol_check_context/runtest.sh old mode 100644 new mode 100755 index 6742dd9..66519cd --- a/libsepol/sepol_check_context/runtest.sh +++ b/libsepol/sepol_check_context/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libsepol" diff --git a/libsepol/user-declaration-in-module/Makefile b/libsepol/user-declaration-in-module/Makefile new file mode 100644 index 0000000..a649d44 --- /dev/null +++ b/libsepol/user-declaration-in-module/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libsepol/Sanity/user-declaration-in-module +# Description: Can libsepol handle users declared in modules? +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsepol/Sanity/user-declaration-in-module +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) test.sh foo.te Makefile + +.PHONY: all install download clean + +run: $(FILES) build + ./test.sh + +build: $(BUILT_FILES) + test -x test.sh || chmod a+x test.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Petr Lautrbach " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Can libsepol handle users declared in modules?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: libsepol" >> $(METADATA) + @echo "Requires: libsepol-devel selinux-policy-devel" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 2136212" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/libsepol/user-declaration-in-module/foo.te b/libsepol/user-declaration-in-module/foo.te new file mode 100644 index 0000000..74ee9c9 --- /dev/null +++ b/libsepol/user-declaration-in-module/foo.te @@ -0,0 +1,8 @@ +module foo 0.0.1; +require { + role staff_r; + sensitivity s0; + category c0; + category c1023; +} +user foo_u roles staff_r level s0 range s0 - s0:c0.c1023; diff --git a/libsepol/user-declaration-in-module/main.fmf b/libsepol/user-declaration-in-module/main.fmf new file mode 100644 index 0000000..265e20f --- /dev/null +++ b/libsepol/user-declaration-in-module/main.fmf @@ -0,0 +1,13 @@ +summary: Can libsepol handle users declared in modules? +test: ./test.sh +framework: beakerlib +component: + - libsepol +require: + - libsepol-devel + - selinux-policy-devel +tier: 1 +enabled: true +link: + - https://bugzilla.redhat.com/show_bug.cgi?id=2136212 +extra-nitrate: TC#0614379 diff --git a/libsepol/user-declaration-in-module/test.sh b/libsepol/user-declaration-in-module/test.sh new file mode 100755 index 0000000..90ab796 --- /dev/null +++ b/libsepol/user-declaration-in-module/test.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Petr Lautrbach + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "cp foo.te $tmp" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlAssertRpm "libsepol" + rlAssertRpm "selinux-policy-devel" + rlPhaseEnd + + rlPhaseStartTest + rlRun "make -f /usr/share/selinux/devel/Makefile foo.pp" 0 "Build a module with user declaration" + rlRun "semodule -i foo.pp" 0 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semodule -r foo" 0 + rlRun "popd" + rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd diff --git a/main.fmf b/main.fmf index 1be570e..0af284f 100644 --- a/main.fmf +++ b/main.fmf @@ -6,8 +6,6 @@ framework: beakerlib #contact: Petr Lautrbach #requires: [policycoreutils, libselinux-utils] -tags: [generic] - /checkpolicy: component: checkpolicy @@ -23,11 +21,18 @@ tags: [generic] /libsepol: component: libsepol +/mcstrans: + component: mcstrans + /policycoreutils: component: policycoreutils /selinux-policy: component: selinux-policy -/other: - component: selinux-policy +/setools: + component: setools + +adjust+: + - duration+: '*15' + when: rhivos_preload is defined and rhivos_preload == true diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile b/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile new file mode 100644 index 0000000..ae8a25f --- /dev/null +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile @@ -0,0 +1,76 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +# Description: setfscreatecon with invalid context can mistakenly succeed +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: setfscreatecon with invalid context can mistakenly succeed" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: mcstrans" >> $(METADATA) + @echo "Requires: mcstrans" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: mktemp" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 442327" >> $(METADATA) # Fedora 9 + + rhts-lint $(METADATA) + diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE b/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE new file mode 100644 index 0000000..4ecdd5e --- /dev/null +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +Author: Milos Malik + +Description: setfscreatecon with invalid context can mistakenly succeed + diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf new file mode 100644 index 0000000..fc979e6 --- /dev/null +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf @@ -0,0 +1,45 @@ +summary: setfscreatecon with invalid context can mistakenly succeed +description: |+ + Description: setfscreatecon with invalid context can mistakenly succeed + +contact: Milos Malik +component: + - mcstrans +test: ./runtest.sh +framework: beakerlib +recommend: + - mcstrans + - /usr/sbin/service + - selinux-policy + - selinux-policy-targeted + - libselinux + - libselinux-utils + - mktemp + - grep + - audit + - policycoreutils +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +duration: 5m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - f31friendly + - f32friendly + - failinrhel8ci + - targeted +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=442327 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=800470 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0062266 +extra-summary: /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +extra-task: /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh b/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh new file mode 100755 index 0000000..6a9cbc3 --- /dev/null +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh @@ -0,0 +1,85 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +# Description: setfscreatecon with invalid context can mistakenly succeed +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="mcstrans" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm selinux-policy + rlAssertRpm libselinux + OUTPUT_FILE=`mktemp` + if rlIsRHEL 5 6 ; then + rlServiceStop mcstrans + else + rlServiceStop mcstransd + fi + + rlRun "setenforce 1" + rlRun "sestatus" + START_DATE_TIME=`date "+%m/%d/%Y %T"` + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#442327" + if rlIsRHEL 5 6 ; then + rlRun "service mcstrans start" + else + rlRun "service mcstransd start" + fi + sleep 1 + rlRun "for I in \`seq 1 1 5000\` ; do mkdir d --context=xyz 2>/dev/null && { t=X ; rmdir d ; } || t=. ; printf \$t ; done >& ${OUTPUT_FILE}" + rlRun "grep -ci x ${OUTPUT_FILE}" 1 + sleep 1 + if rlIsRHEL 5 6 ; then + rlRun "service mcstrans stop" + else + rlRun "service mcstransd stop" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlRun "ausearch -m AVC -m USER_AVC -ts ${START_DATE_TIME} > ${OUTPUT_FILE}" 0,1 + LINE_COUNT=`grep 'type=AVC' ${OUTPUT_FILE} | grep -v 'type=AVC.*denied.*mac_admin.*mkdir' | wc -l` + rlAssert0 "number of unexpected AVCs in ${OUTPUT_FILE} should be 0" ${LINE_COUNT} + + if rlIsRHEL 5 6 ; then + rlServiceRestore mcstrans + else + rlServiceRestore mcstransd + fi + + rm -f ${OUTPUT_FILE} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/mcstrans/internal-examples-testsuite/Makefile b/mcstrans/internal-examples-testsuite/Makefile new file mode 100644 index 0000000..b6fc4e1 --- /dev/null +++ b/mcstrans/internal-examples-testsuite/Makefile @@ -0,0 +1,65 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/mcstrans/Sanity/internal-examples-testsuite +# Description: Wrapper for internal examples used as testsuite +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/mcstrans/Sanity/internal-examples-testsuite +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Wrapper for internal examples used as testsuite" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: mcstrans" >> $(METADATA) + @echo "Requires: mcstrans selinux-policy-targeted libselinux-python sed platform-python-devel python3-libselinux /usr/sbin/service" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 1656304" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/mcstrans/internal-examples-testsuite/PURPOSE b/mcstrans/internal-examples-testsuite/PURPOSE new file mode 100644 index 0000000..85fecad --- /dev/null +++ b/mcstrans/internal-examples-testsuite/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/mcstrans/Sanity/internal-examples-testsuite +Author: Milos Malik + +Internal examples and scripts are used as mcstrans testsuite. + diff --git a/mcstrans/internal-examples-testsuite/main.fmf b/mcstrans/internal-examples-testsuite/main.fmf new file mode 100644 index 0000000..ec20c6b --- /dev/null +++ b/mcstrans/internal-examples-testsuite/main.fmf @@ -0,0 +1,38 @@ +summary: Wrapper for internal examples used as testsuite +description: |+ + Internal examples and scripts are used as mcstrans testsuite. + +contact: Milos Malik +component: + - mcstrans +test: ./runtest.sh +framework: beakerlib +recommend: + - mcstrans + - selinux-policy-targeted + - libselinux-python + - sed + - platform-python-devel + - python3-libselinux + - /usr/sbin/service +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - f32friendly + - f33friendly + - targeted + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1656304 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0520362 +extra-summary: /CoreOS/mcstrans/Sanity/internal-examples-testsuite +extra-task: /CoreOS/mcstrans/Sanity/internal-examples-testsuite diff --git a/mcstrans/internal-examples-testsuite/runtest.sh b/mcstrans/internal-examples-testsuite/runtest.sh new file mode 100755 index 0000000..01ae3e3 --- /dev/null +++ b/mcstrans/internal-examples-testsuite/runtest.sh @@ -0,0 +1,181 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/mcstrans/Sanity/internal-examples-testsuite +# Description: Wrapper for internal examples used as testsuite +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="mcstrans" +if rlIsRHEL 5 6 ; then + SERVICE_NAME="mcstrans" +else + SERVICE_NAME="mcstransd" +fi + +if rlIsRHEL 5 6 7 ; then + PYTHON="python2" + SERVICE_START_LIMIT="[Service] +StartLimitIntervalSec=0 +StartLimitBurst=50 +" +else + PYTHON="python3" + SERVICE_START_LIMIT="[Unit] +StartLimitIntervalSec=0 +" +fi + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm selinux-policy-targeted + rlRun "mkdir -p /etc/systemd/system/mcstrans.service.d/" + rlRun "mkdir -p /etc/systemd/system/mcstransd.service.d/" + echo "${SERVICE_START_LIMIT}" > /etc/systemd/system/mcstrans.service.d/limit.conf + rlRun "cp /etc/systemd/system/mcstrans.service.d/limit.conf /etc/systemd/system/mcstransd.service.d/limit.conf" + rlRun "systemctl daemon-reload" + rlServiceStop ${SERVICE_NAME} + rlRun "mkdir -p /etc/selinux/targeted/setrans.d" + rlFileBackup /etc/selinux/targeted/secolor.conf + rlFileBackup /etc/selinux/targeted/setrans.conf + rlFileBackup /usr/share/mcstrans/util/mlscolor-test + rlFileBackup /usr/share/mcstrans/util/mlstrans-test + rlRun "sed -i 's/^verbose.*$/verbose=1/' /usr/share/mcstrans/util/mlscolor-test" + rlRun "sed -i 's/^verbose.*$/verbose=1/' /usr/share/mcstrans/util/mlstrans-test" + if ! rlIsRHEL 5 6 7 && ! rlIsFedora ; then + # convert the python2 scripts to python3 syntax + rlRun "2to3 -w --no-diffs /usr/share/mcstrans/util/mlscolor-test" + rlRun "2to3 -w --no-diffs /usr/share/mcstrans/util/mlstrans-test" + fi + rlPhaseEnd + + rlPhaseStartTest "default" + rlRun "pushd /usr/share/mcstrans/examples/default" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test default.test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "include" + rlRun "pushd /usr/share/mcstrans/examples/include" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" + rlRun "cp -f setrans.d/* /etc/selinux/targeted/setrans.d" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test default.test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "non-mls-color" + rlRun "pushd /usr/share/mcstrans/examples/non-mls-color" + rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf" + rlRun "rm -f /etc/selinux/targeted/setrans.conf" + rlRun "touch /etc/selinux/targeted/setrans.conf" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test non-mls.color" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "urcsts" + rlRun "pushd /usr/share/mcstrans/examples/urcsts" + rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + #rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test urcsts.color" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test urcsts.test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "urcsts-via-include" + rlRun "pushd /usr/share/mcstrans/examples/urcsts-via-include" + rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" + rlRun "rm -f /etc/selinux/targeted/setrans.d/*" + rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + #rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test urcsts.color" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test urcsts.test" + rlRun "popd" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "nato" + rlRun "pushd /usr/share/mcstrans/examples/nato" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" + rlRun "rm -f /etc/selinux/targeted/setrans.d/*" + rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + ${PYTHON} /usr/share/mcstrans/util/mlstrans-test nato.test + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test nato.test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "pipes" + rlRun "pushd /usr/share/mcstrans/examples/pipes" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" + rlRun "rm -f /etc/selinux/targeted/setrans.d/*" + rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + ${PYTHON} /usr/share/mcstrans/util/mlstrans-test pipes.test + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test pipes.test" + rlRun "popd" + rlPhaseEnd + fi + + rlPhaseStartCleanup + rlRun "rm -rf /etc/systemd/system/mcstrans.service.d/" + rlRun "rm -rf /etc/systemd/system/mcstransd.service.d/" + rlRun "rm -f /etc/selinux/targeted/secolor.conf /etc/selinux/targeted/setrans.conf" + rlRun "rm -rf /etc/selinux/targeted/setrans.d" + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile new file mode 100644 index 0000000..dc15dc2 --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +# Description: mcstrans daemon segfaults when secon -C asks for incomplete context +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE secolor.conf + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: mcstrans daemon segfaults when secon -C asks for incomplete context" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: mcstrans" >> $(METADATA) + @echo "Requires: mcstrans selinux-policy-targeted policycoreutils libselinux-python python3-libselinux /usr/sbin/service" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 1315996" >> $(METADATA) # RHEL-7 + @echo "Bug: 1316680" >> $(METADATA) # RHEL-6 + @echo "Bug: 1699784" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE new file mode 100644 index 0000000..49f8afd --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +Author: Milos Malik + +Description: mcstrans daemon segfaults when secon -C asks for incomplete context + diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf new file mode 100644 index 0000000..7d3bd93 --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf @@ -0,0 +1,38 @@ +summary: mcstrans daemon segfaults when secon -C asks for incomplete context +description: |+ + Description: mcstrans daemon segfaults when secon -C asks for incomplete context + +contact: Milos Malik +component: + - mcstrans +test: ./runtest.sh +framework: beakerlib +recommend: + - mcstrans + - selinux-policy-targeted + - policycoreutils + - libselinux-python + - python3-libselinux + - /usr/sbin/service +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1315996 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1316680 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699784 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0520380 +extra-summary: /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +extra-task: /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh new file mode 100755 index 0000000..5b089dc --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh @@ -0,0 +1,87 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +# Description: mcstrans daemon segfaults when secon -C asks for incomplete context +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="mcstrans" +if rlIsRHEL 6 ; then + SERVICE_NAME="mcstrans" +else # RHEL-7 and above + SERVICE_NAME="mcstransd" +fi +if rlIsRHEL 6 7 ; then + if which python3 >& /dev/null ; then + PYTHON="python3" + else + PYTHON="python2" + fi +else # RHEL-8 + if which python3 >& /dev/null ; then + PYTHON="python3" + else + PYTHON="/usr/libexec/platform-python" + fi +fi + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm policycoreutils + rlAssertRpm selinux-policy-targeted + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/selinux/targeted/secolor.conf + rlPhaseEnd + + rlPhaseStartTest "bz#1315996 + bz#1316680 + bz#1699784" + rlRun "dmesg > before-secon-C.txt" + rlRun "cp -f secolor.conf /etc/selinux/targeted/" + for CONTEXT in ":::" "xyz_u:xyz_r:xyz_t:" "user_u:" "user_u:user_r:" "user_u:user_r:user_t:" ; do + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + set -x + echo -en "import selinux\nselinux.selinux_raw_context_to_color(\"${CONTEXT}\")\n" | ${PYTHON} + set +x + # rlRun "secon -C ${CONTEXT}" 0,1 + sleep 1 + rlRun "service ${SERVICE_NAME} status" + done + rlRun "dmesg > after-secon-C.txt" + rlRun "diff before-secon-C.txt after-secon-C.txt | grep \"mcstransd.*segfault\"" 1 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f before-secon-C.txt after-secon-C.txt" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf new file mode 100644 index 0000000..17abaaf --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf @@ -0,0 +1,24 @@ +color black = #000000 +color green = #008000 +color yellow = #ffff00 +color blue = #0000ff +color white = #ffffff +color red = #ff0000 +color orange = #ffa500 +color tan = #d2b48c + +user unconfined_u = #ff0000 green +role unconfined_r = red #ffffff +type unconfined_t = red orange +user user_u = black green +role user_r = white black +type user_t = tan red +user xguest_u = black yellow +role xguest_r = black red +type xguest_t = black green +user sysadm_u = white black +range s0:c0.c1023 = black white +user * = black white +role * = black white +type * = black white + diff --git a/other/collect-denials/main.fmf b/other/collect-denials/main.fmf new file mode 100644 index 0000000..6d6aa03 --- /dev/null +++ b/other/collect-denials/main.fmf @@ -0,0 +1,13 @@ +summary: collect SELinux denials which appeared since boot +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +recommend: + - audit + - /usr/sbin/service + - policycoreutils +duration: 5m +enabled: true +tag: + - failinfedora + - avoidImageMode diff --git a/other/collect-denials/runtest.sh b/other/collect-denials/runtest.sh new file mode 100755 index 0000000..ff52732 --- /dev/null +++ b/other/collect-denials/runtest.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "sestatus" + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "service auditd status -l" + rlRun "ausearch -m avc -m selinux_err -i -ts boot" 1 + rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + diff --git a/other/collect-denials/test.sh b/other/collect-denials/test.sh new file mode 100755 index 0000000..f8845e4 --- /dev/null +++ b/other/collect-denials/test.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "sestatus" + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "service auditd status -l" + rlRun "ausearch -m avc -m selinux_err -i -ts boot" + rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + diff --git a/other/mounting/Makefile b/other/mounting/Makefile index d2bedf4..541f560 100644 --- a/other/mounting/Makefile +++ b/other/mounting/Makefile @@ -41,7 +41,6 @@ build: $(BUILT_FILES) clean: rm -f *~ $(BUILT_FILES) - include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile @@ -61,6 +60,7 @@ $(METADATA): Makefile @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) rhts-lint $(METADATA) + diff --git a/other/mounting/main.fmf b/other/mounting/main.fmf index bf52899..2ee20f9 100644 --- a/other/mounting/main.fmf +++ b/other/mounting/main.fmf @@ -1,9 +1,25 @@ -path: /other/mounting -summary: Mount various filesystems, test context options -description: | - Test the context and defcontext options of the mount command. Test - different filesystems: ext2, ext3, ext4. XFS, FAT32. Requires - e2fsprogs and dosfstools. -adjust: -- enabled: false - when: distro < rhel-7 +summary: Mount various filesystems, test context options. +description: '' +contact: Milos Malik +component: + - selinux-policy +recommend: + - selinux-policy + - util-linux + - e2fsprogs + - dosfstools +enabled: true +duration: 5m +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - failinfedora + - targeted +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0571362 +extra-summary: /CoreOS/selinux-policy/Sanity/mounting +extra-task: /CoreOS/selinux-policy/Sanity/mounting diff --git a/other/mounting/runtest.sh b/other/mounting/runtest.sh index d012460..34b6815 100755 --- a/other/mounting/runtest.sh +++ b/other/mounting/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -39,7 +38,7 @@ rlJournalStart rlAssertRpm "dosfstools" # create a loopback device - rlRun "fallocate -l 100M loop_file" + rlRun "fallocate -l 400M loop_file" rlRun "losetup -f loop_file" rlRun "losetup -l | grep loop_file" DEV="$(losetup -l | tail -n 1 | cut -f1 -d' ')" diff --git a/other/swig-deprecation-warnings/main.fmf b/other/swig-deprecation-warnings/main.fmf new file mode 100644 index 0000000..3517e20 --- /dev/null +++ b/other/swig-deprecation-warnings/main.fmf @@ -0,0 +1,32 @@ +summary: test if python code produces deprecation messages +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - libselinux + - libsemanage + - policycoreutils + - setools +recommend: + - python3 + - python3-libselinux + - python3-libsemanage + - python3-policycoreutils + - python3-setools +duration: 5m +enabled: true +link: + - verifies: https://issues.redhat.com/browse/RHEL-118812 + - verifies: https://issues.redhat.com/browse/RHEL-138405 + - verifies: https://issues.redhat.com/browse/RHEL-138406 +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false + diff --git a/other/swig-deprecation-warnings/runtest.sh b/other/swig-deprecation-warnings/runtest.sh new file mode 100755 index 0000000..16af69a --- /dev/null +++ b/other/swig-deprecation-warnings/runtest.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "sestatus" + rlRun "rpm -qa | grep -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils -e setools | sort" + rlPhaseEnd + + rlPhaseStartTest "libselinux - RHEL-118812" + rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import selinux\"" + rlRun "grep -i deprecation $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "libsemanage - RHEL-138405" + rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import semanage\"" + rlRun "grep -i deprecation $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "policycoreutils - RHEL-138406" + rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import seobject ; import sepolgen ; import sepolicy\"" + rlRun "grep -i deprecation $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "setools" + rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import setools\"" + rlRun "grep -i deprecation $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + diff --git a/other/update-packages/main.fmf b/other/update-packages/main.fmf new file mode 100644 index 0000000..179a2e4 --- /dev/null +++ b/other/update-packages/main.fmf @@ -0,0 +1,8 @@ +summary: update packages to the latest versions available +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +duration: 15m +enabled: true +tag: + - avoidImageMode diff --git a/other/update-packages/runtest.sh b/other/update-packages/runtest.sh new file mode 100755 index 0000000..bcdf7d6 --- /dev/null +++ b/other/update-packages/runtest.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "dnf clean all" + rlRun "dnf -y update --nobest --allowerasing" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd +rlJournalEnd + diff --git a/other/update-packages/test.sh b/other/update-packages/test.sh new file mode 100755 index 0000000..967588e --- /dev/null +++ b/other/update-packages/test.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "dnf clean all" + rlRun "dnf -y update --skip-broken --allowerasing" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd +rlJournalEnd + diff --git a/plans/ci.fmf b/plans/ci.fmf new file mode 100644 index 0000000..454574d --- /dev/null +++ b/plans/ci.fmf @@ -0,0 +1,9 @@ +summary: CI test plan that runs only modified tests +discover: + how: fmf + modified-only: true + modified-url: https://src.fedoraproject.org/tests/selinux + modified-ref: reference/main +execute: + how: tmt + diff --git a/plans/failing.fmf b/plans/failing.fmf new file mode 100644 index 0000000..178ab77 --- /dev/null +++ b/plans/failing.fmf @@ -0,0 +1,11 @@ +summary: test plan which contains failing tests +adjust+: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: "tag:failinfedora" +execute: + how: tmt + diff --git a/plans/gating.fmf b/plans/gating.fmf new file mode 100644 index 0000000..a2c97ba --- /dev/null +++ b/plans/gating.fmf @@ -0,0 +1,11 @@ +summary: Gating test plan +adjust+: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: "tag:CI-Tier-1 & tag:-failinfedora" +execute: + how: tmt + diff --git a/plans/image-mode.fmf b/plans/image-mode.fmf new file mode 100644 index 0000000..2b074df --- /dev/null +++ b/plans/image-mode.fmf @@ -0,0 +1,17 @@ +summary: general test plan for image mode +enabled: true +adjust+: +- when: trigger == build + enabled: false + because: do not run this plan on a new build +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: 'tag:-tf_broken & tag:-multihost & tag:-reboot & tag:-avoidImageMode' +prepare: +- how: install + package: https://download.copr.fedorainfracloud.org/results/mmalik/mnt-tests/epel-10-x86_64/09597416-mnt-tests/mnt-tests-1.0-1.el10.noarch.rpm +execute: + how: tmt diff --git a/plans/main.fmf b/plans/main.fmf new file mode 100644 index 0000000..9459ca0 --- /dev/null +++ b/plans/main.fmf @@ -0,0 +1,3 @@ +# do not inherit test-specific metadata from toplevel +/: + inherit: false diff --git a/plans/notier.fmf b/plans/notier.fmf new file mode 100644 index 0000000..790b033 --- /dev/null +++ b/plans/notier.fmf @@ -0,0 +1,15 @@ +summary: no tier test plan +adjust+: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: "tag:-Tier1 & tag:-Tier2 & tag:-Tier3 & tag:-CI-Tier-1 & tag:-failinfedora" +execute: + how: tmt +provision: + hardware: + cpu: + cores: '>= 2' + diff --git a/plans/reboot.fmf b/plans/reboot.fmf new file mode 100644 index 0000000..cb304d0 --- /dev/null +++ b/plans/reboot.fmf @@ -0,0 +1,11 @@ +summary: update, reboot and check for denials +discover: + how: fmf + url: https://src.fedoraproject.org/tests/selinux + test: + - /other/update-packages + - /selinux-policy/bz533007-unable-to-start-kdump-service + - /other/collect-denials +execute: + how: tmt + diff --git a/plans/tier1.fmf b/plans/tier1.fmf new file mode 100644 index 0000000..bf35d2d --- /dev/null +++ b/plans/tier1.fmf @@ -0,0 +1,11 @@ +summary: Tier1 test plan +adjust+: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: "tier:1 & tag:-failinfedora" +execute: + how: tmt + diff --git a/plans/tier2.fmf b/plans/tier2.fmf new file mode 100644 index 0000000..ab9f339 --- /dev/null +++ b/plans/tier2.fmf @@ -0,0 +1,11 @@ +summary: Tier2 test plan +adjust+: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: "tier:2 & tag:-failinfedora" +execute: + how: tmt + diff --git a/plans/tier3.fmf b/plans/tier3.fmf new file mode 100644 index 0000000..b57f030 --- /dev/null +++ b/plans/tier3.fmf @@ -0,0 +1,11 @@ +summary: Tier3 test plan +adjust+: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: "tier:3 & tag:-failinfedora" +execute: + how: tmt + diff --git a/policycoreutils/CIL-modules-without-compilation/Makefile b/policycoreutils/CIL-modules-without-compilation/Makefile index 2d8a660..a16e88d 100644 --- a/policycoreutils/CIL-modules-without-compilation/Makefile +++ b/policycoreutils/CIL-modules-without-compilation/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: /usr/sbin/semodule /usr/sbin/semanage" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/policycoreutils/CIL-modules-without-compilation/main.fmf b/policycoreutils/CIL-modules-without-compilation/main.fmf index 02538f7..38386d3 100644 --- a/policycoreutils/CIL-modules-without-compilation/main.fmf +++ b/policycoreutils/CIL-modules-without-compilation/main.fmf @@ -1 +1,29 @@ -path: /policycoreutils/CIL-modules-without-compilation +summary: What the test does +description: |+ + Is it possible to manage policy modules written in CIL without any compilation? Does semanage and semodule understand them? + +contact: Milos Malik +component: + - policycoreutils +recommend: + - /usr/sbin/semodule + - /usr/sbin/semanage +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0535087 +extra-summary: /CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation +extra-task: /CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation diff --git a/policycoreutils/CIL-modules-without-compilation/runtest.sh b/policycoreutils/CIL-modules-without-compilation/runtest.sh index 451461a..f47e67f 100755 --- a/policycoreutils/CIL-modules-without-compilation/runtest.sh +++ b/policycoreutils/CIL-modules-without-compilation/runtest.sh @@ -27,18 +27,21 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" +PACKAGE_VERSION=`rpm -q --queryformat '%{version}' ${PACKAGE}` rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE rlRun "echo '()' > empty.cil" + rlRun "echo '( auditallow init_t security_t ( security ( setsecparam )))' > valid.cil" rlRun "echo '(())' > invalid.cil" rlPhaseEnd + # version 3.3 of SELinux user-space does not accept empty CIL module + if rlTestVersion "${PACKAGE_VERSION}" "<" "3.3" ; then rlPhaseStartTest "empty CIL module" rlRun "semodule -lfull | grep '400.*empty.*cil'" 1 rlRun "semodule -i empty.cil" @@ -51,6 +54,20 @@ rlJournalStart rlRun "semanage module -r empty" rlRun "semanage module -l | grep 'empty.*400.*cil'" 1 rlPhaseEnd + fi + + rlPhaseStartTest "valid CIL module" + rlRun "semodule -lfull | grep '400.*valid.*cil'" 1 + rlRun "semodule -i valid.cil" + rlRun "semodule -lfull | grep '400.*valid.*cil'" + rlRun "semodule -r valid" + rlRun "semodule -lfull | grep '400.*valid.*cil'" 1 + rlRun "semanage module -l | grep 'valid.*400.*cil'" 1 + rlRun "semanage module -a valid.cil" + rlRun "semanage module -l | grep 'valid.*400.*cil'" + rlRun "semanage module -r valid" + rlRun "semanage module -l | grep 'valid.*400.*cil'" 1 + rlPhaseEnd rlPhaseStartTest "invalid CIL module" rlRun "semodule -lfull | grep '400.*invalid.*cil'" 1 @@ -66,7 +83,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartCleanup - rlRun "rm -f empty.cil invalid.cil" + rlRun "rm -f empty.cil valid.cil invalid.cil" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/policycoreutils/booleans/main.fmf b/policycoreutils/booleans/main.fmf index 2b7a3ac..9b3f7d4 100644 --- a/policycoreutils/booleans/main.fmf +++ b/policycoreutils/booleans/main.fmf @@ -1,9 +1,26 @@ -path: /policycoreutils/booleans -summary: Test basic operations with booleans -description: | - The test defines its own booleans and tests setting it on and off - using setsebool and semanage boolean. +summary: Basic operations with booleans +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted tier: 1 -adjust: -- enabled: false - when: distro < rhel-7 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0571350 +extra-summary: /CoreOS/policycoreutils/Sanity/booleans +extra-task: /CoreOS/policycoreutils/Sanity/booleans diff --git a/policycoreutils/booleans/runtest.sh b/policycoreutils/booleans/runtest.sh index 925d3d9..ab3760e 100755 --- a/policycoreutils/booleans/runtest.sh +++ b/policycoreutils/booleans/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/file-contexts/Makefile b/policycoreutils/file-contexts/Makefile index fde8428..37dce15 100644 --- a/policycoreutils/file-contexts/Makefile +++ b/policycoreutils/file-contexts/Makefile @@ -60,5 +60,6 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + @echo "Bug: 1822100" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/policycoreutils/file-contexts/main.fmf b/policycoreutils/file-contexts/main.fmf index 4c27a2c..7f3dfa1 100644 --- a/policycoreutils/file-contexts/main.fmf +++ b/policycoreutils/file-contexts/main.fmf @@ -1,8 +1,29 @@ -path: /policycoreutils/file-contexts summary: Test semanage fcontext, restorecon, fixfiles, chcon -description: | - The test adds custom file contexts, runs restorecon and checks file - contexts. The chcon command is also tested. -adjust: -- enabled: false - when: distro < rhel-7 +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1822100 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0576069 +extra-summary: /CoreOS/policycoreutils/Sanity/file-contexts +extra-task: /CoreOS/policycoreutils/Sanity/file-contexts diff --git a/policycoreutils/file-contexts/runtest.sh b/policycoreutils/file-contexts/runtest.sh index d421ec8..b736e5a 100755 --- a/policycoreutils/file-contexts/runtest.sh +++ b/policycoreutils/file-contexts/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -55,7 +54,11 @@ rlJournalStart rlAssertGrep "/run/\.\* *all files *$RUN_CON" stdout rlAssertGrep "/run *directory *$RUN_CON" stdout rlAssertGrep "/home/\[\^/\]+/bin(/\.\*)? *all files *$HOME_BIN_CON" stdout - rlAssertGrep "/run = /var/run" stdout + if rlIsFedora '>= 40' || rlIsCentOS '>= 10' || rlIsRHEL '>= 10' ; then + rlAssertGrep "/var/run = /run" stdout + else + rlAssertGrep "/run = /var/run" stdout + fi rlPhaseEnd rlPhaseStartTest "semanage fcontext add and delete" @@ -205,6 +208,15 @@ rlJournalStart rlRun "rm -rf /tmp/test" rlPhaseEnd + rlPhaseStartTest "semanage loses sys.stderr bz#1822100" + rlRun "semanage fcontext -l | egrep -s -q -e '^/home'" 0 + # Capture Broken pipe error + rlRun "semanage fcontext -l 2> /tmp/output_file | egrep -s -q -e '^/home'" + rlAssertGrep "Broken pipe" /tmp/output_file + rlAssertNotGrep "lost sys.stderr" /tmp/output_file + rlRun "rm -f /tmp/output_file" + rlPhaseEnd + rlPhaseStartCleanup rlRun "rm -rf stdout" rlPhaseEnd diff --git a/policycoreutils/fixfiles-F-B-N/main.fmf b/policycoreutils/fixfiles-F-B-N/main.fmf index 70e58e3..ace6639 100644 --- a/policycoreutils/fixfiles-F-B-N/main.fmf +++ b/policycoreutils/fixfiles-F-B-N/main.fmf @@ -1,7 +1,10 @@ -path: /policycoreutils/fixfiles-F-B-N -summary: Test fixfiles [-F] [-B] onboot -description: | - Run fixfiles with -F and -B options and check /.autorelabel -adjust: -- enabled: false - when: distro < rhel-7 +summary: Tests fixfiles -F | -B | -N options +description: '' +contact: Petr Lautrbach +component: + - policycoreutils +extra-summary: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N +extra-task: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N +id: d70961fa-6c8b-442d-9706-c8ef47969685 +tag: + - avoidImageMode diff --git a/policycoreutils/fixfiles-F-B-N/runtest.sh b/policycoreutils/fixfiles-F-B-N/runtest.sh index ab401df..34eb5fc 100755 --- a/policycoreutils/fixfiles-F-B-N/runtest.sh +++ b/policycoreutils/fixfiles-F-B-N/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/linux-system-roles.selinux-tests/Makefile b/policycoreutils/linux-system-roles.selinux-tests/Makefile index eed0222..15c1ff0 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/Makefile +++ b/policycoreutils/linux-system-roles.selinux-tests/Makefile @@ -50,7 +50,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) + @echo "TestTime: 40m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) @echo "Requires: policycoreutils ansible git" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/policycoreutils/linux-system-roles.selinux-tests/main.fmf b/policycoreutils/linux-system-roles.selinux-tests/main.fmf index df9c7a2..6498f6d 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/main.fmf +++ b/policycoreutils/linux-system-roles.selinux-tests/main.fmf @@ -1,2 +1,18 @@ -path: /policycoreutils/linux-system-roles.selinux-tests -tags: [fedora] +summary: Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) + Ansible role tests +description: | + Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests +contact: Petr Lautrbach +component: + - policycoreutils +recommend: + - policycoreutils + - ansible + - git +duration: 40m +tag: + - NoRHIVOS + - avoidImageMode +extra-summary: linux-system-roles.selinux-tests +extra-task: linux-system-roles.selinux-tests +id: 4889350b-d9fa-4cbf-86ff-f16a1c729f9e diff --git a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh index 5332b8e..83fc6cc 100755 --- a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh +++ b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh @@ -25,7 +25,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -34,8 +33,14 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE rlAssertRpm "git" - rlAssertRpm "ansible" - + if ! rpm -q ansible; then + rlLog "There's no ansible rpm, trying: pip3 install ansible" + rlRun "dnf -y install python3-pip" + rlRun "pip3 install ansible" + rlRun "ansible-playbook --version" 0 + else + rlAssertRpm "ansible" + fi rlPhaseEnd rlPhaseStartTest @@ -46,7 +51,7 @@ rlJournalStart if [ $ansible_test = "tests_all_transitions.yml" ]; then continue fi - rlRun "ansible-playbook -i localhost, -c local -v $ansible_test" + rlRun "ansible-playbook --skip-tags tests::bootc-e2e -i localhost, -c local -v $ansible_test" done rlPhaseEnd diff --git a/policycoreutils/load_policy/main.fmf b/policycoreutils/load_policy/main.fmf index e375cb8..aae0df7 100644 --- a/policycoreutils/load_policy/main.fmf +++ b/policycoreutils/load_policy/main.fmf @@ -1 +1,37 @@ -path: /policycoreutils/load_policy +summary: Does load_policy work as expected? Does it produce correct audit messages? +description: |+ + Does load_policy work as expected? Does it produce correct audit messages? + +contact: Milos Malik +component: + - policycoreutils +recommend: + - audit + - policycoreutils + - selinux-policy-targeted + - initscripts +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - failinrhel8ci + - targeted + - avoidImageMode +tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false + - when: distro >= rhel-10 + recommend+: + - audit-rules + because: since RHEL 10 package audit was split and early packages have wrong dependency +extra-nitrate: TC#0542457 +extra-summary: /CoreOS/policycoreutils/Sanity/load_policy +extra-task: /CoreOS/policycoreutils/Sanity/load_policy diff --git a/policycoreutils/load_policy/runtest.sh b/policycoreutils/load_policy/runtest.sh index 2698d94..c7809c3 100755 --- a/policycoreutils/load_policy/runtest.sh +++ b/policycoreutils/load_policy/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -64,13 +63,13 @@ rlJournalStart rlRun "grep -i selinux /proc/mounts" sleep 1 if rlIsRHEL ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep load_policy" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep load_policy" fi if rlIsRHEL 5 6 7 ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'policy loaded'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'policy loaded'" else # we assume that audit message has a different format now (does not contain "policy loaded") - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'type=MAC_POLICY_LOAD'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'type=MAC_POLICY_LOAD'" fi rlRun "umount --lazy ${SELINUX_FS_MOUNT}" 0,32 if [ $? -eq 0 ] ; then @@ -81,13 +80,13 @@ rlJournalStart rlRun "grep -i selinux /proc/mounts" sleep 1 if rlIsRHEL ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep load_policy" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep load_policy" fi if rlIsRHEL 5 6 7 ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'policy loaded'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'policy loaded'" else # we assume that audit message has a different format now (does not contain "policy loaded") - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'type=MAC_POLICY_LOAD'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'type=MAC_POLICY_LOAD'" fi fi rlRun "dmesg | grep -i selinux" diff --git a/policycoreutils/modules/main.fmf b/policycoreutils/modules/main.fmf index dc4e4a5..cde2ca0 100644 --- a/policycoreutils/modules/main.fmf +++ b/policycoreutils/modules/main.fmf @@ -1,12 +1,27 @@ -path: /policycoreutils/modules -summary: test basic module functionality -description: | - The test compiles a TE module, loads it via semodule, and checks - that the rules are enforced. The same is done with a CIL module. - Module overriding using priorities and module disabling is also - tested. This test requires policycoreutils and selinux-policy-devel - packages. +summary: Test module compiling and loading +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - selinux-policy-devel duration: 10m -adjust: -- enabled: false - when: distro < rhel-7 +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly +tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0571503 +extra-summary: /CoreOS/policycoreutils/Sanity/modules +extra-task: /CoreOS/policycoreutils/Sanity/modules diff --git a/policycoreutils/modules/runtest.sh b/policycoreutils/modules/runtest.sh index 280c831..408d04c 100755 --- a/policycoreutils/modules/runtest.sh +++ b/policycoreutils/modules/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/org-selinux-dbus-interfaces/Makefile b/policycoreutils/org-selinux-dbus-interfaces/Makefile index 92c8af6..6f00b43 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/Makefile +++ b/policycoreutils/org-selinux-dbus-interfaces/Makefile @@ -51,7 +51,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Do the D-bus interfaces/methods of /org/selinux/object work as expected?" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) @echo "Requires: dbus-tools policycoreutils-dbus selinux-policy-minimum selinux-policy-mls selinux-policy-targeted" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -63,3 +63,4 @@ $(METADATA): Makefile @echo "Bug: 1754873" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) + diff --git a/policycoreutils/org-selinux-dbus-interfaces/main.fmf b/policycoreutils/org-selinux-dbus-interfaces/main.fmf index 8ecc4af..1a6c054 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/main.fmf +++ b/policycoreutils/org-selinux-dbus-interfaces/main.fmf @@ -1,9 +1,34 @@ -path: /policycoreutils/org-selinux-dbus-interfaces summary: Do the D-bus interfaces/methods of /org/selinux/object work as expected? -description: | - Do the D-bus interfaces/methods of /org/selinux/object work as expected? +description: '' +contact: Milos Malik component: -- policycoreutils -adjust: -- enabled: false - when: distro < rhel-8 + - policycoreutils +recommend: + - dbus-tools + - policycoreutils-dbus + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted +duration: 20m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail + - TIPfail_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1415988 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754873 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0546187 +extra-summary: /CoreOS/policycoreutils/Sanity/org-selinux-dbus-interfaces +extra-task: /CoreOS/policycoreutils/Sanity/org-selinux-dbus-interfaces diff --git a/policycoreutils/org-selinux-dbus-interfaces/runtest.sh b/policycoreutils/org-selinux-dbus-interfaces/runtest.sh index 458c695..720fe5a 100755 --- a/policycoreutils/org-selinux-dbus-interfaces/runtest.sh +++ b/policycoreutils/org-selinux-dbus-interfaces/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -91,13 +90,16 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "org.selinux.change_default_policy" + # 1 argument is missing rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy" 1 - rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:minimum" - rlRun "grep SELINUXTYPE=minimum /etc/selinux/config" - rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:mls" - rlRun "grep SELINUXTYPE=mls /etc/selinux/config" - rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:targeted" - rlRun "grep SELINUXTYPE=targeted /etc/selinux/config" + # test existing policies + for POLICY_KIND in minimum mls targeted ; do + if rpm -q selinux-policy-${POLICY_KIND} ; then + rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:${POLICY_KIND}" + rlRun "grep SELINUXTYPE=${POLICY_KIND} /etc/selinux/config" + fi + done + # test a non-existent policy rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:xyz" 1 rlPhaseEnd diff --git a/policycoreutils/python-module-precedence-issue/Makefile b/policycoreutils/python-module-precedence-issue/Makefile new file mode 100644 index 0000000..a5c30d3 --- /dev/null +++ b/policycoreutils/python-module-precedence-issue/Makefile @@ -0,0 +1,65 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Regression/python-module-precedence-issue +# Description: Tools like semanage must be hardened to avoid loading +# rogue python modules that could lead to unexpected failures. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Regression/python-module-precedence-issue +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Amith Kumar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Tools must be hardened to block unwanted python modules" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 1m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils /usr/sbin/semanage" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 2128976" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/policycoreutils/python-module-precedence-issue/PURPOSE b/policycoreutils/python-module-precedence-issue/PURPOSE new file mode 100644 index 0000000..b392571 --- /dev/null +++ b/policycoreutils/python-module-precedence-issue/PURPOSE @@ -0,0 +1,4 @@ +PURPOSE of /CoreOS/policycoreutils/Regression/python-module-precedence-issue +Description: Tools like semanage must be hardened to avoid loading rogue python modules that + could lead to unexpected failures. +Author: Amith Kumar diff --git a/policycoreutils/python-module-precedence-issue/main.fmf b/policycoreutils/python-module-precedence-issue/main.fmf new file mode 100644 index 0000000..a84f7f9 --- /dev/null +++ b/policycoreutils/python-module-precedence-issue/main.fmf @@ -0,0 +1,31 @@ +summary: Harden tools to avoid loading of unchecked python modules. +description: Tools like semanage must be hardened to avoid loading rogue python modules that could lead to unexpected failures. +contact: Amith Kumar +component: + - policycoreutils +test: ./runtest.sh +framework: beakerlib +recommend: + - policycoreutils + - /usr/sbin/semanage +duration: 1m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - avoidImageMode +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2128976 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0614726 diff --git a/policycoreutils/python-module-precedence-issue/runtest.sh b/policycoreutils/python-module-precedence-issue/runtest.sh new file mode 100755 index 0000000..7e91592 --- /dev/null +++ b/policycoreutils/python-module-precedence-issue/runtest.sh @@ -0,0 +1,59 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Regression/python-module-precedence-issue +# Description: Tools like semanage must be hardened to avoid loading +# rogue python modules that could lead to unexpected failures. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "tmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $tmpDir" + rlPhaseEnd + + rlPhaseStartTest "bz2128976 Tools must be hardened to not load rogue python modules" + # Create a custom python script in /usr/sbin +cat > /usr/sbin/audit.py << EOF +import sys +print("BAD GUY!", file=sys.stderr) +sys.exit(1) +EOF + # List all boolean records + rlRun "semanage boolean -l > /dev/null" 0 + rlPhaseEnd + + rlPhaseStartCleanup + # Remove irrelevant files + rlRun "rm /usr/sbin/audit.py" + rlRun "popd" + rlRun "rm -r $tmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/policycoreutils/restorecon-ignores-missing/main.fmf b/policycoreutils/restorecon-ignores-missing/main.fmf new file mode 100644 index 0000000..9c00dc1 --- /dev/null +++ b/policycoreutils/restorecon-ignores-missing/main.fmf @@ -0,0 +1,30 @@ +summary: restorecon -i should ignore missing files/directories +description: Does restorecon -i work as expected? +contact: Milos Malik +component: + - libselinux + - policycoreutils +recommend: + - libselinux + - policycoreutils +duration: 5m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +tier: 1 +link: + - verifies: https://issues.redhat.com/browse/RHEL-110181 + - verifies: https://issues.redhat.com/browse/RHEL-123884 + - verifies: https://issues.redhat.com/browse/RHEL-123885 +adjust+: + - enabled: false + when: distro < rhel-8 or distro ~< rhel-9.8 or distro ~< rhel-10.2 + continue: false + because: Fixed in RHEL-8.10, RHEL-10.2, RHEL-9 fix expected in RHEL-9.8 +extra-nitrate: TC#0619904 +id: baf5db72-ac2b-4d70-90a2-806073285d7c diff --git a/policycoreutils/restorecon-ignores-missing/runtest.sh b/policycoreutils/restorecon-ignores-missing/runtest.sh new file mode 100755 index 0000000..f7e0049 --- /dev/null +++ b/policycoreutils/restorecon-ignores-missing/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep -e libselinux -e policycoreutils | sort" + rlRun "man restorecon | col -b | grep -i 'ignore.*exist'" + rlRun "mkdir -p tmp" + OUTPUT_FILE=`mktemp` + rlPhaseEnd + + rlPhaseStartTest "RHEL-110181 + RHEL-123884" + rlRun "pushd tmp" + rlLog "starting the creator process" + ( while true ; do + mkdir dir + mkfifo fifo + touch file + chcon -t etc_t dir fifo file + rm -rf dir fifo file + done ) & + CREATOR_PID=$! + rlRun "popd" + + rlLog "starting the restorecon process" + ( while true ; do restorecon -RFivv tmp ; done ) >& ${OUTPUT_FILE} & + RESTORECON_PID=$! + + rlRun "sleep 30s" + rlRun "kill ${CREATOR_PID}" 0,1 + rlRun "kill ${RESTORECON_PID}" 0,1 + rlRun "ls -l ${OUTPUT_FILE}" + rlRun "grep -i -e 'no such file' -e 'not set context' ${OUTPUT_FILE}" 1 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf tmp ${OUTPUT_FILE}" + rlPhaseEnd +rlJournalEnd + diff --git a/policycoreutils/restorecon/main.fmf b/policycoreutils/restorecon/main.fmf index 90bf595..9d6fcb9 100644 --- a/policycoreutils/restorecon/main.fmf +++ b/policycoreutils/restorecon/main.fmf @@ -1,2 +1,55 @@ -path: /policycoreutils/restorecon +summary: does restorecon work correctly ? +description: | + Does restorecon work correctly? + + + Description: does restorecon work correctly ? + + Author: Milos Malik + + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=736153 + + Description: + touch test + chcon -u staff_u -t shadow_t -l s0:c1 test + restorecon test + ls -lZ test + You should still see the user as staff_u and the level as s0:c1 but the type should be changed. + restorecon -F test + You should see the user become system_u and the level become s0 +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - grep + - e2fsprogs + - libselinux + - selinux-policy-devel + - libselinux-utils +duration: 15m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - f31friendly + - f32friendly + - targeted + - avoidImageMode tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739587 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=767568 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=741555 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=736153 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=741371 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=740669 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0111587 +extra-summary: /CoreOS/policycoreutils/Sanity/restorecon +extra-task: /CoreOS/policycoreutils/Sanity/restorecon +id: 72bbba2d-1a9e-4009-ae20-145046b8f234 diff --git a/policycoreutils/restorecon/runtest.sh b/policycoreutils/restorecon/runtest.sh index 9ab71d7..115b612 100755 --- a/policycoreutils/restorecon/runtest.sh +++ b/policycoreutils/restorecon/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" diff --git a/policycoreutils/restorecond-service-timeouts/main.fmf b/policycoreutils/restorecond-service-timeouts/main.fmf new file mode 100644 index 0000000..64b970e --- /dev/null +++ b/policycoreutils/restorecond-service-timeouts/main.fmf @@ -0,0 +1,32 @@ +summary: the restorecond service fails to start because of timeout +description: the restorecond service fails to start because of timeout +contact: Milos Malik +component: + - policycoreutils +recommend: + - e2fsprogs + - policycoreutils + - policycoreutils-restorecond +duration: 5m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted +tier: 1 +link: + - verifies: https://issues.redhat.com/browse/RHEL-142541 + - verifies: https://issues.redhat.com/browse/RHEL-165247 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the test is not relevant there + - enabled: false + when: distro == rhel-8, centos-stream-8 + because: the bug is not yet fixed there +id: 24e8b000-43ab-4db7-8066-502cfc6ec48a + diff --git a/policycoreutils/restorecond-service-timeouts/runtest.sh b/policycoreutils/restorecond-service-timeouts/runtest.sh new file mode 100755 index 0000000..d0e2058 --- /dev/null +++ b/policycoreutils/restorecond-service-timeouts/runtest.sh @@ -0,0 +1,37 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep policycoreutils | sort" + rlServiceStop restorecond + rlRun "rm -f /run/restorecond.pid" + rlPhaseEnd + + rlPhaseStartTest "RHEL-142541 + RHEL-165247" + rlRun "grep ^Type=simple /usr/lib/systemd/system/restorecond.service" + rlRun "touch /run/restorecond.pid" + rlRun "chattr +i /run/restorecond.pid" + rlRun "systemctl start restorecond.service" + sleep 2 + rlRun -s "systemctl status restorecond.service -l" + rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1 + rm -f $rlRun_LOG + + rlRun "chattr -i /run/restorecond.pid" + rlRun "rm -f /run/restorecond.pid" + rlRun "systemctl restart restorecond.service" + sleep 2 + rlRun -s "systemctl status restorecond.service -l" + rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlAssertNotExists /run/restorecond.pid + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f /run/restorecond.pid" + rlServiceRestore restorecond + rlPhaseEnd +rlJournalEnd + diff --git a/policycoreutils/restorecond_pointer_abuse/Makefile b/policycoreutils/restorecond_pointer_abuse/Makefile index 253e7f3..bb3ac2c 100644 --- a/policycoreutils/restorecond_pointer_abuse/Makefile +++ b/policycoreutils/restorecond_pointer_abuse/Makefile @@ -55,6 +55,7 @@ $(METADATA): Makefile @echo "Requires: /usr/sbin/sestatus" >> $(METADATA) @echo "Requires: /usr/bin/systemctl" >> $(METADATA) @echo "Requires: /usr/bin/journalctl" >> $(METADATA) + @echo "Requires: /usr/sbin/setenforce" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/policycoreutils/restorecond_pointer_abuse/main.fmf b/policycoreutils/restorecond_pointer_abuse/main.fmf index d96f84a..b4f30c1 100644 --- a/policycoreutils/restorecond_pointer_abuse/main.fmf +++ b/policycoreutils/restorecond_pointer_abuse/main.fmf @@ -11,7 +11,17 @@ description: | Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1626468 component: -- policycoreutils -adjust: -- enabled: false + - policycoreutils +recommend: + - git-core + - policycoreutils-restorecond + - coreutils + - systemd + - policycoreutils + - libselinux-utils +adjust+: + - enabled: false when: distro < rhel-7 +id: a900e46c-6cf9-49e1-9625-5beb609760c5 +tag: + - avoidImageMode diff --git a/policycoreutils/restorecond_pointer_abuse/runtest.sh b/policycoreutils/restorecond_pointer_abuse/runtest.sh index 465b1f2..57463a3 100755 --- a/policycoreutils/restorecond_pointer_abuse/runtest.sh +++ b/policycoreutils/restorecond_pointer_abuse/runtest.sh @@ -36,7 +36,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -45,6 +44,7 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE + rlServiceStart restorecond # backup restorecond configuration file rlRun "rlFileBackup /etc/selinux/restorecond.conf" 0 rlRun "echo '/usr/*' > /etc/selinux/restorecond.conf" 0-255 @@ -59,7 +59,7 @@ rlJournalStart for i in {1..15} do # create misslabeled files - for folder in share games tmp + for folder in share games tmp do rlRun "touch /usr/$folder/$i" rlRun "chcon -t unlabeled_t /usr/$folder/$i" @@ -80,6 +80,9 @@ rlJournalStart rlPhaseStartCleanup rlRun "rlFileRestore" 0 + rlServiceStop restorecond + rm -f ${OUTPUT_FILE} rlPhaseEnd rlJournalPrintText rlJournalEnd + diff --git a/policycoreutils/sctp_test/main.fmf b/policycoreutils/sctp_test/main.fmf index dad2354..8b2d0ea 100644 --- a/policycoreutils/sctp_test/main.fmf +++ b/policycoreutils/sctp_test/main.fmf @@ -1,12 +1,19 @@ -path: /policycoreutils/sctp_test -summary: Is SCTP supported by "semanage port"? -description: | - Simulates a use case where a user wants to confine a client-server application communicating over SCTP - Bug summary: semanage port does not support SCTP protocol - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1563742 -component: -- policycoreutils -- libsemanage -adjust: -- enabled: false - when: distro < rhel-8 +summary: Test for BZ#1563742 (RFE add SCTP protocol support to semanage port) +contact: vmojzis +recommend: + - git + - libselinux-utils + - policycoreutils + - lksctp-tools + - psmisc + - /usr/sbin/semanage + - /usr/sbin/semodule +duration: 10m +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1563742 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1770238 +extra-summary: /selinux/policycoreutils/sctp_test +extra-task: /selinux/policycoreutils/sctp_test +extra-nitrate: TC#0614834 +tag: + - avoidImageMode diff --git a/policycoreutils/sctp_test/runtest.sh b/policycoreutils/sctp_test/runtest.sh index ee18ced..39572be 100755 --- a/policycoreutils/sctp_test/runtest.sh +++ b/policycoreutils/sctp_test/runtest.sh @@ -29,7 +29,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/selinux-autorelabel-service/main.fmf b/policycoreutils/selinux-autorelabel-service/main.fmf index 6b8d0eb..0243f14 100644 --- a/policycoreutils/selinux-autorelabel-service/main.fmf +++ b/policycoreutils/selinux-autorelabel-service/main.fmf @@ -1,2 +1,34 @@ -path: /policycoreutils/selinux-autorelabel-service -tier: 2 +summary: incorrectly set StandardInput and StandardOutput of selinux-autorelabel service +description: |+ + Description: incorrectly set StandardInput and StandardOutput of selinux-autorelabel service + + Bugzilla links: + * https://bugzilla.redhat.com/show_bug.cgi?id=1766578 + * https://bugzilla.redhat.com/show_bug.cgi?id=1778094 + +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - TIPpass_Security + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1766578 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1778094 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0605819 +extra-summary: /CoreOS/policycoreutils/Regression/selinux-autorelabel-service +extra-task: /CoreOS/policycoreutils/Regression/selinux-autorelabel-service diff --git a/policycoreutils/selinux-autorelabel-service/runtest.sh b/policycoreutils/selinux-autorelabel-service/runtest.sh index 49fca5b..2244e2c 100755 --- a/policycoreutils/selinux-autorelabel-service/runtest.sh +++ b/policycoreutils/selinux-autorelabel-service/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/selinux-info/main.fmf b/policycoreutils/selinux-info/main.fmf index a3a9057..1c05e99 100644 --- a/policycoreutils/selinux-info/main.fmf +++ b/policycoreutils/selinux-info/main.fmf @@ -1,9 +1,27 @@ -path: /policycoreutils/selinux-info -summary: test sestatus, avcstat, getenforce -description: | - Test that output of sestatus matches information in /sys/fs/selinux. - Test that avcstat works. Test getenforce. Warning: this tests runs - setenforce. -adjust: -- enabled: false - when: distro < rhel-7 +summary: Test sestatus, avcstat, getenforce and other information gathering tools +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils +duration: 1m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +tier: 1 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0571360 +extra-summary: /CoreOS/policycoreutils/Sanity/selinux-info +extra-task: /CoreOS/policycoreutils/Sanity/selinux-info diff --git a/policycoreutils/selinux-info/runtest.sh b/policycoreutils/selinux-info/runtest.sh index 13a92e6..5e71cb2 100755 --- a/policycoreutils/selinux-info/runtest.sh +++ b/policycoreutils/selinux-info/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/semanage-imports-port-defs/Makefile b/policycoreutils/semanage-imports-port-defs/Makefile new file mode 100644 index 0000000..d977007 --- /dev/null +++ b/policycoreutils/semanage-imports-port-defs/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Regression/semanage-imports-port-defs +# Description: Can semanage import SELinux port definitions correctly? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Regression/semanage-imports-port-defs +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Can semanage import SELinux port definitions correctly?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils /usr/sbin/semanage" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 2063353" >> $(METADATA) # RHEL-8 + @echo "Bug: 2108174" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/policycoreutils/semanage-imports-port-defs/main.fmf b/policycoreutils/semanage-imports-port-defs/main.fmf new file mode 100644 index 0000000..9de2dc9 --- /dev/null +++ b/policycoreutils/semanage-imports-port-defs/main.fmf @@ -0,0 +1,23 @@ +summary: Can semanage import SELinux port definitions correctly? +description: |+ + Can semanage import SELinux port definitions correctly? + +test: ./runtest.sh +contact: Milos Malik +framework: beakerlib +component: + - policycoreutils +recommend: + - policycoreutils + - /usr/sbin/semanage +duration: 10m +enabled: true +tier: 1 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2063353 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2108174 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + because: the test is not relevant there +extra-nitrate: TC#0614161 diff --git a/policycoreutils/semanage-imports-port-defs/runtest.sh b/policycoreutils/semanage-imports-port-defs/runtest.sh new file mode 100755 index 0000000..bdd7d52 --- /dev/null +++ b/policycoreutils/semanage-imports-port-defs/runtest.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Regression/semanage-imports-port-defs +# Description: Can semanage import SELinux port definitions correctly? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm policycoreutils + rlRun "rpm -qf /usr/sbin/semanage" + rlRun "semanage port -a -t http_cache_port_t -r s0 -p tcp 3024" + rlPhaseEnd + + rlPhaseStartTest "bz#2063353 + bz#2108174" + rlRun "semanage port -E" + rlRun "echo -e 'port -D\nport -a -t http_cache_port_t -r s0 -p tcp 3024' | semanage import" + rlRun "semanage port -E" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semanage port -d -t http_cache_port_t -r s0 -p tcp 3024" + rlPhaseEnd +rlJournalEnd + diff --git a/policycoreutils/semanage-interface/main.fmf b/policycoreutils/semanage-interface/main.fmf index 4fd3a5e..d961f08 100644 --- a/policycoreutils/semanage-interface/main.fmf +++ b/policycoreutils/semanage-interface/main.fmf @@ -1 +1,33 @@ -path: /policycoreutils/semanage-interface +summary: Does semanage interface ... work correctly? +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils + - grep + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted +duration: 20m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - avoidImageMode +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0092119 +extra-summary: /CoreOS/policycoreutils/Regression/semanage-interface +extra-task: /CoreOS/policycoreutils/Regression/semanage-interface diff --git a/policycoreutils/semanage-interface/runtest.sh b/policycoreutils/semanage-interface/runtest.sh index ba8608b..ed99caf 100755 --- a/policycoreutils/semanage-interface/runtest.sh +++ b/policycoreutils/semanage-interface/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -35,6 +34,7 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} + rlRun "rpm -qa | grep selinux-policy" rlPhaseEnd rlPhaseStartTest @@ -43,6 +43,9 @@ rlJournalStart if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then continue fi + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then + continue + fi rlRun "semanage interface -l -S ${POLICY_TYPE}" done if ! rlIsRHEL 5; then diff --git a/policycoreutils/semanage-login/main.fmf b/policycoreutils/semanage-login/main.fmf index 9a2165f..e883371 100644 --- a/policycoreutils/semanage-login/main.fmf +++ b/policycoreutils/semanage-login/main.fmf @@ -1 +1,34 @@ -path: /policycoreutils/semanage-login +summary: Does semanage login ... work correctly? +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils + - grep + - shadow-utils + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - avoidImageMode +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0092123 +extra-summary: /CoreOS/policycoreutils/Regression/semanage-login +extra-task: /CoreOS/policycoreutils/Regression/semanage-login diff --git a/policycoreutils/semanage-login/runtest.sh b/policycoreutils/semanage-login/runtest.sh index a69d21a..0986fc5 100755 --- a/policycoreutils/semanage-login/runtest.sh +++ b/policycoreutils/semanage-login/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -35,6 +34,7 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} + rlRun "rpm -qa | grep selinux-policy" rlPhaseEnd rlPhaseStartTest @@ -43,6 +43,9 @@ rlJournalStart if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then continue fi + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then + continue + fi rlRun "semanage login -l -S ${POLICY_TYPE}" done if ! rlIsRHEL 5; then diff --git a/policycoreutils/semanage-permissive-d-problems/main.fmf b/policycoreutils/semanage-permissive-d-problems/main.fmf index 50e8c68..cea9905 100644 --- a/policycoreutils/semanage-permissive-d-problems/main.fmf +++ b/policycoreutils/semanage-permissive-d-problems/main.fmf @@ -1 +1,19 @@ -path: /policycoreutils/semanage-permissive-d-problems +summary: semanage permissive -d accepts more than domain types, its behavior is not + reliable +description: |+ + Does semanage permissive work correctly? + +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils + - policycoreutils-devel + - selinux-policy-devel + - grep + - coreutils +duration: 20m +extra-summary: /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems +extra-task: /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems +id: f9d05e51-8ec4-4b3c-a016-bbdf79775d64 diff --git a/policycoreutils/semanage-permissive-d-problems/runtest.sh b/policycoreutils/semanage-permissive-d-problems/runtest.sh index 67a5b3e..1d33e4c 100755 --- a/policycoreutils/semanage-permissive-d-problems/runtest.sh +++ b/policycoreutils/semanage-permissive-d-problems/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" diff --git a/policycoreutils/semanage-port-add-delete-problems/Makefile b/policycoreutils/semanage-port-add-delete-problems/Makefile index 263da02..36cdf85 100644 --- a/policycoreutils/semanage-port-add-delete-problems/Makefile +++ b/policycoreutils/semanage-port-add-delete-problems/Makefile @@ -54,13 +54,14 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: coreutils" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) @echo "Requires: policycoreutils" >> $(METADATA) @echo "Requires: policycoreutils-python-utils" >> $(METADATA) @echo "Requires: setools-console" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: coreutils" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/policycoreutils/semanage-port-add-delete-problems/main.fmf b/policycoreutils/semanage-port-add-delete-problems/main.fmf index f2655dc..f9c20d5 100644 --- a/policycoreutils/semanage-port-add-delete-problems/main.fmf +++ b/policycoreutils/semanage-port-add-delete-problems/main.fmf @@ -1 +1,22 @@ -path: /policycoreutils/semanage-port-add-delete-problems +summary: semanage accepts invalid port numbers and then cannot delete them +description: |+ + semanage accepts invalid port numbers and then cannot delete them + +contact: Milos Malik +component: + - policycoreutils +recommend: + - audit + - coreutils + - grep + - libselinux + - libselinux-utils + - policycoreutils + - policycoreutils-python-utils + - setools-console +duration: 15m +extra-summary: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems +extra-task: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems +id: 3db01ce3-7cf2-4f3a-9b71-412d7cd7ce64 +tag: + - avoidImageMode diff --git a/policycoreutils/semanage-port-add-delete-problems/runtest.sh b/policycoreutils/semanage-port-add-delete-problems/runtest.sh index ef13e5f..835b043 100755 --- a/policycoreutils/semanage-port-add-delete-problems/runtest.sh +++ b/policycoreutils/semanage-port-add-delete-problems/runtest.sh @@ -26,7 +26,6 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -83,7 +82,7 @@ rlJournalStart sleep 2 # Check for MAC_POLICY_LOAD - rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME}" 0 + rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME} --input-logs" 0 # deleting a port number from a type START_DATE_TIME=`date "+%m/%d/%Y %T"` @@ -92,7 +91,7 @@ rlJournalStart sleep 2 # Check for MAC_POLICY_LOAD - rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME}" 0 + rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME} --input-logs" 0 rlPhaseEnd fi @@ -116,8 +115,12 @@ rlJournalStart rlRun "semanage port -a -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" rlAssertGrep "port .* already defined" ${OUTPUT_FILE} -i rlRun "semanage port -l | grep 'smtp_port_t.*tcp.*25'" + rm -f ${OUTPUT_FILE} rlRun "semanage port -d -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i + # the error may not appear because the local customization can be deleted always + if [ -s ${OUTPUT_FILE} ] ; then + rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i + fi rlRun "semanage port -d -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i rlRun "semanage port -l | grep 'smtp_port_t.*tcp.*25'" diff --git a/policycoreutils/semanage-user/main.fmf b/policycoreutils/semanage-user/main.fmf index 0111538..4ef5dbd 100644 --- a/policycoreutils/semanage-user/main.fmf +++ b/policycoreutils/semanage-user/main.fmf @@ -1 +1,36 @@ -path: /policycoreutils/semanage-user +summary: Does semanage user ... work correctly? +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils + - grep + - selinux-policy-devel + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted + - selinux-policy-devel +duration: 20m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - avoidImageMode +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=987444 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0092120 +extra-summary: /CoreOS/policycoreutils/Regression/semanage-user +extra-task: /CoreOS/policycoreutils/Regression/semanage-user diff --git a/policycoreutils/semanage-user/runtest.sh b/policycoreutils/semanage-user/runtest.sh index b2413fb..6326db6 100755 --- a/policycoreutils/semanage-user/runtest.sh +++ b/policycoreutils/semanage-user/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -35,6 +34,7 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} + rlRun "rpm -qa | grep selinux-policy" rlRun "make -f /usr/share/selinux/devel/Makefile" rlRun "ls -l testpolicy.pp" rlPhaseEnd @@ -51,6 +51,9 @@ rlJournalStart if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then continue fi + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then + continue + fi rlRun "semanage user -l -S ${POLICY_TYPE}" done if ! rlIsRHEL 5; then diff --git a/policycoreutils/semodule-l-checksum/Makefile b/policycoreutils/semodule-l-checksum/Makefile new file mode 100644 index 0000000..875a9b8 --- /dev/null +++ b/policycoreutils/semodule-l-checksum/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +# Description: Test semodule -l --checksum +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Petr Lautrbach " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test semodule -l --checksum" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils selinux-policy-devel" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 1731501 2026680" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/policycoreutils/semodule-l-checksum/PURPOSE b/policycoreutils/semodule-l-checksum/PURPOSE new file mode 100644 index 0000000..a11f95a --- /dev/null +++ b/policycoreutils/semodule-l-checksum/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +Description: Test semodule -l --checksum +Author: Petr Lautrbach diff --git a/policycoreutils/semodule-l-checksum/main.fmf b/policycoreutils/semodule-l-checksum/main.fmf new file mode 100644 index 0000000..bb39ac8 --- /dev/null +++ b/policycoreutils/semodule-l-checksum/main.fmf @@ -0,0 +1,13 @@ +summary: Test semodule -l --checksum +description: '' +contact: Petr Lautrbach +component: + - policycoreutils +recommend: + - policycoreutils + - selinux-policy-devel +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1731501 +extra-summary: /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +extra-task: /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +id: 115f6c6a-426a-4f92-9ea3-9dfca5624c6e diff --git a/policycoreutils/semodule-l-checksum/runtest.sh b/policycoreutils/semodule-l-checksum/runtest.sh new file mode 100755 index 0000000..b16ef6d --- /dev/null +++ b/policycoreutils/semodule-l-checksum/runtest.sh @@ -0,0 +1,87 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +# Description: Test semodule -l --checksum +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + # create new type, allow reading, do not allow writing + rlRun "cat << EOF >test_module.te +module test_module 1.0; + +require { + type unconfined_t; + attribute filesystem_type; + class file { getattr ioctl lock open read relabelto write }; + class filesystem { associate }; +} + +type test_t; + +allow test_t filesystem_type:filesystem { associate }; +allow unconfined_t test_t:file { getattr ioctl lock open read relabelto}; +dontaudit unconfined_t test_t:file { write }; +EOF" + # compile the module + rlRun "make -f /usr/share/selinux/devel/Makefile test_module.pp" + # load it + rlRun "semodule -X 500 -i test_module.pp" + rlRun "/usr/libexec/selinux/hll/pp test_module.pp test_module.cil" + + rlPhaseEnd + + rlPhaseStartTest "semodule -lfull --checksum" + rlRun "semodule -lfull --checksum | grep test_module" + module=($(semodule -lfull --checksum | grep test_module) ) + sha256=($(sha256sum test_module.cil)) + rlAssertEquals "Is the module name 'test_module'?" ${module[1]} "test_module" + rlAssertEquals "Is the module priority '500'?" ${module[0]} "500" + rlAssertEquals "Is the loaded module checksum same as the file checksum? " ${module[3]} "sha256:${sha256[0]}" + rlPhaseEnd + + rlPhaseStartTest "is the checksum option listed?" + if [ -e "/usr/share/man/man8/semodule.8.gz" ]; then + rlRun "man semodule | col -b | grep checksum" + rlRun "man semodule | col -b | grep 'SHA256.*checksum'" + fi + rlRun "semodule --help | grep checksum" + rlRun "semodule --help | grep 'checksum.*SHA256'" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semodule -X 500 -r test_module" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/Makefile b/policycoreutils/semodule-rebuild-if-modules-changed/Makefile new file mode 100644 index 0000000..313928c --- /dev/null +++ b/policycoreutils/semodule-rebuild-if-modules-changed/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: policycoreutils checkpolicy setools-console selinux-policy-targeted" + +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf new file mode 100644 index 0000000..b9115c7 --- /dev/null +++ b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf @@ -0,0 +1,31 @@ +summary: Test rebuild-on-change support in semodule +description: | + Verifies that semodule --rebuild-if-modules-changed command-line option + works as it should. +contact: Ondrej Mosnacek +component: + - policycoreutils + - libsemanage +framework: beakerlib +require: + - policycoreutils + - checkpolicy + - setools-console + - selinux-policy-targeted +duration: 15m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < rhel-8 + because: RHEL-7 and below are not expected to support this + - enabled: false + when: distro < fedora-36 + because: This feature may not be available in F35 and below +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049186 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049189 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049191 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049193 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173959 +extra-nitrate: TC#0613060 diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh new file mode 100755 index 0000000..8291323 --- /dev/null +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -0,0 +1,152 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +if grep -q ^store-root /etc/selinux/semanage.conf ; then + STORE_ROOT=`grep ^store-root /etc/selinux/semanage.conf | cut -d = -f 2` +else + STORE_ROOT=/var/lib/selinux +fi +STORE_TYPE=targeted +MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules" +STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern" +STORE_BOOLS="$STORE_ROOT/$STORE_TYPE/active/booleans.local" +STORE_DISABLE_DONTAUDIT="$STORE_ROOT/$STORE_TYPE/active/disable_dontaudit" +TEST_MODULE_DIR="$MODULES_ROOT/400/test_module" +TEST_BOOLEAN="xguest_exec_content" +TEST_BOOLEAN_VALUE="0" +TEST_BOOLEAN_VALUE_TEXT="false" + +CHECKSUM_CMD=sha256sum + +function policy_checksum() { + local policyvers="$1" + + "$CHECKSUM_CMD" "/etc/selinux/$STORE_TYPE/policy/policy.$policyvers" +} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm "libsemanage" + rlAssertRpm "policycoreutils" + rlAssertRpm "selinux-policy" + + policyvers="$(checkpolicy -V | cut -f 1 -d ' ')" + policyvers_kernel="$(cat /sys/fs/selinux/policyvers)" + if [ "$policyvers" -lt "$policyvers_kernel" ]; then + policyvers="$policyvers_kernel" + fi + + rlRun "semodule -N -B" 0 \ + "Make sure policy store is in a consistent state initially" + + refresh_opt="" + for opt in --refresh --rebuild-if-modules-changed; do + if semodule --help | grep -q -- "$opt"; then + refresh_opt="$opt" + rlLog "$opt command-line option detected for semodule" + break + fi + done + rlPhaseEnd + + if [ -n "$refresh_opt" ]; then + rlPhaseStartTest "No change behavior" + # The resulting binary policy will be different (albeit + # equivalent) after a full rebuild vs. when only local + # changes are applied to existing policy.linked file, so + # toggle a boolean twice to get the expected binary form. + rlRun "setsebool -P xguest_exec_content $TEST_BOOLEAN_VALUE" + rlRun "setsebool -P xguest_exec_content $(( ! $TEST_BOOLEAN_VALUE ))" + + checksum_before="$(policy_checksum "$policyvers")" + rlRun "semodule -N $refresh_opt" + checksum_after="$(policy_checksum "$policyvers")" + rlAssertEquals "Binary policy must not change after rebuild" \ + "$checksum_before" "$checksum_after" + + # Make sure policy is restored regardless of any previous failures + rlRun "semodule -N -B" 0 \ + "Force a rebuild to clean things up" + rlPhaseEnd + + rlPhaseStartTest "Module injected" + rlLog "Inject a new module into the store" + rlRun "mkdir -p '$TEST_MODULE_DIR'" + rlRun "echo -n cil >'$TEST_MODULE_DIR/lang_ext'" + rlRun "echo '(type test_module_type_t)' >'$TEST_MODULE_DIR/cil'" + rlRun "semodule -N $refresh_opt" 0 \ + "Do a conditional rebuild" + rlRun "semodule -l | grep test_module" 0 \ + "Verify that the module has been picked up" + rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 0 \ + "Verify that the new type is included in the built policy" + + rlLog "Now remove the module" + rlRun "rm -rf '$TEST_MODULE_DIR'" + rlRun "semodule -N $refresh_opt" + rlRun "semodule -l | grep test_module" 1 \ + "Verify that the module has been removed" + rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 1 \ + "Verify that the new type is NOT included in the built policy" + + # Make sure policy is restored regardless of any previous failures + rlRun "semodule -N -B" 0 \ + "Force a rebuild to clean things up" + rlPhaseEnd + + # --refresh option implies fixed boolean/etc. behavior + if [ "$refresh_opt" = "--refresh" ]; then + rlPhaseStartTest "Boolean setting injected" + rlLog "Inject a boolean setting into the store" + rlRun "echo '$TEST_BOOLEAN=$TEST_BOOLEAN_VALUE' >'$STORE_BOOLS'" + rlRun "semodule -N $refresh_opt" 0 \ + "Do a conditional rebuild" + rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 0 \ + "Verify that the boolean setting has been picked up" + + rlLog "Now remove the setting" + rlRun "rm -f '$STORE_BOOLS'" + rlRun "semodule -N $refresh_opt" + rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 1 \ + "Verify that the boolean setting has been reset back" + + # Make sure policy is restored regardless of any previous failures + rlRun "semodule -N -B" 0 \ + "Force a rebuild to clean things up" + rlPhaseEnd + + # https://bugzilla.redhat.com/show_bug.cgi?id=2173959 + if ! { rlIsRHEL && rlIsRHEL '<9.3'; }; then + rlPhaseStartTest "Disable dontaudit injected" + rlLog "Inject disable_dontaudit flag into the store" + rlRun "touch '$STORE_DISABLE_DONTAUDIT'" + rlRun "semodule -N $refresh_opt" 0 \ + "Do a conditional rebuild" + rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -eq 0" 0 \ + "Verify that the flag has been picked up" + + rlLog "Now remove the flag" + rlRun "rm -f '$STORE_DISABLE_DONTAUDIT'" + rlRun "semodule -N $refresh_opt" + rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -gt 0" 0 \ + "Verify that the dontaudit rules are back" + + # Make sure policy is restored regardless of any previous failures + rlRun "semodule -N -B" 0 \ + "Force a rebuild to clean things up" + rlPhaseEnd + fi + fi + else + rlPhaseStartTest "Test skipped" + rlLog "--rebuild-if-modules-changed/--refresh command-line option not supported; skipping tests..." + rlPhaseEnd + fi +rlJournalPrintText +rlJournalEnd diff --git a/policycoreutils/sepolicy-generate-application/main.fmf b/policycoreutils/sepolicy-generate-application/main.fmf new file mode 100644 index 0000000..3b95b9c --- /dev/null +++ b/policycoreutils/sepolicy-generate-application/main.fmf @@ -0,0 +1,16 @@ +summary: Does `sepolicy generate --application ...` detect writeable locations? +test: ./test.sh +framework: beakerlib +component: + - policycoreutils +require: + - policycoreutils + - policycoreutils-devel + - mariadb-server +recommend: + - abrt +tier: '3' +tag: + - failinfedora +enabled: true +extra-nitrate: TC#0615932 diff --git a/policycoreutils/sepolicy-generate-application/test.sh b/policycoreutils/sepolicy-generate-application/test.sh new file mode 100755 index 0000000..50ac0cc --- /dev/null +++ b/policycoreutils/sepolicy-generate-application/test.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlPhaseEnd + + rlPhaseStartTest "/usr/bin/mysqld_safe" + rlRun "mkdir policy" + rlRun "sepolicy generate -p policy --application /usr/bin/mysqld_safe" + rlRun "cat policy/*fc" + for dir in `rpm -ql --dump mariadb-server | sed -n -E '\%\/var\/(log|run|lib)[[:graph:]]* [[:alnum:]]* [[:alnum:]]* [[:alnum:]]* 04.*%s%^([^ ]*).*%\1%p'`; do + rlRun "grep $dir policy/*.fc" + done + rlRun "rm -rf policy" + rlPhaseEnd + + if [ -x /usr/sbin/abrtd ] ; then + rlPhaseStartTest "/usr/sbin/abrtd" + rlRun "mkdir policy" + rlRun "sepolicy generate -p policy --application /usr/sbin/abrtd" + rlRun "cat policy/*fc" + for dir in `rpm -ql --dump abrt | sed -n -E '\%\/var\/(log|run|lib)[[:graph:]]* [[:alnum:]]* [[:alnum:]]* [[:alnum:]]* 04.*%s%^([^ ]*).*%\1%p'`; do + rlRun "grep $dir policy/*.fc" + done + rlRun "rm -rf policy" + rlPhaseEnd + fi + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd diff --git a/policycoreutils/sepolicy-generate/main.fmf b/policycoreutils/sepolicy-generate/main.fmf index 29abfee..fc31e47 100644 --- a/policycoreutils/sepolicy-generate/main.fmf +++ b/policycoreutils/sepolicy-generate/main.fmf @@ -1 +1,38 @@ -path: /policycoreutils/sepolicy-generate +summary: sepolicy generate sanity test +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-devel + - rpm-build +duration: 115m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_FIPS + - TIPpass_Security + - TipWaived7 + - f31friendly + - f32friendly + - targeted + - avoidImageMode +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271324 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924686 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1512590 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924696 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=962752 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924107 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924121 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0248603 +extra-summary: /CoreOS/policycoreutils/Sanity/sepolicy-generate +extra-task: /CoreOS/policycoreutils/Sanity/sepolicy-generate diff --git a/policycoreutils/sepolicy-generate/runtest.sh b/policycoreutils/sepolicy-generate/runtest.sh index e318ecc..f79213f 100755 --- a/policycoreutils/sepolicy-generate/runtest.sh +++ b/policycoreutils/sepolicy-generate/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -107,16 +106,10 @@ rlJournalStart rlRun "rm -rf mypolicy" rlPhaseEnd - rlPhaseStartTest "sepolicy manpage --web, bz1854639" - rlRun "sepolicy manpage --web -d zebra_t" - rlRun "ls /tmp/*release*" 0 "Html file with OS name exists." - rlRun "cat /tmp/*release* > /tmp/testfile" - rlAssertGrep "href=zebra.html" "/tmp/testfile" - rlPhaseEnd - rlPhaseStartCleanup rlRun "popd" rlRun "rm -r $TmpDir" 0 "Removing tmp directory" rlPhaseEnd rlJournalPrintText rlJournalEnd + diff --git a/policycoreutils/sepolicy-manpage/main.fmf b/policycoreutils/sepolicy-manpage/main.fmf new file mode 100644 index 0000000..ab89152 --- /dev/null +++ b/policycoreutils/sepolicy-manpage/main.fmf @@ -0,0 +1,22 @@ +summary: sepolicy manpage sanity test +description: Does the sepolicy manpage command work correctly? +contact: Milos Malik +component: + - policycoreutils +framework: beakerlib +recommend: + - /usr/bin/sepolicy + - setools-console +duration: 1h +enabled: true +tier: 3 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1416372 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1854639 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1989840 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + because: the sepolicy command is not available there +extra-nitrate: TC#0614751 + diff --git a/policycoreutils/sepolicy-manpage/runtest.sh b/policycoreutils/sepolicy-manpage/runtest.sh new file mode 100755 index 0000000..5c0f22b --- /dev/null +++ b/policycoreutils/sepolicy-manpage/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep policycoreutils" + rlPhaseEnd + + rlPhaseStartTest "bz#1416372" + rlRun -s "sepolicy manpage -a" + rlRun "grep -i -e invalid -e error -e traceback ${rlRun_LOG}" 1 + rm -f ${rlRun_LOG} + rlRun -s "sepolicy manpage -d crond_t" + rlRun "grep -i -e invalid -e error -e traceback ${rlRun_LOG}" 1 + rm -f ${rlRun_LOG} + rlPhaseEnd + + rlPhaseStartTest "sepolicy manpage --web, bz#1854639 + bz#1989840" + if seinfo -a domain -x | grep -q zebra ; then + DOMAIN_PREFIX="zebra" + else + DOMAIN_PREFIX="xserver" + fi + rlRun "sepolicy manpage --web -d ${DOMAIN_PREFIX}_t" + if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then + rlRun "ls -l /tmp/*release*" 0 "Html file with OS name exists." + rlRun "cat /tmp/*release* > /tmp/testfile" + else + rlRun "ls -l /tmp/index.html" 0 "HTML file exists" + rlRun "cat /tmp/index.html > /tmp/testfile" + fi + rlAssertGrep "href=${DOMAIN_PREFIX}.html" "/tmp/testfile" + rlRun "ls -l /tmp/${DOMAIN_PREFIX}.html" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f /tmp/${DOMAIN_PREFIX}* /tmp/index.html /tmp/*release*" + rlPhaseEnd +rlJournalEnd + diff --git a/policycoreutils/sestatus/main.fmf b/policycoreutils/sestatus/main.fmf index 0ca1ec2..436e656 100644 --- a/policycoreutils/sestatus/main.fmf +++ b/policycoreutils/sestatus/main.fmf @@ -1 +1,30 @@ -path: /policycoreutils/sestatus +summary: tests everything about sestatus +description: |4 + +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - grep + - man +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - f31friendly + - f32friendly + - targeted +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705027 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705031 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1723859 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0103609 +extra-summary: /CoreOS/policycoreutils/Sanity/sestatus +extra-task: /CoreOS/policycoreutils/Sanity/sestatus diff --git a/policycoreutils/sestatus/runtest.sh b/policycoreutils/sestatus/runtest.sh old mode 100644 new mode 100755 index 14ad828..1ddd4d5 --- a/policycoreutils/sestatus/runtest.sh +++ b/policycoreutils/sestatus/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" @@ -95,14 +94,18 @@ rlJournalStart # This bug is not worth fixing in RHEL-5 if ! rlIsRHEL 5 ; then rlPhaseStartTest - rlRun "rpm -ql ${PACKAGE} | grep /usr/sbin/sestatus" + rlRun "rpm -ql ${PACKAGE} | grep -E '/usr/s?bin/sestatus'" rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/man8/sestatus.8" for OPTION in b v ; do rlRun "sestatus --help 2>&1 | grep -- -${OPTION}" - rlRun "man sestatus | col -b | grep -- -${OPTION}" + if [ -e "/usr/share/man/man8/sestatus.8.gz" ]; then + rlRun "man sestatus | col -b | grep -- -${OPTION}" + fi done if ! rlIsRHEL 6 ; then - rlRun "man -w sestatus.conf" + if [ -e "/usr/share/man/man5/sestatus.conf.5.gz" ]; then + rlRun "man -w sestatus.conf" + fi fi rlPhaseEnd fi diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile new file mode 100644 index 0000000..6e1a5af --- /dev/null +++ b/policycoreutils/setfiles/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Sanity/setfiles +# Description: Basic sanity tests for setfiles +# Author: Michal Trunecka +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Sanity/setfiles +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Michal Trunecka " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Basic sanity tests for setfiles" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 1098062" >> $(METADATA) # RHEL-6 + @echo "Bug: 1086572" >> $(METADATA) # RHEL-6 + @echo "Bug: 1086456" >> $(METADATA) # RHEL-6 + @echo "Bug: 1271326" >> $(METADATA) # RHEL-7 + @echo "Bug: 1271327" >> $(METADATA) # RHEL-7 + @echo "Bug: 1584116" >> $(METADATA) # RHEL-7 + @echo "Bug: 1794518" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) diff --git a/policycoreutils/setfiles/PURPOSE b/policycoreutils/setfiles/PURPOSE new file mode 100644 index 0000000..eb93ba3 --- /dev/null +++ b/policycoreutils/setfiles/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/policycoreutils/Sanity/setfiles +Description: Basic sanity tests for setfiles +Author: Michal Trunecka diff --git a/policycoreutils/setfiles/main.fmf b/policycoreutils/setfiles/main.fmf new file mode 100644 index 0000000..d4e2cce --- /dev/null +++ b/policycoreutils/setfiles/main.fmf @@ -0,0 +1,29 @@ +summary: Basic sanity tests for setfiles +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils +require: + - e2fsprogs +duration: 30m +enabled: true +tag: + - CI-Tier-1 + - TIPfail_Security + - f31friendly + - f32friendly + - targeted +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1098062 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1086572 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1086456 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271326 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271327 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1584116 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1794518 +extra-nitrate: TC#0392756 +extra-summary: /CoreOS/policycoreutils/Sanity/setfiles +extra-task: /CoreOS/policycoreutils/Sanity/setfiles diff --git a/policycoreutils/setfiles/runtest.sh b/policycoreutils/setfiles/runtest.sh new file mode 100755 index 0000000..a760694 --- /dev/null +++ b/policycoreutils/setfiles/runtest.sh @@ -0,0 +1,109 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Sanity/setfiles +# Description: Basic sanity tests for setfiles +# Author: Michal Trunecka +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + OUTPUT=`mktemp` + rlPhaseEnd + + rlPhaseStartTest "bz1086456 + bz1086572 + bz1098062 + bz1584116" + rlLog "Check for bz#1086456" + rlRun "touch /tmp/file" + rlRun "cat > spec_file < ${USERTMP}/spec_file < +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Sanity/setfiles_binary +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Vit Mojzis " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: setfiles should allow checking given path against binary policy" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils rpm cpio" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1973754" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) diff --git a/policycoreutils/setfiles_binary/PURPOSE b/policycoreutils/setfiles_binary/PURPOSE new file mode 100644 index 0000000..57f484f --- /dev/null +++ b/policycoreutils/setfiles_binary/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/policycoreutils/Sanity/setfiles_binary +Description: setfiles should allow checking given path against binary policy +Author: Vit Mojzis diff --git a/policycoreutils/setfiles_binary/main.fmf b/policycoreutils/setfiles_binary/main.fmf new file mode 100644 index 0000000..e00f7b1 --- /dev/null +++ b/policycoreutils/setfiles_binary/main.fmf @@ -0,0 +1,25 @@ +summary: setfiles should allow checking given path against binary policy +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - rpm + - cpio +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1973754 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0611169 +extra-summary: /CoreOS/policycoreutils/Sanity/setfiles_binary +extra-task: /CoreOS/policycoreutils/Sanity/setfiles_binary diff --git a/policycoreutils/setfiles_binary/runtest.sh b/policycoreutils/setfiles_binary/runtest.sh new file mode 100755 index 0000000..7221573 --- /dev/null +++ b/policycoreutils/setfiles_binary/runtest.sh @@ -0,0 +1,76 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Sanity/setfiles_binary +# Description: setfiles should allow checking given path against binary policy +# Author: Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + OUTPUT=`mktemp` + rlRun "mkdir policy" + rlRun "pushd policy" + # download and extract selinux-policy-targeted + rlRun "dnf download selinux-policy-targeted" + rlRun "rpm2cpio *.rpm | cpio -idm" + rlRun "popd" + # create a mockup of root directory structure + DIRS="bin boot dev etc home lib lib64 media mnt opt proc root run sbin snap srv sys tmp usr var" + rlRun " +mkdir testroot +for DIR in ${DIRS}; do + mkdir -p testroot/\${DIR} +done +" + rlRun "ls -lZ testroot" + rlPhaseEnd + + rlPhaseStartTest "setfiles should allow checking given path against binary policy - bz#1973754" + DIR=$(pwd) + # run setfiles using system policy + rlRun "setfiles -r '$DIR/testroot' -nvF /etc/selinux/targeted/contexts/files/file_contexts '$DIR/testroot' &> setfilesout" + POLICY=$(find "$DIR/policy/etc/selinux/targeted/policy/" -name "policy.*") + # run the same command using the extracted policy + rlRun "setfiles -r '$DIR/testroot' -nvF -c '$POLICY' '$DIR/policy/etc/selinux/targeted/contexts/files/file_contexts' '$DIR/testroot' &> setfilesout2" + rlRun "diff setfilesout setfilesout2" 0 + if [ ! $? -eq 0 ] ; then + rlRun "cat setfilesout" + rlRun "cat setfilesout2" + fi + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/policycoreutils/setsebool/main.fmf b/policycoreutils/setsebool/main.fmf index 7da7113..e12bcec 100644 --- a/policycoreutils/setsebool/main.fmf +++ b/policycoreutils/setsebool/main.fmf @@ -1 +1,43 @@ -path: /policycoreutils/setsebool +summary: does setsebool work correctly ? +description: |+ + Does setsebool work as expected? Does it produce correct audit messages? + +contact: Milos Malik +component: + - policycoreutils +recommend: + - audit + - policycoreutils + - libselinux-utils + - shadow-utils + - grep +duration: 45m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - TipWaived7 + - f31friendly + - f33friendly + - failinrhel8ci + - targeted + - avoidImageMode +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1002529 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=856550 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1029965 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953917 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=825176 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=666365 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=998974 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0078073 +extra-summary: /CoreOS/policycoreutils/Sanity/setsebool +extra-task: /CoreOS/policycoreutils/Sanity/setsebool diff --git a/policycoreutils/setsebool/runtest.sh b/policycoreutils/setsebool/runtest.sh index 202d641..04878f9 100755 --- a/policycoreutils/setsebool/runtest.sh +++ b/policycoreutils/setsebool/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" @@ -115,9 +114,14 @@ rlJournalStart for LINE in `cat /etc/selinux/*/booleans.subs_dist | sort | uniq | tr -s ' ' | tr ' ' ':'` ; do OLD_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 1` NEW_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 2` - rlRun "getsebool ${OLD_BOOLEAN_NAME} 2>&1 | tee ${OUTPUT_FILE}" - rlRun "getsebool ${NEW_BOOLEAN_NAME} 2>&1 | tee -a ${OUTPUT_FILE}" - rlRun "uniq -c ${OUTPUT_FILE} | grep '2 '" + # do not test this if the new boolean does not exist in the policy + if getsebool ${NEW_BOOLEAN_NAME} &> /dev/null; then + rlRun "getsebool ${OLD_BOOLEAN_NAME} 2>&1 | tee ${OUTPUT_FILE}" + rlRun "getsebool ${NEW_BOOLEAN_NAME} 2>&1 | tee -a ${OUTPUT_FILE}" + rlRun "uniq -c ${OUTPUT_FILE} | grep '2 '" + else + rlLog "$NEW_BOOLEAN_NAME does not exist, skip" + fi done rlPhaseEnd fi @@ -129,10 +133,10 @@ rlJournalStart rlRun "setsebool ${BOOLEAN} off" rlRun "setsebool ${BOOLEAN} on" sleep 1 - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=1 old_val=0\"" - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=0 old_val=1\"" + rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} --input-logs | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=1 old_val=0\"" + rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} --input-logs | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=0 old_val=1\"" if rlIsRHEL ; then - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=SYSCALL.*comm=setsebool\"" + rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} --input-logs | grep \"type=SYSCALL.*comm=setsebool\"" fi rlPhaseEnd diff --git a/policycoreutils/seunshare-drop-system-calls/main.fmf b/policycoreutils/seunshare-drop-system-calls/main.fmf new file mode 100644 index 0000000..2dbcac1 --- /dev/null +++ b/policycoreutils/seunshare-drop-system-calls/main.fmf @@ -0,0 +1,25 @@ +summary: Test that seunshare/sandbox doesn't execute shell commands when given + filenames with special characters. +contact: Veronika Syncakova +component: + - policycoreutils +require: + - policycoreutils + - policycoreutils-sandbox +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-144055 + - verifies: https://redhat.atlassian.net/browse/RHEL-144041 +adjust+: + - enabled: false + when: distro < rhel-8 + continue: false +id: cd507040-e105-4873-972b-7fe10bb597fa + diff --git a/policycoreutils/seunshare-drop-system-calls/runtest.sh b/policycoreutils/seunshare-drop-system-calls/runtest.sh new file mode 100755 index 0000000..79cfb87 --- /dev/null +++ b/policycoreutils/seunshare-drop-system-calls/runtest.sh @@ -0,0 +1,34 @@ +#!/bin/bash + +# Include beakerlib environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="policycoreutils-sandbox" +TEST_DIR="/tmp/mytest" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlRun "mkdir -p ${TEST_DIR}" + rlPhaseEnd + + rlPhaseStartTest "RHEL-144055 + RHEL-144041" + # Create a file with malicious name + rlRun -s "seunshare -Z unconfined_u:unconfined_r:sandbox_x_t:s0 \ + -t ${TEST_DIR} \ + -- /bin/bash -c \"touch \\\"/tmp/' ; id -Z ; '\\\"\"" + rlRun "ls ${TEST_DIR} | grep '; id -Z ;' " + # Trigger rsync which processes filenames + rlRun -s "seunshare -Z unconfined_u:unconfined_r:sandbox_x_t:s0 \ + -t ${TEST_DIR} \ + -- /bin/bash -c \"touch \\\"/tmp/' ; id -Z ; '\\\"\" " + rlAssertNotGrep "command not found" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf ${TEST_DIR}" + rlRun "rm -f $rlRun_LOG" + rlPhaseEnd + + rlJournalPrintText +rlJournalEnd diff --git a/policycoreutils/spaces-in-fcontext-patterns/Makefile b/policycoreutils/spaces-in-fcontext-patterns/Makefile new file mode 100644 index 0000000..b39090e --- /dev/null +++ b/policycoreutils/spaces-in-fcontext-patterns/Makefile @@ -0,0 +1,66 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns +# Description: Does semanage accept spaces in fcontext patterns? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does semanage accept spaces in fcontext patterns?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/semanage" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1893545" >> $(METADATA) # Fedora 32 + + rhts-lint $(METADATA) + diff --git a/policycoreutils/spaces-in-fcontext-patterns/PURPOSE b/policycoreutils/spaces-in-fcontext-patterns/PURPOSE new file mode 100644 index 0000000..db31d4a --- /dev/null +++ b/policycoreutils/spaces-in-fcontext-patterns/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns +Author: Milos Malik + +Description: Does semanage accept spaces in fcontext patterns? + diff --git a/policycoreutils/spaces-in-fcontext-patterns/main.fmf b/policycoreutils/spaces-in-fcontext-patterns/main.fmf new file mode 100644 index 0000000..62bb7a3 --- /dev/null +++ b/policycoreutils/spaces-in-fcontext-patterns/main.fmf @@ -0,0 +1,36 @@ +summary: Does semanage accept spaces in fcontext patterns? +description: |+ + Does semanage accept spaces in fcontext patterns? + +contact: Milos Malik +component: + - policycoreutils +test: ./runtest.sh +framework: beakerlib +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/semanage +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1893545 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0614100 diff --git a/policycoreutils/spaces-in-fcontext-patterns/runtest.sh b/policycoreutils/spaces-in-fcontext-patterns/runtest.sh new file mode 100755 index 0000000..ea57c89 --- /dev/null +++ b/policycoreutils/spaces-in-fcontext-patterns/runtest.sh @@ -0,0 +1,56 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns +# Description: Does semanage accept spaces in fcontext patterns? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlRun "rpm -qf `which semanage`" + rlPhaseEnd + + rlPhaseStartTest "bz#1893545" + rlRun "semanage fcontext -l -C" + rlRun "semanage fcontext -a -t public_content_t '/mnt/media/My\ Dir(/.*)?'" 1 + rlRun "semanage fcontext -a -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 + rlRun "semanage fcontext -a -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 + rlRun "semanage fcontext -l -C" + rlRun "semanage fcontext -d -t public_content_t '/mnt/media/My\ Dir(/.*)?'" 1 + rlRun "semanage fcontext -d -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 + rlRun "semanage fcontext -d -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 + rlRun "semanage fcontext -l -C" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/Library/common/Makefile b/selinux-policy/Library/common/Makefile index 8c2004f..eecb818 100644 --- a/selinux-policy/Library/common/Makefile +++ b/selinux-policy/Library/common/Makefile @@ -1,7 +1,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Makefile of /CoreOS/selinux-policy/Library/common -# Description: Wrapper library for /CoreOS/selinux-policy/common +# Description: Common library for SELinux related components # Author: David Spurek # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -43,19 +43,19 @@ $(METADATA): Makefile @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Common library for SELinux" >> $(METADATA) + @echo "Description: Common library for SELinux related components" >> $(METADATA) @echo "Type: Library" >> $(METADATA) @echo "TestTime: 120m" >> $(METADATA) - @echo "Requires: setools" >> $(METADATA) @echo "Requires: setools-console" >> $(METADATA) @echo "Requires: expect" >> $(METADATA) @echo "Requires: policycoreutils" >> $(METADATA) @echo "Requires: /usr/sbin/semanage" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) @echo "Requires: selinux-policy-devel" >> $(METADATA) @echo "Requires: yum-utils" >> $(METADATA) @echo "Requires: python3 sqlite" >> $(METADATA) @echo "Provides: library(selinux-policy/common)" >> $(METADATA) - @echo "RhtsRequires: library(distribution/epel)" >> $(METADATA) + @echo "RhtsRequires: library(epel/epel)" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh old mode 100644 new mode 100755 index 8d6785f..61c8ca9 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -3,7 +3,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # lib.sh of /CoreOS/selinux-policy/Library/common -# Description: Common library for selinux-policy component +# Description: Common library for SELinux related components # Authors: Milos Malik # Michal Trunecka # David Spurek @@ -29,7 +29,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # library-prefix = rlSE -# library-version = 40 +# library-version = 44 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ : <<'=cut' @@ -49,7 +49,6 @@ selinux-policy/common - BeakerLib extension for managing SELinux =pod =head1 VARIABLES - =over =item rlSE_CACHE_DIR @@ -66,9 +65,6 @@ rlSE_CACHE_DIR="${rlSE_CACHE_DIR:-$__INTERNAL_PERSISTENT_TMP/BEAKERLIB-rlSE}" __INTERNAL_rlSE_CACHEFILE="$rlSE_CACHE_DIR/cache.db" __INTERNAL_rlSE_SUMFILE="$rlSE_CACHE_DIR/cache.policy-checksum" -SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` - - # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Functions # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -322,6 +318,7 @@ function rlSEMatchPathCon() { local FILE_PATH local LINK_PATH local REAL_TYPE=`rlSETranslateAlias $2` + rlLogDebug "$FUNCNAME(): REAL_TYPE=$REAL_TYPE" FILE_PATH=$1 if ! rlIsRHEL '<6'; then @@ -333,16 +330,22 @@ function rlSEMatchPathCon() { done fi + rlLogDebug "$FUNCNAME(): FILE_PATH=$FILE_PATH" + local ec=0 while [[ -n "$FILE_PATH" ]]; do if [ -L ${FILE_PATH} ] ; then + rlLogDebug "$FUNCNAME(): evaluating symlink" LINK_PATH=`readlink -f ${FILE_PATH}` - matchpathcon ${FILE_PATH} ${LINK_PATH} - matchpathcon ${FILE_PATH} ${LINK_PATH} | grep :${REAL_TYPE} > /dev/null + local out="$(matchpathcon ${FILE_PATH} ${LINK_PATH})" + echo "$out" + echo "$out" | grep -q ":${REAL_TYPE}:" rlAssert0 "Results of matchpathcon ${FILE_PATH} ${LINK_PATH} should contain ${REAL_TYPE}" $? || ec=1 else - matchpathcon ${FILE_PATH} - matchpathcon ${FILE_PATH} | grep :${REAL_TYPE} > /dev/null + rlLogDebug "$FUNCNAME(): evaluating file" + local out="$(matchpathcon ${FILE_PATH})" + echo "$out" + echo "$out" | grep -q ":${REAL_TYPE}:" rlAssert0 "Result of matchpathcon ${FILE_PATH} should contain ${REAL_TYPE}" $? || ec=1 fi FILE_PATH=( "${FILE_PATH[@]:1}" ) @@ -869,7 +872,7 @@ Pair functions to check AVC messages from the given moment. The starting timesta function rlSESetTimestamp() { - local STAMP=`date "+%m/%d/%Y %T"` + local STAMP=`LC_ALL=en_US.UTF-8 date "+%x %T"` local NAME="TIMESTAMP" [ -z "$1" ] || NAME="${NAME}_$1" @@ -927,7 +930,7 @@ function rlSEAVCCheck() { return 1 else rlLog "$FUNCNAME: Search for AVCs, USER_AVCs, SELINUX_ERRs, and USER_SELINUX_ERRs since timestamp '$NAME' [$STAMP]" - local ausearch_output=$(LC_TIME='en_US.UTF-8' ausearch -i -m AVC -m USER_AVC -m SELINUX_ERR -m USER_SELINUX_ERR -ts $STAMP 2>&1) + local ausearch_output=$(LC_ALL='en_US.UTF-8' ausearch --input-logs -i -m AVC -m USER_AVC -m SELINUX_ERR -m USER_SELINUX_ERR -ts $STAMP 2>&1) echo "$ausearch_output" >&2 local res=0 # filter out ignored patterns @@ -1282,6 +1285,16 @@ function rlSERunWithContext() { } +function rlSEConfigureSSH () { + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + if [ -d /etc/ssh/sshd_config.d ] ; then + rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" + fi + rlRun "service sshd restart" +} + true <<'=cut' =pod @@ -1371,6 +1384,7 @@ function rlSETranslateBoolean() { staff_exec_content allow_staff_exec_content sysadm_exec_content allow_sysadm_exec_content user_exec_content allow_user_exec_content + virt_use_nfs virt_sandbox_use_nfs xguest_exec_content allow_xguest_exec_content xserver_clients_write_xshm allow_write_xshm xserver_execmem allow_xserver_execmem @@ -1402,41 +1416,59 @@ Limitation: seinfo does not report aliases on RHEL-5 and RHEL-6 now. =cut function rlSETranslateAlias { + local res if rlIsRHEL 5 ; then + rlLogDebug "$FUNCNAME(): RHEL5 - no translation, using $1" echo $1 return 0 elif rlIsRHEL 6 ; then + rlLogDebug "$FUNCNAME(): RHEL6" if seinfo -t$1 2>&1 | grep -q "ERROR:" ; then + rlLogDebug "$FUNCNAME(): got an error - no translation, using $1" echo $1 return 1 elif seinfo -t$1 2>&1 | grep -q " $1" ; then + rlLogDebug "$FUNCNAME(): seinfo confirmed the name - no translation, using $1" echo $1 return 0 - else # the type should be used either as a source or as a target in an allow rule - ( sesearch -s $1 -A | tr -s ' ' | cut -d ' ' -f 3 ; sesearch -t $1 -A | tr -s ' ' | cut -d ' ' -f 4 ) | sort | uniq | grep "^.*_t$" + else + rlLogDebug "$FUNCNAME(): the type should be used either as a source or as a target in an allow rule" + res="$(( sesearch -s $1 -A | tr -s ' ' | cut -d ' ' -f 3 ; sesearch -t $1 -A | tr -s ' ' | cut -d ' ' -f 4 ) | sort | uniq | grep "^.*_t$")" + rlLogDebug "$FUNCNAME(): translated name: $res" + echo "$res" return 0 fi else + rlLogDebug "$FUNCNAME(): RHEL>6 && Fedora" + rlLogDebug "$FUNCNAME(): setools version ${SETOOLS_MAJOR_VERSION}" local seinfo_out seinfo_out="$(seinfo -t$1 2>&1 )" + rlLogDebug "$FUNCNAME(): seinfo_out='$seinfo_out'" if echo "$seinfo_out" | grep -q "ERROR:" ; then - # the type was not recognized + rlLogDebug "$FUNCNAME(): the type was not recognized - no translation, using $1" echo $1 return 1 elif echo "$seinfo_out" | grep -q "TypeName " ; then - seinfo -t$1 2>/dev/null | grep TypeName | tr -s ' ' | cut -d ' ' -f 3 + rlLogDebug "$FUNCNAME(): translation done using TypeName" + res="$(seinfo -t$1 2>/dev/null | grep TypeName | tr -s ' ' | cut -d ' ' -f 3)" + rlLogDebug "$FUNCNAME(): translated name: $res" + echo "$res" return 0 elif echo "$seinfo_out" | grep -q "Types: 0" ; then - # cannot translate alias, if setools v.4 are used then BZ#1581761 + rlLogDebug "$FUNCNAME(): # cannot translate alias, if setools v.4 are used then BZ#1581761 - no translation, using $1" echo $1 return 1 elif [[ ${SETOOLS_MAJOR_VERSION} == "4" ]] ; then - # setools v.4 - seinfo -t$1 2>/dev/null | tail -n 1 | tr -s ' ' | cut -d ' ' -f 2 + rlLogDebug "$FUNCNAME(): translation done using seinfo v.4 parsing" + res="$(seinfo -t$1 2>/dev/null | tail -n 1 | tr -s ' ' | cut -d ' ' -f 2)" + rlLogDebug "$FUNCNAME(): translated name: $res" + echo "$res" return 0 else - # setools v.3 - seinfo -t$1 2>/dev/null | head -n 1 | tr -s ' ' | cut -d ' ' -f 2 + rlLogDebug "$FUNCNAME(): translation done using seinfo v.3 parsing" + res="$(seinfo -t$1 2>/dev/null | head -n 1 | tr -s ' ' | cut -d ' ' -f 2)" + rlLogDebug "$FUNCNAME(): translated name: $res" + echo "$res" return 0 fi fi @@ -1463,7 +1495,7 @@ function rlSEListServices() { SERVICES_ARRAY[21]='vsftpd proftpd pure-ftpd lighttpd' # FTP servers SERVICES_ARRAY[25]='exim postfix sendmail' # SMTP servers - SERVICES_ARRAY[53]='named named-sdb unbound yadifad nsd pdns' # DNS servers + SERVICES_ARRAY[53]='named named-sdb unbound yadifad nsd pdns systemd-resolved dnsmasq' # DNS servers SERVICES_ARRAY[80]='httpd cherokee lighttpd nginx thttpd' # HTTP servers SERVICES_ARRAY[123]='ntpd chronyd' # NTP servers @@ -1496,7 +1528,46 @@ function rlSESetEnforce() { } +true <<'=cut' +=pod +=head2 rlSESatisfyRequires + +The function attempts to install all packages required in Makefile and all packa +ges given as arguments. +The function will be used to install packages from any repository we want. + +=cut + +function rlSESatisfyRequires() { + local FILE_NAME="./Makefile" + local PACKAGE_LIST + local PACKAGE_LIST2 + + if [ "x$COLLECTIONS" != "x" ] ; then + # do not install any packages when running in RHSCL environment + # because that would most likely break the environment or fail + return + fi + + which yum >& /dev/null + if [ $? -ne 0 ] ; then + rlLog "The yum is not present. Don't know how to install required packages." + return + fi + + if [ $# -gt 0 ] ; then + PACKAGE_LIST2="$*" + fi + PACKAGE_LIST=`grep '"Requires:' ${FILE_NAME} | cut -d : -f 2 | cut -d '"' -f 1 | tr '\n' ' ' | tr -s ' '` + # check if all required packages are really installed + if rpm -q ${PACKAGE_LIST} ${PACKAGE_LIST2} >& /dev/null ; then + rlPass "all required packages are really installed" + return 0 + fi + + rlRun "epelyum install -y --nobest --nogpgcheck --skip-broken ${PACKAGE_LIST} ${PACKAGE_LIST2}" 0,1 +} __INTERNAL_rlSEModuleList() { local semodule_list @@ -1742,7 +1813,7 @@ __INTERNAL_rlSEenable_full_auditing() { fi local final_rules=/etc/audit/audit.rules local config_file=/etc/audit/auditd.conf - local auditd_need_restart=0 + local auditd_need_restart=1 local rules="-D"$'\n'"-w /etc/shadow -p w" local res=0 if ! diff -u <(grep -v -e '^$' -e '^#' $final_rules) <(echo "$rules") > /dev/null; then @@ -1768,7 +1839,7 @@ __INTERNAL_rlSEenable_full_auditing() { } [[ $auditd_need_restart -eq 1 ]] && { rlLog "stop the audit daemon first" - rlRun "service auditd stop" + rlRun "service auditd stop" 0,2 sleep 5 rlLog "audit daemon configuration file is updated, starting the audit service" rlServiceStart auditd || { @@ -1901,10 +1972,97 @@ __INTERNAL_rlSEcache_sesearch() { esac } -rlSELibraryLoaded() { - return 0 -} +rlSELibraryLoaded() { + __INTERNAL_SEMODULE_LISTING="semodule -lfull" + local tmp + eval tmp="\$($__INTERNAL_SEMODULE_LISTING 2>&1 )" + if [[ "$tmp" =~ invalid\ option ]]; then + __INTERNAL_SEMODULE_LISTING='semodule -l' + fi + rlLogInfo "SELinux: using '$__INTERNAL_SEMODULE_LISTING' to list modules" + __INTERNAL_POLICY_NAME="$(sestatus | grep -i 'Loaded policy name' | sed -r 's/.*:\s*([^:]+)\s*/\1/')" + __INTERNAL_POLICY_NAME="${__INTERNAL_POLICY_NAME:-$(sestatus | grep -i 'Policy from config file' | sed -r 's/.*:\s*([^:]+)\s*/\1/')}" + __INTERNAL_POLICY_NAME="${__INTERNAL_POLICY_NAME:-targeted}" + __INTERNAL_POLICY_ROOT="$(sestatus | grep -i 'SELinux root directory' | sed -r 's/.*:\s*([^:]+)\s*/\1/')" + __INTERNAL_POLICY_ROOT="${__INTERNAL_POLICY_ROOT:-/etc/selinux}" + __INTERNAL_POLICY_PATH="$__INTERNAL_POLICY_ROOT/$__INTERNAL_POLICY_NAME" + __INTERNAL_POLICY_FILE="$__INTERNAL_POLICY_PATH/policy/policy.$(ls -1 -d $__INTERNAL_POLICY_PATH/policy/policy.* | sed -r 's/[^.]*\.//' | sort -nr | head -n 1)" + __INTERNAL_POLICY_STORE_ROOT="/var/lib/selinux" + rlIsRHEL '<8' && __INTERNAL_POLICY_STORE_ROOT="/etc/selinux" + export rlSEpolicyRoot="$__INTERNAL_POLICY_ROOT" + export rlSEstoreRoot="$__INTERNAL_POLICY_STORE_ROOT" + export rlSEpolicyName="$__INTERNAL_POLICY_NAME" + rlLogInfo "Running with policy located in $__INTERNAL_POLICY_FILE" + if rlIsRHEL 4 5; then + rlSE_REQUIRES="setools expect policycoreutils" + elif rlIsRHEL 6 ; then + rlSE_REQUIRES="setools-console expect policycoreutils-python" + elif rlIsRHEL 7 ; then + rlSE_REQUIRES="setools-console expect policycoreutils-python selinux-policy-devel" + elif rlIsRHEL 8 9 || rlIsCentOS 8 9 ; then + rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel" + else + rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel audit-rules" + fi + + # make sure that these directories exist in home directories of + # tested users since the time they were created + rlRun "mkdir -p /etc/skel/.{cache,config,local}" + + # make sure the /etc directory is labeled correctly + rlRun "restorecon -Rv /etc" + + __INTERNAL_rlSEenable_full_auditing + + local t=$(date +%s) + rlLogInfo "SELinux related packages listing:" + rlLogInfo "$(rpm -qa | grep -e ^selinux-policy -e ^libsemanage -e ^policycoreutils -e ^setools -e ^libselinux -e ^libsepol -e ^checkpolicy -e ^mcstrans -e ^setroubleshoot | sort | sed 's/^/ /')" + rlLogInfo " listing took $(($(date +%s)-$t)) second(s)" + + if rlCheckRequirements $rlSE_REQUIRES; then + SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` + rlLogDebug "FUNCNAME(): sesearch --version: $(sesearch --version 2>&1)" + rlLogDebug "FUNCNAME(): SETOOLS_MAJOR_VERSION=$SETOOLS_MAJOR_VERSION" + rlLogDebug "rlSE Library: Requires installed." + return 0 + fi + + if rlIsRHEL 7 ; then + if uname -r | grep -q x86_64 ; then + local LIBSEPOL_VER_REL=`rpm -q --queryformat "%{version},%{release}" libsepol` + local LIBSELINUX_VER_REL=`rpm -q --queryformat "%{version},%{release}" libselinux` + local SETOOLS_VER_REL=`rpm -q --queryformat "%{version},%{release}" setools-libs` + # remove all i686 setools* packages + rlRun "yum -y remove setools\*.i686" + # install necessary packages + rlRun "yum -y install setools-libs setools-console libsepol libselinux libselinux-python libselinux-utils -x \*.i686" 0,1 + fi + fi + + if rlIsRHEL; then + rlRun "yum install -y --skip-broken $rlSE_REQUIRES" + else + rlRun "dnf install -y --skip-broken $rlSE_REQUIRES" + fi + + # make sure that restorecon does not change SELinux contexts under /var/ARTIFACTS + # otherwise SELinux context of backed up files/directories will be affected + if matchpathcon /var/ARTIFACTS/something | grep -q :var_t: ; then + semanage fcontext -a -e /proc /var/ARTIFACTS + fi + + if rlCheckRequirements $rlSE_REQUIRES; then + SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` + rlLogDebug "FUNCNAME(): sesearch --version: $(sesearch --version 2>&1)" + rlLogDebug "FUNCNAME(): SETOOLS_MAJOR_VERSION=$SETOOLS_MAJOR_VERSION" + rlLogDebug "rlSE Library: Requires installed." + return 0 + fi + + rlLogError "rlSE Library: Not all required packages installed." + return 1 +} # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Authors diff --git a/selinux-policy/Library/common/main.fmf b/selinux-policy/Library/common/main.fmf new file mode 100644 index 0000000..e7dfd5f --- /dev/null +++ b/selinux-policy/Library/common/main.fmf @@ -0,0 +1,15 @@ +summary: selinux-policy Beakerlib library +require: +- type: library + url: https://github.com/beakerlib/epel.git + name: /epel +recommend: +- audit +- setools-console +- expect +- policycoreutils +- /usr/sbin/semanage +- selinux-policy-devel +- yum-utils +- python3 +- sqlite diff --git a/selinux-policy/Library/common/runtest.sh b/selinux-policy/Library/common/runtest.sh index 46d5d95..9f2f5a9 100755 --- a/selinux-policy/Library/common/runtest.sh +++ b/selinux-policy/Library/common/runtest.sh @@ -3,7 +3,6 @@ # This is a test file # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh list_booleans() { @@ -17,7 +16,9 @@ rlIsRHEL 5 && { rlJournalStart rlPhaseStartSetup - rlRun "rlImport selinux-policy/common" + rlRun "rlImport selinux-policy/common" 0,1 + rlRun "uname -a" + rlRun "sestatus" rlPhaseEnd rlPhaseStartTest "rlSEBoolean test" @@ -178,7 +179,7 @@ rlJournalStart rlSESearchRule "allow unconfined_t smbcontrol_t : fd use mls" 1 rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write }" rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write } [ rsync_client ]" 1 - rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write } [ allow_ftpd_anon_write ]" 0 + rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write } [ ftpd_anon_write ]" 0 rlPhaseEnd if rlIsRHEL '>=8'; then diff --git a/selinux-policy/ModemManager-and-similar/Makefile b/selinux-policy/ModemManager-and-similar/Makefile new file mode 100644 index 0000000..e1470f1 --- /dev/null +++ b/selinux-policy/ModemManager-and-similar/Makefile @@ -0,0 +1,85 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/ModemManager-and-similar +# Description: SELinux interferes with ModemManager and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/ModemManager-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with ModemManager and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: ModemManager" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 ModemManager /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 1120152" >> $(METADATA) # RHEL-7 + @echo "Bug: 1362273" >> $(METADATA) # RHEL-7 + @echo "Bug: 1365214" >> $(METADATA) # RHEL-7 + @echo "Bug: 1676810" >> $(METADATA) # RHEL-7 + @echo "Bug: 1697868" >> $(METADATA) # RHEL-7 + @echo "Bug: 1961571" >> $(METADATA) # Fedora 35 + @echo "Bug: 1996903" >> $(METADATA) # Fedora 35 + @echo "Bug: 1996905" >> $(METADATA) # Fedora 35 + @echo "Bug: 2000196" >> $(METADATA) # RHEL-9 + @echo "Bug: 2001141" >> $(METADATA) # Fedora 35 + @echo "Bug: 2001143" >> $(METADATA) # Fedora 35 + @echo "Bug: 2001144" >> $(METADATA) # Fedora 35 + @echo "Bug: 2001145" >> $(METADATA) # Fedora 35 + @echo "Bug: 2036582" >> $(METADATA) # RHEL-9 + @echo "Bug: 2145005" >> $(METADATA) # Fedora 36 + @echo "Bug: 2149560" >> $(METADATA) # RHEL-9 + @echo "Bug: 2149954" >> $(METADATA) # Fedora 37 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/ModemManager-and-similar/PURPOSE b/selinux-policy/ModemManager-and-similar/PURPOSE new file mode 100644 index 0000000..ee44526 --- /dev/null +++ b/selinux-policy/ModemManager-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/ModemManager-and-similar +Author: Milos Malik + +SELinux interferes with ModemManager and related programs. + diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf new file mode 100644 index 0000000..3157e2f --- /dev/null +++ b/selinux-policy/ModemManager-and-similar/main.fmf @@ -0,0 +1,63 @@ +summary: SELinux interferes with ModemManager and related programs +description: |+ + SELinux interferes with ModemManager and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - ModemManager + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1120152 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1362273 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1365214 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1676810 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697868 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961571 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1996903 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1996905 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2000196 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001141 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001143 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001144 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001145 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2036582 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2145005 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149560 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149954 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0075515 +extra-summary: /CoreOS/selinux-policy/Regression/ModemManager-and-similar +extra-task: /CoreOS/selinux-policy/Regression/ModemManager-and-similar +id: 7caff9dc-87ff-4e55-ad78-32312f7f1c99 diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh new file mode 100755 index 0000000..266f354 --- /dev/null +++ b/selinux-policy/ModemManager-and-similar/runtest.sh @@ -0,0 +1,153 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/ModemManager-and-similar +# Description: SELinux interferes with ModemManager and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +if rlIsRHEL 6 ; then + FILE_PATH="/usr/sbin/modem-manager" + PROCESS_NAME="modem-manager" +else + FILE_PATH="/usr/sbin/ModemManager" + PROCESS_NAME="ModemManager" +fi +FILE_CONTEXT="modemmanager_exec_t" +SERVICE_PACKAGE="ModemManager" +SERVICE_NAME="ModemManager" +PROCESS_CONTEXT="modemmanager_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="system_dbusd_t" # D-bus daemon runs the process + else # RHEL-7 etc. + for SOURCE_TYPE in system_dbusd_t init_t ; do + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition }" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + done + fi + rlPhaseEnd + + DESTINATION="org.freedesktop.ModemManager1" + if busctl | grep -iq ${DESTINATION} ; then + rlPhaseStartTest "real scenario -- DBus service" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" 0,1 + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1120152" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSESearchRule "allow modemmanager_t modemmanager_t : unix_stream_socket { connectto }" + rlPhaseEnd + + rlPhaseStartTest "bz#1362273 + bz#1365214" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSEMatchPathCon "/run/systemd/inhibit/7.ref" "systemd_logind_inhibit_var_run_t" + rlSESearchRule "allow modemmanager_t systemd_logind_t : dbus { send_msg }" + rlSESearchRule "allow systemd_logind_t modemmanager_t : dbus { send_msg }" + rlSESearchRule "allow modemmanager_t systemd_logind_inhibit_var_run_t : fifo_file { write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1676810 + bz#1697868" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSESearchRule "allow modemmanager_t sysfs_t : file { append write } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + sleep 1 + rlRun "service systemd-logind restart" + sleep 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + if ! rlIsRHEL 6 7 8 && ! rlIsCentOS 6 7 8 ; then + rlPhaseStartTest "bz#1996903 + bz#1996905 + bz#2001141 + bz#2001143 + bz#2001144 + bz#2001145 + bz#2036582" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSESearchRule "allow modemmanager_t modemmanager_t : qipcrtr_socket { create getattr getopt } [ ]" + rlSESearchRule "allow modemmanager_t kernel_t : system { module_request } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1961571 + bz#2000196" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSEMatchPathCon "/dev/wwan0p1QCDM" "modem_device_t" + rlSEMatchPathCon "/dev/wwan0p2MBIM" "modem_device_t" + rlRun "semanage fcontext -l | grep '^/dev/wwan.*char.*modem_device_t'" + rlSESearchRule "allow modemmanager_t modem_device_t : chr_file { getattr open read write ioctl } [ ]" + rlSESearchRule "allow modemmanager_t unconfined_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2145005 + bz#2149560 + bz#2149954" + rlSESearchRule "allow modemmanager_t modemmanager_t : netlink_route_socket { create getopt getattr nlmsg_write } [ ]" + rlSESearchRule "allow modemmanager_t sysfs_t : dir { write add_name } [ ]" + rlSESearchRule "allow modemmanager_t sysfs_t : file { create } [ ]" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlFileRestore + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/abrt-services/Makefile b/selinux-policy/abrt-services/Makefile new file mode 100644 index 0000000..1984edd --- /dev/null +++ b/selinux-policy/abrt-services/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/abrt-services +# Description: SELinux interferes with various ABRT services +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/abrt-services +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with various ABRT services" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: abrt" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console psmisc abrt abrt-addon-ccpp abrt-addon-coredump-helper abrt-addon-kerneloops abrt-addon-pstoreoops abrt-addon-upload-watch abrt-addon-vmcore abrt-addon-xorg /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL9" >> $(METADATA) + @echo "Bug: 2274709" >> $(METADATA) # Fedora 40 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/abrt-services/PURPOSE b/selinux-policy/abrt-services/PURPOSE new file mode 100644 index 0000000..0416559 --- /dev/null +++ b/selinux-policy/abrt-services/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/abrt-services +Author: Milos Malik + +SELinux interferes with various ABRT services. + diff --git a/selinux-policy/abrt-services/main.fmf b/selinux-policy/abrt-services/main.fmf new file mode 100644 index 0000000..d58ecaf --- /dev/null +++ b/selinux-policy/abrt-services/main.fmf @@ -0,0 +1,54 @@ +summary: SELinux interferes with various ABRT services +description: |+ + SELinux interferes with various ABRT services + +contact: Milos Malik +component: + - abrt + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - psmisc + - abrt + - abrt-addon-ccpp + - abrt-addon-coredump-helper + - abrt-addon-kerneloops + - abrt-addon-pstoreoops + - abrt-addon-upload-watch + - abrt-addon-vmcore + - abrt-addon-xorg + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL9 + - targeted + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2274709 +adjust+: + - enabled: false + when: distro >= rhel-9 + because: the abrt* packages are not available there + - enabled: false + when: distro >= centos-stream-9 + because: the abrt* packages are not available there +extra-summary: /CoreOS/selinux-policy/Regression/abrt-services +extra-task: /CoreOS/selinux-policy/Regression/abrt-services +extra-nitrate: TC#0617419 +id: ca742967-9ac5-4f16-be93-d95eb7932224 diff --git a/selinux-policy/abrt-services/runtest.sh b/selinux-policy/abrt-services/runtest.sh new file mode 100755 index 0000000..abc6c85 --- /dev/null +++ b/selinux-policy/abrt-services/runtest.sh @@ -0,0 +1,81 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/abrt-services +# Description: SELinux interferes with various ABRT services +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qa | grep abrt | sort" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlIsFedora ; then + rlPhaseStartTest "bz#2274709" + rlSEMatchPathCon "/usr/bin/abrt-dump-journal-core" "abrt_dump_oops_exec_t" + rlSEMatchPathCon "/run/systemd/userdb/io.systemd.DynamicUser" "systemd_userdbd_runtime_t" + rlSEMatchPathCon "/run/systemd/userdb/io.systemd.DropIn" "systemd_userdbd_runtime_t" + rlSEMatchPathCon "/run/systemd/userdb/io.systemd.Home" "systemd_userdbd_runtime_t" + rlSESearchRule "allow abrt_dump_oops_t systemd_userdbd_runtime_t : sock_file { write } [ ]" + rlSESearchRule "allow abrt_dump_oops_t systemd_userdbd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow abrt_dump_oops_t init_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + if rpm -qa | grep -q abrt ; then + rlPhaseStartTest "real scenario -- bz#2274709" + for SERVICE_NAME in abrtd abrt-journal-core abrt-oops abrt-pstoreoops abrt-upload-watch abrt-vmcore abrt-xorg ; do + rlRun "service ${SERVICE_NAME} start" + done + sleep 60 & + sleep 10 + rlRun "killall --signal SIGABRT sleep" + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + for SERVICE_NAME in abrtd abrt-journal-core abrt-oops abrt-pstoreoops abrt-upload-watch abrt-vmcore abrt-xorg ; do + rlRun "service ${SERVICE_NAME} stop" + done + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/accounts-daemon-and-similar/Makefile b/selinux-policy/accounts-daemon-and-similar/Makefile new file mode 100644 index 0000000..249d054 --- /dev/null +++ b/selinux-policy/accounts-daemon-and-similar/Makefile @@ -0,0 +1,92 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +# Description: SELinux interferes with accounts daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with accounts daemon and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: accountsservice" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console accountsservice glib2 procps-ng realmd initscripts gdm" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5 -RHEL6" >> $(METADATA) + @echo "Bug: 1456760" >> $(METADATA) # RHEL-7 + @echo "Bug: 1507089" >> $(METADATA) # RHEL-7 + @echo "Bug: 1518211" >> $(METADATA) # RHEL-7 + @echo "Bug: 1595667" >> $(METADATA) # RHEL-7 + @echo "Bug: 1792895" >> $(METADATA) # RHEL-8 + @echo "Bug: 1806126" >> $(METADATA) # Fedora 32 + @echo "Bug: 1811407" >> $(METADATA) # Fedora 32 + @echo "Bug: 1815312" >> $(METADATA) # Fedora 32 + @echo "Bug: 1818696" >> $(METADATA) # Fedora 32 + @echo "Bug: 1819040" >> $(METADATA) # Fedora 32 + @echo "Bug: 1820978" >> $(METADATA) # Fedora 32 + @echo "Bug: 1820992" >> $(METADATA) # Fedora 32 + @echo "Bug: 1821156" >> $(METADATA) # RHEL-8 + @echo "Bug: 1828809" >> $(METADATA) # RHEL-8 + @echo "Bug: 1829013" >> $(METADATA) # Fedora 32 + @echo "Bug: 1829075" >> $(METADATA) # Fedora 32 + @echo "Bug: 1829128" >> $(METADATA) # Fedora 32 + @echo "Bug: 1928546" >> $(METADATA) # Fedora 34 + @echo "Bug: 1928565" >> $(METADATA) # Fedora 34 + @echo "Bug: 1928567" >> $(METADATA) # Fedora 34 + @echo "Bug: 1933687" >> $(METADATA) # Fedora 34 + @echo "Bug: 1933842" >> $(METADATA) # RHEL-9 + @echo "Bug: 1934573" >> $(METADATA) # Fedora 34 + @echo "Bug: 1935232" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/accounts-daemon-and-similar/PURPOSE b/selinux-policy/accounts-daemon-and-similar/PURPOSE new file mode 100644 index 0000000..24bd6f7 --- /dev/null +++ b/selinux-policy/accounts-daemon-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +Author: Milos Malik + +SELinux interferes with accounts daemon and related programs. + diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf new file mode 100644 index 0000000..0a9bd58 --- /dev/null +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -0,0 +1,77 @@ +summary: SELinux interferes with accounts daemon and related programs +description: |+ + SELinux interferes with accounts daemon and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - accountsservice + - glib2 + - procps-ng + - realmd + - initscripts + - gdm +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass + - TIPpass_Security + - TierCandidatesPASS + - targeted + - NoRHIVOS +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1456760 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1507089 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1518211 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595667 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1792895 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1806126 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1811407 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1815312 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1818696 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1819040 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1820978 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1820992 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1821156 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1828809 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829013 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829075 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829128 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928546 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928565 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928567 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933687 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933842 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934573 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1935232 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - enabled: false + when: arch == aarch64, s390x + continue: false +extra-nitrate: TC#0075208 +extra-summary: /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +extra-task: /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +id: 553e648e-a295-4739-8e36-12a4f67a903c diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh new file mode 100755 index 0000000..f658bad --- /dev/null +++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh @@ -0,0 +1,158 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +# Description: SELinux interferes with accounts daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/accounts-daemon" +FILE_CONTEXT="accountsd_exec_t" +SERVICE_PACKAGE="accountsservice" +SERVICE_NAME="accounts-daemon" +PROCESS_NAME="accounts-daemon" +PROCESS_CONTEXT="accountsd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" # a boolean name + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition }" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlPhaseEnd + + rlPhaseStartTest "bz#1456760 + bz#1518211" + rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" + rlSEMatchPathCon "/root" "admin_home_t" + rlSESearchRule "dontaudit accountsd_t admin_home_t : dir { write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1507089" + rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" + rlSESearchRule "allow accountsd_t accountsd_t : capability { dac_read_search } [ ]" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1595667" + rlSEMatchPathCon "/usr/sbin/useradd" "useradd_exec_t" + rlSESearchRule "allow accountsd_t useradd_exec_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1792895 + bz#1821156" + rlSESearchRule "allow accountsd_t realmd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow realmd_t accountsd_t : dbus { send_msg } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1828809" + for USER_TYPE in user_t staff_t sysadm_t xguest_t unconfined_t ; do + rlSESearchRule "allow ${USER_TYPE} accountsd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow accountsd_t ${USER_TYPE} : dbus { send_msg } [ ]" + done + rlPhaseEnd + fi + + DESTINATION="org.freedesktop.Accounts" + if busctl | grep -iq ${DESTINATION} ; then + rlPhaseStartTest "real scenario -- DBus service" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#1806126, bz#1811407, bz#1815312, bz#1818696, bz#1819040, bz#1820978, bz#1820992, bz#1829013, bz#1829075, bz#1829128" + rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" + rlSESearchRule "dontaudit accountsd_t accountsd_t : capability { sys_nice } [ daemons_dontaudit_scheduling ]" + rlPhaseEnd + fi + + if seinfo --common file -x | grep -q watch ; then + rlPhaseStartTest "bz#1928546 + bz#1933842 + bz#1935232" + rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" + rlSEMatchPathCon "/etc/gdm" "xdm_etc_t" + rlSESearchRule "allow accountsd_t xdm_etc_t : dir { watch } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlRun "mkdir -p /etc/gdm" + rlRun "restorecon -Rv /etc" + rlRun "service realmd start" # helps to reproduce BZ#1792895 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/acpid-and-similar/Makefile b/selinux-policy/acpid-and-similar/Makefile new file mode 100644 index 0000000..b7df294 --- /dev/null +++ b/selinux-policy/acpid-and-similar/Makefile @@ -0,0 +1,75 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/acpid-and-similar +# Description: SELinux interferes with acpid and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/acpid-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with acpid and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: acpid" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console acpid /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Architectures: i386 x86_64" >> $(METADATA) + @echo "Bug: 995898" >> $(METADATA) # RHEL-7 + @echo "Bug: 1358478" >> $(METADATA) # RHEL-7 + @echo "Bug: 1468548" >> $(METADATA) # RHEL-7 + @echo "Bug: 1622417" >> $(METADATA) # RHEL-7 + @echo "Bug: 1623342" >> $(METADATA) # RHEL-7 + @echo "Bug: 1932294" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/acpid-and-similar/PURPOSE b/selinux-policy/acpid-and-similar/PURPOSE new file mode 100644 index 0000000..e4b9ffe --- /dev/null +++ b/selinux-policy/acpid-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/acpid-and-similar +Author: Milos Malik + +SELinux interferes with acpid and related programs + diff --git a/selinux-policy/acpid-and-similar/main.fmf b/selinux-policy/acpid-and-similar/main.fmf new file mode 100644 index 0000000..21a6880 --- /dev/null +++ b/selinux-policy/acpid-and-similar/main.fmf @@ -0,0 +1,54 @@ +summary: SELinux interferes with acpid and related programs +description: |+ + SELinux interferes with acpid and related programs + +contact: Milos Malik +component: + - selinux-policy + - acpid +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - acpid + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - TIPpass + - TIPpass_Security + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=995898 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358478 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1468548 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1622417 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1623342 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932294 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919167 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false + - enabled: false + when: arch == ia64, ppc64, ppc64le, s390, s390x + continue: false +extra-nitrate: TC#0075209 +extra-summary: /CoreOS/selinux-policy/Regression/acpid-and-similar +extra-task: /CoreOS/selinux-policy/Regression/acpid-and-similar +id: beec2e51-5acf-4d66-aa05-dc183fbb7b46 diff --git a/selinux-policy/acpid-and-similar/runtest.sh b/selinux-policy/acpid-and-similar/runtest.sh new file mode 100755 index 0000000..5059ee2 --- /dev/null +++ b/selinux-policy/acpid-and-similar/runtest.sh @@ -0,0 +1,134 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/acpid-and-similar +# Description: SELinux interferes with acpid and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/acpid" +FILE_CONTEXT="apmd_exec_t" +SERVICE_PACKAGE="acpid" +SERVICE_NAME="acpid" +PROCESS_NAME="acpid" +PROCESS_CONTEXT="apmd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow initrc_t ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow initrc_t ${PROCESS_CONTEXT} : process { transition }" + rlSESearchRule "type_transition initrc_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#995898" + rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" + rlSEMatchPathCon "/usr/lib/systemd/system/poweroff.target" "power_unit_file_t" + rlSESearchRule "allow apmd_t init_t : dbus { send_msg }" + rlSESearchRule "allow init_t apmd_t : dbus { send_msg }" + rlSESearchRule "allow apmd_t power_unit_file_t : service { start }" + rlPhaseEnd + + rlPhaseStartTest "bz#1358478 + bz#1468548" + rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" + rlSESearchRule "allow apmd_t apmd_t : netlink_generic_socket { create setopt bind } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1622417 + bz#1623342" + rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" + rlSEMatchPathCon "/dev/input/event20" "event_device_t" + rlSEMatchPathCon "/dev/input/event21" "event_device_t" + rlSEMatchPathCon "/dev/input/event22" "event_device_t" + rlSEMatchPathCon "/dev/input/event23" "event_device_t" + rlSEMatchPathCon "/dev/input/event24" "event_device_t" + rlSEMatchPathCon "/dev/input/event25" "event_device_t" + rlSEMatchPathCon "/dev/input/event26" "event_device_t" + rlSEMatchPathCon "/dev/input/event27" "event_device_t" + rlSEMatchPathCon "/dev/input/event28" "event_device_t" + rlSEMatchPathCon "/dev/input/event29" "event_device_t" + rlSEMatchPathCon "/dev/input/event30" "event_device_t" + rlSESearchRule "allow apmd_t event_device_t : chr_file { getattr open read } [ ]" + for I in `seq 20 1 30` ; do + rlRun "sesearch -T -s init_t -t device_t -c chr_file | grep \"event_device_t.*event$I\"" + rlRun "sesearch -T -s kernel_t -t device_t -c chr_file | grep \"event_device_t.*event$I\"" + rlRun "sesearch -T -s udev_t -t device_t -c chr_file | grep \"event_device_t.*event$I\"" + done + rlPhaseEnd + fi + + if seinfo --common file -x | grep -q watch ; then + rlPhaseStartTest "bz#1932294" + rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" + rlSEMatchPathCon "/dev/input" "device_t" + rlSESearchRule "allow apmd_t device_t : dir { watch } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile new file mode 100644 index 0000000..80b8415 --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -0,0 +1,78 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/anon_inode-and-similar +# Description: Upstream coverage for SELinux issues with anon_inode tclass. +# Author: Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/anon_inode-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE reproducer.c + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Amith Kumar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux AVC issues related to anon_inode tclass policies." >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers setools-console audit fio grubby stress-ng" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Architectures: aarch64 ppc64le x86_64" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 1954145" >> $(METADATA) # RHEL-9 + @echo "Bug: 1974559" >> $(METADATA) + @echo "Bug: 2027660" >> $(METADATA) # RHEL-9 + @echo "Bug: 2025714" >> $(METADATA) # Fedora 35 + @echo "Bug: 2187745" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-11792" >> $(METADATA) # RHEL-9 + @echo "Bug: 2270895" >> $(METADATA) # Fedora 41 + @echo "Bug: RHEL-60837" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-116154" >> $(METADATA) # RHEL-10 + @echo "Bug: RHELTEST-2022" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/anon_inode-and-similar/PURPOSE b/selinux-policy/anon_inode-and-similar/PURPOSE new file mode 100644 index 0000000..3267a57 --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/PURPOSE @@ -0,0 +1,4 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/anon_inode-and-similar +Author: Amith Kumar + +SELinux denials affect processes that deals with anon_inode and io_uring classes. diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf new file mode 100644 index 0000000..47dbdcf --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -0,0 +1,59 @@ +summary: SELinux AVC issues related to anon_inode tclass policies. +description: | + SELinux denials affect processes that deals with anon_inode tclass. +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - libselinux + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - gcc + - glibc-headers + - setools-console + - audit + - fio + - grubby + - stress-ng +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - reboot + - rhel9_broken + - rhel10_broken + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954145 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027660 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2025714 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187745 + - verifies: https://issues.redhat.com/browse/RHEL-11792 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270895 + - verifies: https://issues.redhat.com/browse/RHEL-60837 + - verifies: https://issues.redhat.com/browse/RHEL-116154 + - verifies: https://issues.redhat.com/browse/RHELTEST-2022 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the anon_inode class is not defined there + - enabled: false + when: arch == s390, s390x + because: the automated test gets stuck there +extra-nitrate: TC#0612643 +extra-summary: /CoreOS/selinux-policy/Regression/anon_inode-and-similar +extra-task: /CoreOS/selinux-policy/Regression/anon_inode-and-similar +id: 4e70e1ec-d3ae-40df-aad6-dfc4a23bc081 diff --git a/selinux-policy/anon_inode-and-similar/reproducer.c b/selinux-policy/anon_inode-and-similar/reproducer.c new file mode 100644 index 0000000..9759c2c --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/reproducer.c @@ -0,0 +1,84 @@ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static void test_assert(int cond) { + if (!cond) { + abort(); + } +} + +static void do_child(int sock) { + int fd; + struct msghdr msg; + char mbuf; + struct iovec iov = { &mbuf, 1 }; + char cbuf[CMSG_SPACE(sizeof(fd))]; + const struct cmsghdr* cmsg; + + memset(&msg, 0, sizeof(msg)); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = cbuf; + msg.msg_controllen = sizeof(cbuf); + + test_assert(recvmsg(sock, &msg, 0) == 1); + test_assert(mbuf == 'x'); + + test_assert(!(msg.msg_flags & MSG_CTRUNC)); + test_assert(msg.msg_controllen == CMSG_SPACE(sizeof(fd))); + cmsg = CMSG_FIRSTHDR(&msg); + test_assert(SOL_SOCKET == cmsg->cmsg_level && SCM_RIGHTS == cmsg->cmsg_type); + memcpy(&fd, CMSG_DATA(cmsg), sizeof(fd)); + + printf("fd=%d\n", fd); +} + +#define USER_MODE_ONLY 1 + +int main(void) { + int sockfds[2]; + pid_t child; + int fd; + struct msghdr msg; + struct iovec iov = { "x", 1 }; + char cbuf[CMSG_SPACE(sizeof(fd))]; + struct cmsghdr* cmsg; + ssize_t nsent; + int status; + + test_assert(0 == socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds)); + + if (0 == (child = fork())) { + do_child(sockfds[1]); + return 0; + } + + fd = syscall(SYS_userfaultfd, USER_MODE_ONLY); + test_assert(fd >= 0); + + memset(&msg, 0, sizeof(msg)); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = cbuf; + msg.msg_controllen = sizeof(cbuf); + cmsg = CMSG_FIRSTHDR(&msg); + cmsg->cmsg_level = SOL_SOCKET; + cmsg->cmsg_type = SCM_RIGHTS; + cmsg->cmsg_len = CMSG_LEN(sizeof(fd)); + memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd)); + + test_assert(sendmsg(sockfds[0], &msg, 0) == 1); + + test_assert(child == waitpid(child, &status, 0)); + test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); + + return 0; +} diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh new file mode 100755 index 0000000..0732ea1 --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -0,0 +1,122 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/anon_inode-and-similar +# Description: Test coverage for cases verifying avc denial issues related to anon_inode tclass. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +if rlIsRHEL 9 || rlIsCentOS 9 ; then + if ! grep io_uring /proc/cmdline ; then + grubby --update-kernel ALL --args io_uring.enable=y + grubby --update-kernel ALL --args sysctl.kernel.io_uring_disabled=0 + sync + tmt-reboot + fi +fi + +PACKAGE="selinux-policy" + +rlJournalStart + if ! seinfo -c anon_inode | grep -q anon_inode ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm gcc + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1954145" + rlRun "seinfo -c | grep anon_inode" + rlRun "seinfo -c anon_inode -x" + rlRun "sesearch -s domain -t domain -c anon_inode -A -ds -dt" + rlPhaseEnd + + rlPhaseStartTest "SELinux policy prevents userfaultfds bz1974559" + rlRun "gcc -o reproducer reproducer.c" + tst_Time="$(date '+%T')" + rlRun "./reproducer" + sleep 3 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + if rlIsFedora '<=39'; then + rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { write }" + fi + rlRun "rm -f reproducer" + rlPhaseEnd + + rlPhaseStartTest "mmap on io_uring - bz#2025714 + bz#2187745" + if rlIsFedora '<=39' || rlIsCentOS 9 || rlIsRHEL 9 ; then + rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { map } [ ]" + rlSESearchRule "allow svirt_t svirt_t : anon_inode { map } [ ]" + rlSESearchRule "allow virtd_t virtd_t : anon_inode { map } [ ]" + else + rlSESearchRule "allow unconfined_t io_uring_t : anon_inode { create getattr map read write } [ ]" + rlSESearchRule "allow svirt_t io_uring_t : anon_inode { create getattr map read write } [ ]" + rlSESearchRule "allow virtd_t io_uring_t : anon_inode { create getattr map read write } [ ]" + fi + + rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 + rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring_cmd --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 + rlPhaseEnd + + if ! rlIsRHEL "<9.4"; then + rlPhaseStartTest "RHEL-11792" + rlSESearchRule "allow unconfined_t unconfined_t : io_uring { cmd } [ ]" + rlSESearchRule "allow unconfined_service_t unconfined_service_t : io_uring { cmd } [ ]" + rlPhaseEnd + fi + + if seinfo -t | grep -q secretmem_t ; then + rlPhaseStartTest "bz#2270895 + RHEL-60837" + rlSESearchRule "allow unconfined_t secretmem_t : anon_inode { create } [ ]" + rlSESearchRule "allow sysadm_t secretmem_t : anon_inode { create } [ ]" + rlSESearchRule "type_transition unconfined_t unconfined_t : anon_inode secretmem_t [secretmem]" + rlSESearchRule "type_transition sysadm_t sysadm_t : anon_inode secretmem_t [secretmem]" + rlRun "stress-ng --resources 16 --timeout 5 --log-file /dev/null" + rlPhaseEnd + + rlPhaseStartTest "RHEL-116154 + RHELTEST-2022" + rlSESearchRule "allow unconfined_t secretmem_t : anon_inode { map read write } [ ]" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/bgpd-and-similar/Makefile b/selinux-policy/bgpd-and-similar/Makefile new file mode 100644 index 0000000..4abe755 --- /dev/null +++ b/selinux-policy/bgpd-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bgpd-and-similar +# Description: SELinux interferes with bgpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bgpd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with bgpd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console openbgpd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1830170" >> $(METADATA) # RHEL-8 + @echo "Bug: 2055578" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bgpd-and-similar/PURPOSE b/selinux-policy/bgpd-and-similar/PURPOSE new file mode 100644 index 0000000..975ccf4 --- /dev/null +++ b/selinux-policy/bgpd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bgpd-and-similar +Author: Milos Malik + +SELinux interferes with bgpd and related programs + diff --git a/selinux-policy/bgpd-and-similar/main.fmf b/selinux-policy/bgpd-and-similar/main.fmf new file mode 100644 index 0000000..7524230 --- /dev/null +++ b/selinux-policy/bgpd-and-similar/main.fmf @@ -0,0 +1,48 @@ +summary: SELinux interferes with bgpd and related programs +description: |+ + SELinux interferes with bgpd and related programs + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - openbgpd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - epel + - rhel8-epel + - rhel9-epel + - rhel10-epel + - targeted + - NoRHIVOS +tier: 2 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1830170 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2055578 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0613221 +extra-summary: /CoreOS/selinux-policy/Regression/bgpd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/bgpd-and-similar +id: b6f956b3-645b-440b-ac06-f8cdb1f8fe80 diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh new file mode 100755 index 0000000..7cb5b26 --- /dev/null +++ b/selinux-policy/bgpd-and-similar/runtest.sh @@ -0,0 +1,108 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bgpd-and-similar +# Description: SELinux interferes with bgpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/bgpd" +SERVICE_PACKAGE="openbgpd" +SERVICE_NAME="bgpd" +PROCESS_NAME="bgpd" +if rlIsRHEL 9 || rlIsCentOS 9 ; then + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +else + FILE_CONTEXT="zebra_exec_t" + PROCESS_CONTEXT="zebra_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/bgpd.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1830170 + bz#2055578" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf" + if rlIsRHEL 8 || rlIsCentOS 8 ; then + # work around BZ#1830170 that was closed as WONTFIX + rlRun "chcon -t bin_t /usr/sbin/bgpd" + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + if rlIsRHEL 8 || rlIsCentOS 8 ; then + # work around BZ#1830170 that was closed as WONTFIX + rlRun "restorecon -v /usr/sbin/bgpd" + fi + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/blueman-and-similar/Makefile b/selinux-policy/blueman-and-similar/Makefile new file mode 100644 index 0000000..633c985 --- /dev/null +++ b/selinux-policy/blueman-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/blueman-and-similar +# Description: SELinux interferes with blueman* programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/blueman-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with blueman* programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 gtk3 blueman python-cairo pygtk2 /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1470501" >> $(METADATA) # Fedora + @echo "Bug: 2027044" >> $(METADATA) # Fedora 35 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/blueman-and-similar/PURPOSE b/selinux-policy/blueman-and-similar/PURPOSE new file mode 100644 index 0000000..585f5a1 --- /dev/null +++ b/selinux-policy/blueman-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/blueman-and-similar +Author: Milos Malik + +SELinux interferes with blueman* programs. + diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf new file mode 100644 index 0000000..11d9759 --- /dev/null +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -0,0 +1,47 @@ +summary: SELinux interferes with blueman* programs +description: |+ + SELinux interferes with blueman* programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - gtk3 + - blueman + - python-cairo + - pygtk2 + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470501 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2027044 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10 + because: the blueman package is not available there +extra-nitrate: TC#0563638 +extra-summary: /CoreOS/selinux-policy/Regression/blueman-and-similar +extra-task: /CoreOS/selinux-policy/Regression/blueman-and-similar +id: 9466ffdd-be04-4b35-8e65-f866e23fcfad diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh new file mode 100755 index 0000000..a5910b6 --- /dev/null +++ b/selinux-policy/blueman-and-similar/runtest.sh @@ -0,0 +1,126 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/blueman-and-similar +# Description: SELinux interferes with blueman* programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/blueman-mechanism" +FILE_CONTEXT="blueman_exec_t" +SERVICE_PACKAGE="blueman" +SERVICE_NAME="blueman-mechanism" +PROCESS_NAME="blueman-mechanism" +PROCESS_CONTEXT="blueman_t" + +rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlRun "mkdir -p -Z ~/.cache" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1470501" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow blueman_t policykit_t : dbus { send_msg }" + rlSESearchRule "allow policykit_t blueman_t : dbus { send_msg }" + rlPhaseEnd + + DESTINATION="org.blueman.Mechanism" + if busctl | grep -iq ${DESTINATION} ; then + rlPhaseStartTest "real scenario -- DBus service" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#2027044" + rlSEMatchPathCon "/usr/libexec/blueman-mechanism" "blueman_exec_t" + rlSEMatchPathCon "/root/.local/lib/python3.10/site-packages" "gconf_home_t" + rlSESearchRule "allow blueman_t gconf_home_t : dir { read } [ ]" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + PYTHON_VERSION=`python --version | tr -d ' ' | cut -d . -f 1,2 | tr '[:upper:]' '[:lower:]'` + rlRun "mkdir -p ~/.local/lib/${PYTHON_VERSION}/site-packages/" + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/boinc-and-similar/Makefile b/selinux-policy/boinc-and-similar/Makefile new file mode 100644 index 0000000..467133b --- /dev/null +++ b/selinux-policy/boinc-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/boinc-and-similar +# Description: SELinux interferes with boinc and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/boinc-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with boinc and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: boinc-client" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console boinc-client /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1618683" >> $(METADATA) # RHEL-7 + @echo "Bug: 1711682" >> $(METADATA) # Fedora 30 + @echo "Bug: 1779070" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/boinc-and-similar/PURPOSE b/selinux-policy/boinc-and-similar/PURPOSE new file mode 100644 index 0000000..5f8f3b6 --- /dev/null +++ b/selinux-policy/boinc-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/boinc-and-similar +Author: Milos Malik + +SELinux interferes with BOINC client (Berkeley Open Infrastructure Network Computing) and related programs. + diff --git a/selinux-policy/boinc-and-similar/main.fmf b/selinux-policy/boinc-and-similar/main.fmf new file mode 100644 index 0000000..5c18c33 --- /dev/null +++ b/selinux-policy/boinc-and-similar/main.fmf @@ -0,0 +1,55 @@ +summary: SELinux interferes with boinc and related programs +description: |+ + SELinux interferes with BOINC client (Berkeley Open Infrastructure Network Computing) and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - boinc-client + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - epel + - rhel8-epel + - rhel9-epel + - rhel10-epel + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618683 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1711682 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1779070 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - enabled: false + when: arch == aarch64, s390x + continue: false +extra-nitrate: TC#0563640 +extra-summary: /CoreOS/selinux-policy/Regression/boinc-and-similar +extra-task: /CoreOS/selinux-policy/Regression/boinc-and-similar +id: 024cde06-0e81-40fe-8901-e552f47f5ca4 diff --git a/selinux-policy/boinc-and-similar/runtest.sh b/selinux-policy/boinc-and-similar/runtest.sh new file mode 100755 index 0000000..3db917c --- /dev/null +++ b/selinux-policy/boinc-and-similar/runtest.sh @@ -0,0 +1,113 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/boinc-and-similar +# Description: SELinux interferes with boinc and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/bin/boinc_client" +FILE_CONTEXT="boinc_exec_t" +SERVICE_PACKAGE="boinc-client" +SERVICE_NAME="boinc-client" +PROCESS_NAME="boinc" +PROCESS_CONTEXT="boinc_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1618683" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow boinc_t boinc_exec_t : file { execute_no_trans }" + rlPhaseEnd + + rlPhaseStartTest "bz#1711682 + bz#1779070" + # /usr/bin/boinc and /usr/bin/boinc_client are hardlinks, share the same inode + rlSEMatchPathCon "/usr/bin/boinc_client" "boinc_exec_t" + rlSEMatchPathCon "/var/lib/boinc" "boinc_var_lib_t" + rlSEMatchPathCon "/run/systemd/unit-root/var/lib/boinc" "init_var_run_t" + rlSESearchRule "allow init_t boinc_var_lib_t : dir { mounton } [ ]" + # SELinux denials appear if the following line is in boinc-client system unit file + # ReadWritePaths=/var/lib/boinc + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/boltd-and-similar/Makefile b/selinux-policy/boltd-and-similar/Makefile new file mode 100644 index 0000000..e1a39c5 --- /dev/null +++ b/selinux-policy/boltd-and-similar/Makefile @@ -0,0 +1,74 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/boltd-and-similar +# Description: SELinux interferes with boltd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/boltd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with boltd and related programs." >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: bolt" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 expect openssh-clients bolt" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1589086" >> $(METADATA) # RHEL-7 + @echo "Bug: 1625786" >> $(METADATA) # Fedora 28 + @echo "Bug: 1684103" >> $(METADATA) # RHEL-8 + @echo "Bug: 1685591" >> $(METADATA) # RHEL-7 + @echo "Bug: 1702243" >> $(METADATA) # RHEL-8 + @echo "Bug: 1704766" >> $(METADATA) # RHEL-7 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/boltd-and-similar/PURPOSE b/selinux-policy/boltd-and-similar/PURPOSE new file mode 100644 index 0000000..69f4521 --- /dev/null +++ b/selinux-policy/boltd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/boltd-and-similar +Author: Milos Malik + +SELinux interferes with boltd and related programs. + diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf new file mode 100644 index 0000000..9cb811e --- /dev/null +++ b/selinux-policy/boltd-and-similar/main.fmf @@ -0,0 +1,54 @@ +summary: SELinux interferes with boltd and related programs. +description: |+ + SELinux interferes with boltd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - /usr/sbin/service + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - expect + - openssh-clients + - bolt +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1589086 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1625786 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1684103 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1685591 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1702243 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1704766 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0575292 +extra-summary: /CoreOS/selinux-policy/Regression/boltd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/boltd-and-similar +id: 008316f1-35ab-4eb6-9e70-92df795f9254 diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh new file mode 100755 index 0000000..0115c59 --- /dev/null +++ b/selinux-policy/boltd-and-similar/runtest.sh @@ -0,0 +1,167 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/boltd-and-similar +# Description: SELinux interferes with boltd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/boltd" +FILE_CONTEXT="boltd_exec_t" +SERVICE_PACKAGE="bolt" +SERVICE_NAME="bolt" +PROCESS_NAME="boltd" +PROCESS_CONTEXT="boltd_t" +ALLOWED_USERS="staff_u user_u xguest_u sysadm_u unconfined_u" +DENIED_USERS="guest_u" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1589086 + bz#1684103 + bz#1685591" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/lib/boltd" "boltd_var_lib_t" + rlSEMatchPathCon "/var/run/dbus" "system_dbusd_var_run_t" + rlSEMatchPathCon "/var/run/dbus/system_bus_socket" "system_dbusd_var_run_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + rlSEMatchPathCon "/run/udev" "udev_var_run_t" + rlSEMatchPathCon "/run/udev/control" "udev_var_run_t" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow unconfined_t boltd_t : dbus { send_msg }" + rlSESearchRule "allow boltd_t unconfined_t : dbus { send_msg }" + rlSESearchRule "allow boltd_t sssd_public_t : dir { search }" + rlSESearchRule "allow boltd_t sssd_public_t : file { getattr map open read }" + rlSESearchRule "allow boltd_t sssd_var_lib_t : sock_file { write }" + rlSESearchRule "allow boltd_t udev_var_run_t : dir { search }" + rlSESearchRule "allow boltd_t system_dbusd_var_run_t : dir { search }" + rlSESearchRule "allow boltd_t system_dbusd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t system_dbusd_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1625786" + rlSESearchRule "allow boltd_t policykit_t : dbus { send_msg } [ ]" + rlSESearchRule "allow policykit_t boltd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t system_dbusd_t : dbus { acquire_svc } [ ]" + rlSESearchRule "allow boltd_t xdm_t : dbus { send_msg } [ ]" + rlSESearchRule "allow xdm_t boltd_t : dbus { send_msg } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1702243 + bz#1704766" + rlSESearchRule "allow staff_t boltd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t staff_t : dbus { send_msg } [ ]" + rlSESearchRule "allow user_t boltd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t user_t : dbus { send_msg } [ ]" + rlSESearchRule "allow xguest_t boltd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t xguest_t : dbus { send_msg } [ ]" + rlPhaseEnd + + DESTINATION="org.freedesktop.bolt" + if busctl | grep -iq ${DESTINATION} ; then + rlPhaseStartTest "real scenario -- system D-bus" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 2 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- confined users" + CREATED_USERS="" + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost boltctl list" + sleep 2 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/boltd-and-similar/ssh.exp b/selinux-policy/boltd-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/boltd-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/boothd-and-similar/Makefile b/selinux-policy/boothd-and-similar/Makefile new file mode 100644 index 0000000..fa8e9cf --- /dev/null +++ b/selinux-policy/boothd-and-similar/Makefile @@ -0,0 +1,72 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/boothd-and-similar +# Description: SELinux interferes with boothd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/boothd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with boothd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: booth" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console booth-arbitrator booth-core /usr/sbin/service net-tools systemd-container" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-45907" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-57104" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-58060" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-75471" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/boothd-and-similar/PURPOSE b/selinux-policy/boothd-and-similar/PURPOSE new file mode 100644 index 0000000..def5594 --- /dev/null +++ b/selinux-policy/boothd-and-similar/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/boothd-and-similar +Author: Milos Malik + +SELinux interferes with boothd and related programs. +Covers the booth-arbitrator service. + diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf new file mode 100644 index 0000000..45244b4 --- /dev/null +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -0,0 +1,52 @@ +summary: SELinux interferes with boothd and related programs +description: |+ + SELinux interferes with boothd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - booth-arbitrator + - booth-core + - /usr/sbin/service + - net-tools + - systemd-container +environment: + AVC_ERROR: +no_avc_check +duration: 20m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS + - avoidImageMode +link: + - verifies: https://issues.redhat.com/browse/RHEL-45907 + - verifies: https://issues.redhat.com/browse/RHEL-57104 + - verifies: https://issues.redhat.com/browse/RHEL-58060 + - verifies: https://issues.redhat.com/browse/RHEL-75471 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the booth package is not available there + - enabled: false + when: distro ~< rhel-9.6 + because: RHEL-57104 and other is fixed in RHEL-9.6, RHEL-8 not affected +extra-summary: /CoreOS/selinux-policy/Regression/boothd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/boothd-and-similar +extra-nitrate: TC#0617767 +id: 7d00eabe-6df9-4577-9b07-1b79ab62f21b diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh new file mode 100755 index 0000000..e32dae0 --- /dev/null +++ b/selinux-policy/boothd-and-similar/runtest.sh @@ -0,0 +1,108 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/boothd-and-similar +# Description: SELinux interferes with boothd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/boothd" +SERVICE_PACKAGE="booth-arbitrator" +SERVICE_NAME="booth-arbitrator" +PROCESS_NAME="boothd" +if seinfo -t | grep -q boothd ; then + FILE_CONTEXT="boothd_exec_t" + PROCESS_CONTEXT="boothd_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/booth/booth.conf + rlRun "service systemd-machined start" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if seinfo -t | grep -q boothd && ! rlIsRHEL "<9.6" && ! rlIsCentOS "<9.6" ; then + rlPhaseStartTest "RHEL-45907" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/run/systemd/userdb" "systemd_userdbd_runtime_t" + rlSESearchRule "allow boothd_t systemd_userdbd_runtime_t : dir { read } [ ]" + rlSESearchRule "allow boothd_t systemd_userdbd_runtime_t : sock_file { write } [ ]" + rlSESearchRule "allow boothd_t systemd_userdbd_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-57104 + RHEL-58060" + rlSESearchRule "allow boothd_t kernel_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 8 9 && ! rlIsCentOS 8 9 ; then + rlPhaseStartTest "RHEL-75471" + rlSESearchRule "allow boothd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ]; then + rlPhaseStartTest "real scenario -- standalone service" + IF_NAME=`route | grep default | awk '{ print $8 }'` + IP_ADDRESS=`ip addr show ${IF_NAME} | grep 'inet ' | cut -d / -f 1 | awk '{ print $2 }' | head -n 1` + rlRun "cp -f /usr/share/doc/booth/booth.conf.example /etc/booth/booth.conf" + rlRun "sed -i 's/^arbitrator=.*$/arbitrator=\"${IP_ADDRESS}\"/' /etc/booth/booth.conf" + rlRun "grep ^arbitrator /etc/booth/booth.conf" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlWatchdog "booth list" 20 + rlWatchdog "booth status" 20 + rlWatchdog "booth peers" 20 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlFileRestore + rlRun "service systemd-machined stop" + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile new file mode 100644 index 0000000..68ea1c9 --- /dev/null +++ b/selinux-policy/bootupd-and-similar/Makefile @@ -0,0 +1,75 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bootupd-and-similar +# Description: SELinux interferes with the bootupd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bootupd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service bootupd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2029478" >> $(METADATA) # RHEL-9 + @echo "Bug: 2044508" >> $(METADATA) # RHEL-9 + @echo "Bug: 2218106" >> $(METADATA) # Fedora rawhide + @echo "Bug: RHEL-36289" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-39514" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-66584" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-70849" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-174888" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bootupd-and-similar/PURPOSE b/selinux-policy/bootupd-and-similar/PURPOSE new file mode 100644 index 0000000..d1f7895 --- /dev/null +++ b/selinux-policy/bootupd-and-similar/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bootupd-and-similar +Description: SELinux interferes with the bootupd service and related programs +Author: Milos Malik + +The TC needs a machine with EFI for a successful run. + diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf new file mode 100644 index 0000000..52e576e --- /dev/null +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -0,0 +1,52 @@ +summary: SELinux interferes with the bootupd service and related programs +description: |+ + SELinux interferes with the bootupd service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - bootupd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS + - avoidImageMode +tier: 3 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2029478 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2044508 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106 + - verifies: https://issues.redhat.com/browse/RHEL-36289 + - verifies: https://issues.redhat.com/browse/RHEL-39514 + - verifies: https://issues.redhat.com/browse/RHEL-66584 + - verifies: https://issues.redhat.com/browse/RHEL-70849 + - verifies: https://issues.redhat.com/browse/RHEL-174888 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/bootupd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/bootupd-and-similar +extra-nitrate: TC#0614833 +id: f6f4f1bc-b585-4199-8cde-d72424cadd52 diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh new file mode 100755 index 0000000..f2b2767 --- /dev/null +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -0,0 +1,188 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bootupd-and-similar +# Description: SELinux interferes with the bootupd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/bootupd" +SERVICE_PACKAGE="bootupd" +if rlIsFedora ; then + SERVICE_NAME="bootloader-update" +else + SERVICE_NAME="bootupd" +fi +PROCESS_NAME="bootupd" +if seinfo -t | grep -q bootupd ; then + FILE_CONTEXT="bootupd_exec_t" + PROCESS_CONTEXT="bootupd_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2029478 + bz#2044508" + # both BZs were closed as WONTFIX, but the test is flexible enough + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + BOOLEANS="[ ]" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "bz#2218106" + rlSEMatchPathCon "/usr/libexec/bootupd" "${FILE_CONTEXT}" + if [ -d /boot/efi ] ; then + rlRun "ls -aRlZ /boot/efi" + fi + rlSESearchRule "allow ${PROCESS_CONTEXT} dosfs_t : dir { getattr search } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-36289 + RHEL-39514" + rlSEMatchPathCon "/usr/libexec/bootupd" "${FILE_CONTEXT}" + if [ -d /sys/firmware/efi/efivars ] ; then + rlRun "ls -aRlZ /sys/firmware/efi/efivars" + fi + rlSESearchRule "allow ${PROCESS_CONTEXT} efivarfs_t : dir { getattr search } [ ]" + rlPhaseEnd + + if rlSEDefined "bootupd_t" ; then + rlPhaseStartTest "RHEL-66584" + rlSEMatchPathCon "/boot/bootupd-state.json" "boot_t" + rlSESearchRule "allow bootupd_t boot_t : dir { write remove_name } [ ]" + rlSESearchRule "allow bootupd_t boot_t : file { unlink } [ ]" + rlSESearchRule "allow bootupd_t dosfs_t : dir { search } [ ]" + rlSESearchRule "allow bootupd_t dosfs_t : file { open } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-70849" + rlSEMatchPathCon "/usr/bin/findmnt" "bin_t" + rlSEMatchPathCon "/usr/bin/lsblk" "bin_t" + rlSEMatchPathCon "/usr/bin/udevadm" "udev_exec_t" + rlSEMatchPathCon "/usr/bin/mount" "mount_exec_t" + rlSEMatchPathCon "/usr/sbin/grub2-install" "bootloader_exec_t" + rlSESearchRule "allow bootupd_t fixed_disk_device_t : blk_file { getattr } [ ]" + rlSESearchRule "allow bootupd_t bin_t : file { execute execute_no_trans map } [ ]" + rlSESearchRule "allow bootupd_t sysfs_t : dir { read } [ ]" + rlSESearchRule "allow bootupd_t sysfs_t : file { getattr open read } [ ]" + rlSESearchRule "allow bootupd_t sysfs_t : lnk_file { read } [ ]" + rlSESearchRule "allow bootupd_t cert_t : dir { getattr open read search } [ ]" + rlSESearchRule "allow bootupd_t cert_t : file { getattr open read } [ ]" + + rlSESearchRule "allow bootupd_t udev_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "type_transition bootupd_t udev_exec_t : process udev_t" + rlSESearchRule "allow bootupd_t udev_t : process { transition } [ ]" + + rlSESearchRule "allow bootupd_t mount_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "type_transition bootupd_t mount_exec_t : process mount_t" + rlSESearchRule "allow bootupd_t mount_t : process { transition } [ ]" + + rlSESearchRule "allow bootupd_t bootloader_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "type_transition bootupd_t bootloader_exec_t : process bootloader_t" + rlSESearchRule "allow bootupd_t bootloader_t : process { transition } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-174888" + rlSEMatchPathCon "/usr/bin/lsblk" "bin_t" + rlSEMatchPathCon "/etc/passwd" "passwd_file_t" + rlSEMatchPathCon "/run/mount/utab" "mount_var_run_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSESearchRule "allow bootupd_t mount_var_run_t : dir { search } [ ]" + rlSESearchRule "allow bootupd_t passwd_file_t : file { getattr open read } [ ]" + rlSESearchRule "allow bootupd_t sssd_public_t : dir { search } [ ]" + rlSESearchRule "allow bootupd_t sssd_var_lib_t : dir { search } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for OSes where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlRun "systemctl start ${SERVICE_NAME}.socket" + fi + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlRun "systemctl stop ${SERVICE_NAME}.socket" + fi + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlPhaseStartTest "real scenario -- ${SERVICE_NAME}.socket" + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + sleep 1 + rlRun "rm -f /boot/bootupd-state.json" + rlRun "bootupctl adopt-and-update" 0,1 + rlRun "bootupctl status" 0,1 + rlRun "bootupctl validate" 0,1 + rlRun "lsblk" + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario without the service or the socket" + rlRun "rm -f /boot/bootupd-state.json" + rlRun "bootupctl adopt-and-update" 0,1 + rlRun "bootupctl status" 0,1 + rlRun "bootupctl validate" 0,1 + rlRun "lsblk" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/bz481628-send-msg-to-dbus/Makefile b/selinux-policy/bz481628-send-msg-to-dbus/Makefile index 06e84fa..3afb08d 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/Makefile +++ b/selinux-policy/bz481628-send-msg-to-dbus/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: dbus" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console expect openssh-clients dbus-daemon shadow-utils" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console expect openssh-clients dbus-daemon shadow-utils" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf index 8763a30..d2dae9e 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf +++ b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf @@ -1,2 +1,53 @@ -path: /selinux-policy/bz481628-send-msg-to-dbus -tier: 2 +summary: checks if dbus daemon is able to send message to hal daemon and vice versa +description: |+ + SELinux interferes with D-bus daemon and related programs. + +contact: Milos Malik +component: + - dbus + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/service + - setools-console + - expect + - openssh-clients + - dbus-daemon + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass + - TierCandidatesPASS + - targeted + - NoRHIVOS +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=463267 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=481628 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1546721 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1614236 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1688671 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1727887 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754476 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0057414 +extra-summary: /CoreOS/selinux-policy/Regression/bz481628-send-msg-to-dbus +extra-task: /CoreOS/selinux-policy/Regression/bz481628-send-msg-to-dbus +id: 3d861eff-500e-48d9-bef7-0906a55f5000 diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh index 97c4f41..80100e4 100755 --- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh +++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" @@ -45,12 +44,14 @@ PROCESS_CONTEXT="system_dbusd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} + rlSEConfigureSSH + rlSESetEnforce rlSEStatus rlSESetTimestamp @@ -99,13 +100,15 @@ rlJournalStart rlPhaseStartTest "bz#1614236" rlSEMatchPathCon "/usr/bin/dbus-daemon" "dbusd_exec_t" rlSEMatchPathCon "/dev/nvme0n1p1" "nvme_device_t" - rlSESearchRule "allow system_dbusd_t nvme_device_t : blk_file { getattr open read }" + rlSESearchRule "allow system_dbusd_t nvme_device_t : blk_file { read } [ ]" rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService "nopassword" ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "reload status" 1 rlPhaseEnd + fi if ! rlIsRHEL 5 6 7 ; then rlPhaseStartTest "bz#1688671" @@ -132,6 +135,7 @@ rlJournalStart rlPhaseStartTest "real scenario -- user session service" rlRun "setsebool ssh_sysadm_login on" rlRun "setsebool selinuxuser_tcp_server on" + CREATED_USERS="" # TODO: guest_u, xguest_u cannot successfully run systemctl for SELINUX_USER in user_u staff_u sysadm_u unconfined_u ; do USER_NAME="user${RANDOM}" @@ -149,8 +153,10 @@ rlJournalStart rlRun "grep \"${SELINUX_USER}:object_r:session_dbusd_tmp_t:.* services\" files.txt" fi rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/busctl --user --no-pager" + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + for USER_NAME in ${CREATED_USERS} ; do rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 done rlRun "setsebool selinuxuser_tcp_server off" rlRun "setsebool ssh_sysadm_login off" @@ -159,8 +165,11 @@ rlJournalStart rlPhaseStartCleanup sleep 2 - rlSECheckAVC + rlSECheckAVC --ignore 'type=AVC .* create .*systemd .*:user_t:.*:user_tmp_t:.*tclass=dir' rm -f files.txt + + rlFileRestore + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile b/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile new file mode 100644 index 0000000..20c69e7 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile @@ -0,0 +1,113 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +# Description: kdump service cannot be started because of SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te run.exp id_rsa id_rsa.pub + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh run.exp + chcon -t bin_t runtest.sh run.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: kdump service cannot be started because of SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: expect" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) + @echo "Requires: kexec-tools" >> $(METADATA) + @echo "Requires: grubby" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: sed" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-mls" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 533007" >> $(METADATA) # RHEL-6 + @echo "Bug: 533366" >> $(METADATA) # RHEL-6 + @echo "Bug: 537088" >> $(METADATA) # RHEL-6 + @echo "Bug: 540758" >> $(METADATA) # RHEL-6 + @echo "Bug: 549503" >> $(METADATA) # RHEL-6 + @echo "Bug: 618329" >> $(METADATA) # RHEL-6 + @echo "Bug: 621061" >> $(METADATA) # RHEL-6 + @echo "Bug: 753039" >> $(METADATA) # RHEL-5 + @echo "Bug: 966203" >> $(METADATA) # RHEL-6 + @echo "Bug: 1055634" >> $(METADATA) # RHEL-7 + @echo "Bug: 1117368" >> $(METADATA) # RHEL-7 + @echo "Bug: 1117710" >> $(METADATA) # RHEL-7 + @echo "Bug: 1146491" >> $(METADATA) # RHEL-7 + @echo "Bug: 1288565" >> $(METADATA) # RHEL-6 + @echo "Bug: 1363977" >> $(METADATA) # RHEL-7 + @echo "Bug: 1375963" >> $(METADATA) # RHEL-7 + @echo "Bug: 1390669" >> $(METADATA) # RHEL-7 + @echo "Bug: 1418441" >> $(METADATA) # RHEL-7 + @echo "Bug: 1431236" >> $(METADATA) # RHEL-6 + @echo "Bug: 1536690" >> $(METADATA) # RHEL-7 + @echo "Bug: 1540004" >> $(METADATA) # RHEL-7 + @echo "Bug: 1542283" >> $(METADATA) # RHEL-7 + @echo "Bug: 1576730" >> $(METADATA) # RHEL-8 + @echo "Bug: 1588884" >> $(METADATA) # RHEL-7 + @echo "Bug: 1842897" >> $(METADATA) # RHEL-8 + @echo "Bug: 1896424" >> $(METADATA) # RHEL-8 + @echo "Bug: 1896595" >> $(METADATA) # RHEL-8 + @echo "Bug: 1899141" >> $(METADATA) # RHEL-8 + @echo "Bug: 1932752" >> $(METADATA) # RHEL-9 + @echo "Bug: 1951323" >> $(METADATA) # Fedora 33 + @echo "Bug: 1961728" >> $(METADATA) # RHEL-8 + @echo "Bug: 1965985" >> $(METADATA) # RHEL-8 + @echo "Bug: 1965989" >> $(METADATA) # RHEL-9 + @echo "Bug: 1965989" >> $(METADATA) # Fedora rawhide + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE b/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE new file mode 100644 index 0000000..dd2a012 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +Author: Milos Malik + +SELinux interferes with kdump and related programs. + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa new file mode 100644 index 0000000..a38bb9b --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEA724nX9GdCr5+gJTSgdn6QK+AhSdqlN0D++qqs6fGBn5YA1w1 +dGNtuMsL81HjKPIjK+tecFO9HRUSM1nsxg6z8zNzlVxvQYB8uTw3cZXKgorDI280 +6ESdU4oXDQqrUyZVRJmh2I58qMVn9TdeTwbnYFEbrnItq7NKQ9VobcF4T3w2aj61 +vSTLLx8IT9cfyTfQI9ELJ3RFTVzlyfMJ6x9PSyWPzeclsL9pR39rp5ZuZpOXY2Nm +1t3UiQcOurPS/1Y3lxUgZHadFnQyW/oIeQddIfKOollFqnKx/71YPq1RUcPcO/ba +y1IpM8tgpxXfkIWk7jB4N9zmVRI7QwDe+5NKBwIDAQABAoIBAQDAnqnmmEfzANXc +s922wZpmt8p5VQCVykkOPfgemHbjenlsGp6Wh/cZl6CBm/tYUZSiHLTZQUT/RJhj +35BwthtnKJlwK/EFjUzJ6Pvh0VQeOWxL8Ydq5Oh88LcistaqCkjG66IdCmSXkljU +Gjsw8Kjr/9R5PzomzBKPB/z/b4pOxlzAxUev2m7Gfb8UcCwnlMTq3udn6sexZ50V +bTX//tgpsUAMMzARKYk2v472qtmQuTa7rP9EIjKR8qVpv27tX0i80MFUSsOpL1E3 +kPSqqkKEXkCf1zCw14dF2d2JeiyW7ADka71m51ZMfn1POMdwWgpreeWUQphwC798 +KyrJ3RNhAoGBAPy1yUlE1Hs7+/6G3ndpf5lI5lU6aiaT12TVYi0cMWpFDjX0qA93 +Ew7HMFfkZpFwV54YYW1ZuoGG0l93voKsP8LWnSDLEoX+gBbkKHeyMHkzCTiVTlYN +rB7EtAxEe6kYlTbcYhpICA561ujxf+kn/uLhYZQ8iq70Z0kpiDGYwN19AoGBAPKM +HAq7xmxq8rCC65CBbneIJD8luK+XenDKkIj/OjjOp33odR4DAyNwUigu+DzZjdb4 +Xm2Mb3HofDzsRjPjEidQ9dx/rQoA4qKmXMLZI9qFMcFsqFkNwHToBYgrQU0XK+2G +DYIs1spu5TtqWspflcvos4oWM0EiTZs5y8TrnGzTAoGASWEn36Si5l3WoGPdOWNi +78mhSGI77JPFWbw0U9D58Fe49qXiHwt+dy4TtZHWzqiGaJu/vpbtdysE7z/ADAWk +Rhk3awxMhqgN3ZfGwGr3dFoDdXC1XHt/3TdU6LMCDWnb+iAoRGViIYI94Uou0C8S +7iJvyTGDO6YwT6hFqdEnP6kCgYB9LSA/zd8/DwcHX9nxL0tytzl1uaMSREw1r+Ve +PtKuhMDecz0WaxmQjaRpBqyowuK4ImChiwvtLr4Hty0YFEXHMrpgvSfx9LkClndj +PCuL2JfwKoLLyxQbga9xMlm2TpImOLv6Begoe4kk2+PVc/VcUlFun7x+DhUdWnu2 +up51bwKBgAfnx94dIgA8Z7P4Za8Cpp9FCMfUa4R+gNI+/0XLFAGR9Bd+c/61jMRd +OQjErru9Fq47kvE91GHfyS069gI+g7tsTcnPgAXiNhmhILe5O+blNuPPclQ9NMLG +4WII0I6nrbKMnvwCRw6Ikc2OiijPkmbI9VXwIMfbGxI77A4UGBp5 +-----END RSA PRIVATE KEY----- diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub new file mode 100644 index 0000000..7b2871f --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDvbidf0Z0Kvn6AlNKB2fpAr4CFJ2qU3QP76qqzp8YGflgDXDV0Y224ywvzUeMo8iMr615wU70dFRIzWezGDrPzM3OVXG9BgHy5PDdxlcqCisMjbzToRJ1TihcNCqtTJlVEmaHYjnyoxWf1N15PBudgURuuci2rs0pD1WhtwXhPfDZqPrW9JMsvHwhP1x/JN9Aj0QsndEVNXOXJ8wnrH09LJY/N5yWwv2lHf2unlm5mk5djY2bW3dSJBw66s9L/VjeXFSBkdp0WdDJb+gh5B10h8o6iWUWqcrH/vVg+rVFRw9w79trLUikzy2CnFd+QhaTuMHg33OZVEjtDAN77k0oH diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf new file mode 100644 index 0000000..9104410 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -0,0 +1,88 @@ +summary: SELinux interferes with kdump and related programs +description: |+ + SELinux interferes with kdump and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - expect + - /usr/sbin/service + - kexec-tools + - kdump-utils + - grubby + - libselinux + - libselinux-utils + - policycoreutils + - sed + - selinux-policy + - selinux-policy-mls + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - MLS + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - TipWaived7 + - failinfedora + - targeted + - NoRHIVOS + - rhel10_broken + - reboot +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533007 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533366 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=537088 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=540758 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=549503 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=618329 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=621061 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=753039 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=966203 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1055634 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1117368 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1117710 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1146491 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1288565 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1363977 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1375963 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1418441 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1431236 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1536690 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1540004 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1542283 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1576730 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1588884 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1842897 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1896424 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1896595 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899141 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932752 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951323 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961728 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965985 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965989 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934347 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=830822 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2236876 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0057470 +extra-summary: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +extra-task: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +id: 99e91f23-6d4d-4f52-b867-8420eaa39e03 diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp b/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp new file mode 100755 index 0000000..939b3a3 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp @@ -0,0 +1,17 @@ +#!/usr/bin/expect -f +# ./run.exp password param1 param2 param3 +set password [lrange $argv 0 0] +set param1 [lrange $argv 1 1] +set param2 [lrange $argv 2 2] +set param3 [lrange $argv 3 3] +set timeout 15 +spawn $param1 $param2 $param3 +expect { + "yes/no" { send -- "yes\r" } + eof +} +expect { + "assword" { send -- "$password\r" } + eof +} + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh new file mode 100755 index 0000000..3606222 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh @@ -0,0 +1,250 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +# Description: kdump service cannot be started because of SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +if ! grep crashkernel= /proc/cmdline ; then + grubby --update-kernel ALL --args crashkernel=512M + sync + tmt-reboot +fi + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-mls + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm kexec-tools + rlRun "uname -a" + rlRun "cat /proc/cmdline" + + rlFileBackup --clean /root/.ssh + rlFileBackup /etc/kdump.conf + rlFileBackup /etc/shadow + OUTPUT_FILE=`mktemp` + + if rlIsRHEL 6 ; then + rlRun "ls -l testpolicy.te" + rlRun "make -f /usr/share/selinux/devel/Makefile" + rlRun "ls -l testpolicy.pp" + rlRun "semodule -i testpolicy.pp" + fi + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#533007 + bz#533366 + bz#540758 + bz#549503 + bz#966203" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlRun "ls -Z /proc/kcore | grep :proc_kcore_t" + if rlIsRHEL 6 ; then + rlRun "seinfo -tkdump_t -x | grep mlsfileread" + fi + rlSESearchRule "allow kdump_t proc_kcore_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#537088" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t kdump_t : capability { sys_rawio }" + rlPhaseEnd + + rlPhaseStartTest "bz#618329" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + [ -e /sys/kernel/debug/boot_params/data ] && rlRun "ls -Z /sys/kernel/debug/boot_params/data | grep :debugfs_t" + rlSESearchRule "allow kdump_t user_devpts_t : chr_file { read write } [ allow_daemons_use_tty ]" + rlSESearchRule "allow kdump_t sysfs_t : dir { getattr read search }" + rlSESearchRule "allow kdump_t sysfs_t : file { getattr open read }" + rlSESearchRule "allow kdump_t debugfs_t : dir { getattr search }" + rlSESearchRule "allow kdump_t debugfs_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#621061" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t kernel_t : system { module_request }" + rlPhaseEnd + fi + + if rlIsRHEL 6 ; then + rlPhaseStartTest "bz#1288565 + bz#1431236" + rlSEMatchPathCon "/usr/sbin/bmc-watchdog" "freeipmi_bmc_watchdog_exec_t" + rlSEMatchPathCon "/var/lock/kdump" "kdump_lock_t" + # even though the context of /var/lock/kdump was corrected via restorecon before reboot + # after reboot the file was mislabeled (var_lock_t) again + rlSESearchRule "dontaudit freeipmi_bmc_watchdog_t var_lock_t : file { write }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1055634" # MLS + targeted + rlSEMatchPathCon "/usr/bin/kdumpctl" "kdumpctl_exec_t" + rlSEMatchPathCon "/var/lock" "var_lock_t" + rlSEMatchPathCon "/var/lock/kdump" "kdump_lock_t" + rlSESearchRule "allow kdumpctl_t var_lock_t : lnk_file { getattr read }" + rlSESearchRule "allow kdumpctl_t var_lock_t : dir { getattr open search read write add_name remove_name }" + rlRun "sesearch -s kdumpctl_t -t var_lock_t -c file -T | grep \"kdump_lock_t.*kdump\"" + rlSESearchRule "allow kdumpctl_t kdump_lock_t : file { getattr open create unlink }" + rlPhaseEnd + + rlPhaseStartTest "bz#1117368 + bz#1117710 + bz#1146491" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlRun "ls -Z /proc/kallsyms | grep :system_map_t" + rlSESearchRule "allow kdump_t system_map_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1363977" + rlSESearchRule "allow NetworkManager_t kdumpctl_t : dbus { send_msg }" + rlSESearchRule "allow kdumpctl_t NetworkManager_t : dbus { send_msg }" + rlPhaseEnd + + rlPhaseStartTest "bz#1375963 + bz#1418441" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t kdump_t : capability { sys_admin }" + rlPhaseEnd + + rlPhaseStartTest "bz#1390669" + rlSEMatchPathCon "/usr/bin/kdumpctl" "kdumpctl_exec_t" + if [ -f /sys/kernel/security/securelevel ] ; then + # the file is present on RHEL-7.5: kernel 3.10 + # the file is not present on RHEL-ALT-7.5: kernel 4.14 + rlRun "ls -Z /sys/kernel/security/securelevel | grep :security_t" + fi + rlSESearchRule "allow kdumpctl_t security_t : file { getattr open read } mls" + rlSESearchRule "allow kdumpctl_t security_t : file { getattr open read } targeted" + rlPhaseEnd + + rlPhaseStartTest "bz#1540004 + bz#1542283" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t kdump_t : capability2 { syslog }" + rlPhaseEnd + + rlPhaseStartTest "bz#1536690" + rlSESearchRule "allow kdump_t modules_object_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1576730 + bz#1588884" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSEMatchPathCon "/boot/initramfs-4.16.0-8.el8+5.s390xkdump.img" "boot_t" + rlSESearchRule "allow kdump_t boot_t : file { map }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1842897" + # relevant SELinux denials appear during the real scenario phases + rlSESearchRule "dontaudit NetworkManager_t kdumpctl_tmp_t : fifo_file { write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1896424 + bz#1896595 + bz#1899141" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t tmp_t : dir { write add_name remove_name } [ ]" + rlSESearchRule "allow kdump_t tmp_t : file { create unlink } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1951323 + bz#1961728 + bz#1965985 + bz#1965989" + # the directory belongs to the kexec-tools package + rlSEMatchPathCon "/var/lib/kdump" "kdump_var_lib_t" + rlSEMatchPathCon "/var/lib/kdump/initramfs-kernel-version.kdump.img" "kdump_var_lib_t" + rlSESearchRule "allow kdump_t kdump_var_lib_t : dir { getattr open search add_name remove_name read write } [ ]" + rlSESearchRule "allow kdump_t kdump_var_lib_t : file { getattr open read } [ ]" + rlSESearchRule "allow rpm_script_t kdump_var_lib_t : dir { getattr open search add_name remove_name read write } [ ]" + rlSESearchRule "allow rpm_script_t kdump_var_lib_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#2236876" + rlSESearchRule "allow kdump_t tmpfs_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition kdump_t tmpfs_t : file kdump_tmpfs_t" + rlSESearchRule "allow kdump_t kdump_tmpfs_t : file { read write } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlRun "sed -i \"s/^\(net.*\)$/# \1/\" /etc/kdump.conf" + rlRun "service kdump start 2>&1 | tee ${OUTPUT_FILE}" + rlRun "grep -i \"unable to gather efi data\" ${OUTPUT_FILE}" 1 + sleep 1 + rlRun "service kdump restart 2>&1 | tee ${OUTPUT_FILE}" + rlRun "grep -i \"unable to gather efi data\" ${OUTPUT_FILE}" 1 + sleep 1 + rlRun "service kdump stop" + sleep 1 + rlRun "grep \"kdump.*kexec.*loaded.*kernel\" /var/log/messages | tail -n 2" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#753039" + USER_NAME="root" + USER_SECRET="redhat" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "mkdir -p /root/.ssh" + rlRun "restorecon -Rv /root/.ssh" + rlRun "cp id_rsa /root/.ssh/" + rlRun "chmod 600 /root/.ssh/id_rsa" + rlRun "cat id_rsa.pub >> /root/.ssh/authorized_keys" + + if rlIsRHEL 5 6 ; then + rlRun "echo \"net ${USER_NAME}@${HOSTNAME}\" >> /etc/kdump.conf" + rlRun "./run.exp ${USER_SECRET} service kdump propagate" + else + rlRun "sed -i \"s/makedumpfile/makedumpfile -F/\" /etc/kdump.conf" + rlRun "echo \"ssh ${USER_NAME}@${HOSTNAME}\" >> /etc/kdump.conf" + rlRun "./run.exp ${USER_SECRET} kdumpctl propagate" + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c \"kdumpctl showmem\"" + fi + rlRun "service kdump restart" + sleep 1 + rlRun "grep \"kdump.*propagated ssh key\" /var/log/messages | tail -n 1" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + if rlIsRHEL 6 ; then + rlRun "semodule -r testpolicy" + rlRun "rm -f testpolicy.pp" + fi + + rm -f ${OUTPUT_FILE} + rlFileRestore + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te b/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te new file mode 100644 index 0000000..d90b338 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te @@ -0,0 +1,15 @@ +module testpolicy 1.0; + +require { + type user_tmp_t; + type setfiles_t; + type kdump_t; + class file write; +} + +#============= kdump_t ============== +allow kdump_t user_tmp_t:file write; + +#============= setfiles_t ============== +allow setfiles_t user_tmp_t:file write; + diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile new file mode 100644 index 0000000..ed51edc --- /dev/null +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile @@ -0,0 +1,88 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +# Description: some plymouth operations are denied during boot because of SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: some plymouth operations are denied during boot because of SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: plymouth" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5" >> $(METADATA) + @echo "Bug: 538089" >> $(METADATA) # RHEL-6 + @echo "Bug: 560611" >> $(METADATA) # RHEL-6 + @echo "Bug: 904016" >> $(METADATA) # RHEL-7 + @echo "Bug: 1045382" >> $(METADATA) # RHEL-7 + @echo "Bug: 1131195" >> $(METADATA) # RHEL-6 + @echo "Bug: 1160196" >> $(METADATA) # RHEL-7 + @echo "Bug: 1202429" >> $(METADATA) # Fedora 21 + @echo "Bug: 1517405" >> $(METADATA) # Fedora 27 + @echo "Bug: 1664143" >> $(METADATA) # Fedora 29 + @echo "Bug: 1869814" >> $(METADATA) # RHEL-8 + @echo "Bug: 1871307" >> $(METADATA) # RHEL-8 + @echo "Bug: 2184803" >> $(METADATA) # RHEL-9 + @echo "Bug: 2256442" >> $(METADATA) # Fedora 40 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE new file mode 100644 index 0000000..e16c39f --- /dev/null +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +Author: Milos Malik + +SELinux interferes with plymouth / plymouthd and related programs. + diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf new file mode 100644 index 0000000..6ce929e --- /dev/null +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf @@ -0,0 +1,59 @@ +summary: some plymouth operations are denied during boot because of SELinux +description: |+ + SELinux interferes with plymouth / plymouthd and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - /usr/sbin/service + - libselinux + - libselinux-utils + - plymouth + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - kernel-rt + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=538089 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560611 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=904016 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1045382 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1131195 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1160196 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1202429 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1517405 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1664143 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1869814 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1871307 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2184803 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2256442 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0057474 +extra-summary: /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +extra-task: /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +id: b3e914bb-2af2-4edb-9959-d20e81b2e7ce diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh new file mode 100755 index 0000000..e78bd69 --- /dev/null +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh @@ -0,0 +1,184 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +# Description: some plymouth operations are denied during boot because of SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/plymouthd" +FILE_CONTEXT="plymouthd_exec_t" +SERVICE_PACKAGE="plymouth" +SERVICE_NAME="plymouth-start" +PROCESS_NAME="plymouthd" +PROCESS_CONTEXT="plymouthd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#538089" + rlSEMatchPathCon "/bin/plymouth" "plymouth_exec_t" + rlSEMatchPathCon "/sbin/cryptsetup" "lvm_exec_t" + rlSEMatchPathCon "/dev/mapper/control" "lvm_control_t" + rlRun "ls -Z /proc/devices | grep :proc_t" + rlSESearchRule "allow plymouth_t lvm_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition plymouth_t lvm_exec_t : process lvm_t" + rlSESearchRule "allow plymouth_t lvm_t : process { transition }" + rlSESearchRule "allow lvm_t lvm_t : capability { ipc_lock }" + rlSESearchRule "allow lvm_t proc_t : file { getattr open read }" + rlSESearchRule "allow lvm_t lvm_control_t : chr_file { getattr open read write }" + rlPhaseEnd + + rlPhaseStartTest "bz#560611" + rlSEMatchPathCon "/bin/plymouth" "plymouth_exec_t" + rlRun "ls -Z /proc/cmdline | grep :proc_t" + rlSESearchRule "allow plymouth_t proc_t : file { getattr open read }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#904016" + rlSEMatchPathCon "/usr/sbin/plymouthd" "plymouthd_exec_t" + rlSEMatchPathCon "/var/log/boot.log" "plymouthd_var_log_t" + # when plymouthd runs as plymouthd_t + rlSESearchRule "allow plymouthd_t var_log_t : dir { write add_name }" + rlSESearchRule "type_transition plymouthd_t var_log_t : file plymouthd_var_log_t" + rlSESearchRule "allow plymouthd_t plymouthd_var_log_t : file { create }" + # when plymouthd runs as kernel_t + rlSESearchRule "allow kernel_t var_log_t : dir { write add_name }" + rlRun "sesearch -s kernel_t -t var_log_t -c file -T | grep 'plymouthd_var_log_t.*boot.log'" + rlSESearchRule "allow kernel_t plymouthd_var_log_t : file { create }" + rlPhaseEnd + + rlPhaseStartTest "bz#1045382" + rlSEMatchPathCon "/usr/sbin/plymouthd" "plymouthd_exec_t" + rlSEMatchPathCon "/var/run/udev" "udev_var_run_t" + rlSEMatchPathCon "/var/run/udev/queue.bin" "udev_var_run_t" + rlSESearchRule "allow plymouthd_t plymouthd_t : netlink_kobject_uevent_socket { create setopt bind getattr }" + rlSESearchRule "allow plymouthd_t udev_var_run_t : dir { search }" + rlSESearchRule "allow plymouthd_t udev_var_run_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1160196" + rlSEMatchPathCon "/usr/sbin/plymouthd" "plymouthd_exec_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/group" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + rlSESearchRule "allow plymouthd_t sssd_public_t : dir { getattr search open }" + rlSESearchRule "allow plymouthd_t sssd_public_t : file { getattr open read }" + rlSESearchRule "allow plymouthd_t sssd_var_lib_t : dir { getattr search open }" + rlSESearchRule "allow plymouthd_t sssd_var_lib_t : sock_file { write getattr append open }" + rlPhaseEnd + fi + + if rlIsRHEL 6 ; then + rlPhaseStartTest "bz#1131195" + rlSEMatchPathCon "/var/spool/plymouth/boot.log" "plymouthd_spool_t" + rlSESearchRule "allow xdm_t plymouthd_spool_t : file { getattr }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1202429" + rlSEMatchPathCon "/dev/ttyUSB0" "usbtty_device_t" + rlSESearchRule "allow plymouthd_t usbtty_device_t : chr_file { read write } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1517405" + rlSEMatchPathCon "/dev/fb0" "framebuf_device_t" + rlSESearchRule "allow plymouthd_t framebuf_device_t : chr_file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1664143" + rlSEMatchPathCon "/sys/firmware/efi/efivars" "efivarfs_t" + rlSESearchRule "allow plymouthd_t efivarfs_t : dir { getattr open search } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1869814 + bz#1871307" + rlSESearchRule "allow plymouthd_t plymouthd_t : capability { sys_chroot } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL "<9.3" ; then + rlPhaseStartTest "bz#2184803" + rlSESearchRule "allow plymouthd_t plymouthd_t : capability2 { bpf } [ ]" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#2256442" + rlSEMatchPathCon "/dev/kmsg" "kmsg_device_t" + rlSESearchRule "allow plymouthd_t kmsg_device_t : chr_file { open read write } [ ]" + rlSESearchRule "allow plymouthd_t kernel_t : system { syslog_read } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile b/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile new file mode 100644 index 0000000..d0987e4 --- /dev/null +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile @@ -0,0 +1,100 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +# Description: some named files in chroot-ed environment have wrong SELinux labels +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: some named files in chroot-ed environment have wrong SELinux labels" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 2h" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: bind" >> $(METADATA) + @echo "Requires: bind-chroot" >> $(METADATA) + @echo "Requires: caching-nameserver" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: procps" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 451970" >> $(METADATA) # RHEL-5 + @echo "Bug: 562833" >> $(METADATA) # RHEL-5 + @echo "Bug: 578187" >> $(METADATA) # RHEL-5 + @echo "Bug: 698257" >> $(METADATA) # RHEL-5 + @echo "Bug: 739886" >> $(METADATA) # RHEL-6 + @echo "Bug: 843732" >> $(METADATA) # RHEL-6 + @echo "Bug: 859231" >> $(METADATA) # RHEL-6 + @echo "Bug: 916173" >> $(METADATA) # RHEL-7 + @echo "Bug: 1012051" >> $(METADATA) # RHEL-7 + @echo "Bug: 1103439" >> $(METADATA) # RHEL-6 + @echo "Bug: 1110397" >> $(METADATA) # RHEL-6 + @echo "Bug: 1166281" >> $(METADATA) # RHEL-7 + @echo "Bug: 1199473" >> $(METADATA) # RHEL-7 + @echo "Bug: 1312972" >> $(METADATA) # RHEL-7 + @echo "Bug: 1683754" >> $(METADATA) # RHEL-7 + @echo "Bug: 1759505" >> $(METADATA) # RHEL-8 + @echo "Bug: 1827591" >> $(METADATA) # Fedora 30 + @echo "Bug: 1923929" >> $(METADATA) # RHEL-9 + @echo "Bug: 2223725" >> $(METADATA) # Fedora 39 + @echo "Bug: 2224352" >> $(METADATA) # Fedora 38 + @echo "Bug: 2226703" >> $(METADATA) # Fedora 38 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE b/selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE new file mode 100644 index 0000000..5c1c31b --- /dev/null +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +Author: Milos Malik + +SELinux interferes with named and related programs. + diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf new file mode 100644 index 0000000..3228e5d --- /dev/null +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf @@ -0,0 +1,68 @@ +summary: some named files in chroot-ed environment have wrong SELinux labels +description: |+ + SELinux interferes with named and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - bind + - bind-chroot + - caching-nameserver + - grep + - /usr/sbin/service + - libselinux + - libselinux-utils + - policycoreutils + - procps + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 2h +enabled: true +tag: + - NoRHEL4 + - TierCandidatesPASS + - f32friendly + - targeted + - NoRHIVOS + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=451970 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=562833 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=578187 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=698257 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739886 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=843732 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=859231 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=916173 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1012051 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1103439 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1110397 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1166281 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1199473 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1312972 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1683754 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1759505 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1827591 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1923929 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2223725 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2224352 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2226703 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0057489 +extra-summary: /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +extra-task: /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +id: dc594e14-f692-4537-9553-ce6aeab1a0cc diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh new file mode 100755 index 0000000..7df24ef --- /dev/null +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh @@ -0,0 +1,256 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +# Description: some named files in chroot-ed environment have wrong SELinux labels +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qa | grep bind | sort" + + rlServiceStop ` rlSEListServices 53 ` + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#451970" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" + rlSESearchRule "allow named_t port_t : udp_socket { name_bind }" + rlPhaseEnd + + rlPhaseStartTest "bz#562833" + if rlIsRHEL ">=11.0" || rlIsCentOS ">=11.0" || rlIsFedora ">=45" ; then + for PREFIX in "" "/var/named/chroot" ; do + rlSEMatchPathCon "${PREFIX}/dev/null" "null_device_t" + rlSEMatchPathCon "${PREFIX}/dev/random" "random_device_t" + rlSEMatchPathCon "${PREFIX}/dev/zero" "zero_device_t" + rlSEMatchPathCon "${PREFIX}/etc/named.conf" "named_conf_t" + rlSEMatchPathCon "${PREFIX}/run/named" "named_var_run_t" + rlSEMatchPathCon "${PREFIX}/var/log" "var_log_t" + rlSEMatchPathCon "${PREFIX}/var/log/named.log" "named_log_t" + rlSEMatchPathCon "${PREFIX}/var/named/data" "named_cache_t" + rlSEMatchPathCon "${PREFIX}/var/named/slaves" "named_cache_t" + rlSEMatchPathCon "${PREFIX}/var/named" "named_cache_t" + done + else + for PREFIX in "" "/var/named/chroot" ; do + rlSEMatchPathCon "${PREFIX}/dev/null" "null_device_t" + rlSEMatchPathCon "${PREFIX}/dev/random" "random_device_t" + rlSEMatchPathCon "${PREFIX}/dev/zero" "zero_device_t" + rlSEMatchPathCon "${PREFIX}/etc/named.conf" "named_conf_t" + rlSEMatchPathCon "${PREFIX}/run/named" "named_var_run_t" + rlSEMatchPathCon "${PREFIX}/var/log" "var_log_t" + rlSEMatchPathCon "${PREFIX}/var/log/named.log" "named_log_t" + rlSEMatchPathCon "${PREFIX}/var/named/data" "named_cache_t" + rlSEMatchPathCon "${PREFIX}/var/named/slaves" "named_cache_t" + rlSEMatchPathCon "${PREFIX}/var/named" "named_zone_t" + done + fi + rlPhaseEnd + + rlPhaseStartTest "bz#578187" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" + for PREFIX in "" "/var/named/chroot" ; do + rlSEMatchPathCon "${PREFIX}/var/named/dynamic" "named_cache_t" + done + rlSESearchRule "allow named_t named_t : process { getcap setcap getsched setsched setrlimit }" + rlPhaseEnd + + rlPhaseStartTest "bz#698257" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" + if rlIsRHEL 5 ; then + rlSEMatchPathCon "/var/named/chroot/var/log/update-debug.log" "named_log_t" + fi + rlSESearchRule "allow named_t named_log_t : file { append }" + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#739886" + rlSEMatchPathCon "$(readlink -en /usr/sbin/rndc)" "ndc_exec_t" + rlRun "ls -Z /proc/loadavg | grep :proc_t" + rlSESearchRule "allow ndc_t proc_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#843732 + bz#916173" + for PREFIX in "" "/var/named/chroot" ; do + rlSEMatchPathCon "${PREFIX}/lib" "lib_t" + rlSEMatchPathCon "${PREFIX}/lib64" "lib_t" + rlSEMatchPathCon "${PREFIX}/usr/lib" "lib_t" + rlSEMatchPathCon "${PREFIX}/usr/lib64" "lib_t" + done + rlSEMatchPathCon "/var/named/chroot/etc/localtime" "locale_t" + rlPhaseEnd + + rlPhaseStartTest "bz#1110397 + bz#1166281" + rlSEMatchPathCon "$(readlink -en /usr/sbin/rndc)" "ndc_exec_t" + rlSEMatchPathCon "/dev/random" "random_device_t" + rlSEMatchPathCon "/dev/urandom" "urandom_device_t" + rlSESearchRule "allow ndc_t random_device_t : chr_file { getattr open read }" + rlSESearchRule "allow ndc_t urandom_device_t : chr_file { getattr open read }" + rlPhaseEnd + fi + + if rlIsRHEL 6 ; then + rlPhaseStartTest "bz#859231" + rlSEMatchPathCon "/var/tmp/DNS_25" "named_tmp_t" + rlPhaseEnd + + rlPhaseStartTest "bz#1103439 + bz#1199473" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" + rlSEMatchPortCon udp 1935 flash_port_t + rlSEMatchPortCon udp 2605 bgp_port_t + rlSEMatchPortCon udp 4321 whois_port_t + rlSEMatchPortCon udp 6514 syslogd_port_t + rlSEMatchPortCon udp 8610 ipp_port_t + rlSEMatchPortCon udp 8611 ipp_port_t + rlSEMatchPortCon udp 8612 ipp_port_t + rlSEMatchPortCon udp 8613 ipp_port_t + rlSEMatchPortCon udp 8614 ipp_port_t + rlSESearchRule "dontaudit named_t flash_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t ipp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t syslogd_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t whois_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t bgp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t reserved_port_t : udp_socket { name_bind } [ ]" 1 + rlSESearchRule "allow named_t hi_reserved_port_t : udp_socket { name_bind } [ ]" 1 + rlSESearchRule "dontaudit named_t reserved_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t hi_reserved_port_t : udp_socket { name_bind } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1012051" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" + rlSESearchRule "allow named_t named_t : key { read write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1312972" + rlSEMatchPortCon udp 1935 flash_port_t + rlSEMatchPortCon udp 2605 bgp_port_t + rlSEMatchPortCon udp 4321 whois_port_t + rlSEMatchPortCon udp 4444 kerberos_port_t + rlSEMatchPortCon udp 5546 dhcpc_port_t + if rlIsRHEL 7 ; then + rlSEMatchPortCon udp 61000 ephemeral_port_t + else # RHEL-8 and Fedora + rlSEMatchPortCon udp 60999 ephemeral_port_t + fi + rlSEMatchPortCon udp 8554 rtsp_port_t + rlSEMatchPortCon udp 8610 ipp_port_t + rlSEMatchPortCon udp 8611 ipp_port_t + rlSEMatchPortCon udp 8612 ipp_port_t + rlSEMatchPortCon udp 8613 ipp_port_t + rlSEMatchPortCon udp 8614 ipp_port_t + rlSESearchRule "allow named_t bgp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t dhcpc_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t ephemeral_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t flash_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t ipp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t kerberos_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t rtsp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t whois_port_t : udp_socket { name_bind } [ ]" + COUNT=`seinfo --portcon | cut -d : -f 3 | sort | uniq | wc -l` + rlLog "Number of defined SELinux ports which have at least 1 port number assigned is $COUNT" + for PORT_TYPE in `seinfo --portcon | cut -d : -f 3 | sort | uniq` ; do + if rlIsRHEL 5 6 7 ; then + sesearch -s named_t -t ${PORT_TYPE} -c udp_socket -p name_bind -A -C -D | grep -v '\]' | grep -q -e allow -e dontaudit + else + sesearch -s named_t -t ${PORT_TYPE} -c udp_socket -p name_bind -A --dontaudit | grep -v '\]' | grep -q -e allow -e dontaudit + fi + if [ $? -eq 1 ] ; then + rlFail "named_t access to ${PORT_TYPE}:udp_socket via name_bind operation is neither allowed nor dontaudited" + fi + done + rlLog "all $COUNT defined SELinux ports tested" + rlPhaseEnd + + rlPhaseStartTest "bz#1683754" + rlRun "ls -dZ /proc/sys/net | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv4 | grep :sysctl_net_t" + rlRun "ls -Z /proc/sys/net/ipv4/ip_local_port_range | grep :sysctl_net_t" + rlSESearchRule "allow named_t sysctl_net_t : dir { getattr open search } [ ]" + rlSESearchRule "allow named_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1759505" + rlSEMatchPathCon "/etc/named" "named_conf_t" + rlSEMatchPathCon "/etc/named/test.conf" "named_conf_t" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then + rlPhaseStartTest "bz#1827591 + bz#1923929" + rlSEMatchPathCon "$(readlink -en /usr/sbin/rndc)" "ndc_exec_t" + rlSESearchRule "dontaudit ndc_t ndc_t : process { setsched } [ ]" + rlPhaseEnd + fi + + if rlIsFedora '>=38' ; then + rlPhaseStartTest "bz#2223725 + bz#2224352 + bz#2226703" + rlSESearchRule "allow named_t named_t : io_uring { sqpoll } [ ]" + rlSESearchRule "allow ndc_t ndc_t : io_uring { sqpoll } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + if ! rlIsRHEL 5 ; then + rlRun "semodule -l | grep bind" + fi + rlRun "getsebool -a | grep named" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlSEService ${ROOT_PASSWORD} named named named_t "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc querylog'" + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc dumpdb'" + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc tsig-list'" + rlSEService ${ROOT_PASSWORD} named named named_t "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ` rlSEListServices 53 ` + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/bz624405-pcsc-and-similar/Makefile b/selinux-policy/bz624405-pcsc-and-similar/Makefile new file mode 100644 index 0000000..18528c2 --- /dev/null +++ b/selinux-policy/bz624405-pcsc-and-similar/Makefile @@ -0,0 +1,95 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +# Description: SELinux interferes with pcscd +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with pcscd" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: pcsc-lite" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: expect" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: initscripts" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: pcsc-lite" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: procps" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-mls" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Architectures: i386 ia64 ppc ppc64 x86_64" >> $(METADATA) + @echo "Bug: 624405" >> $(METADATA) # RHEL-6 + @echo "Bug: 752453" >> $(METADATA) # RHEL-6 + @echo "Bug: 1605641" >> $(METADATA) # RHEL-7 + @echo "Bug: 1802423" >> $(METADATA) # Fedora 32 + @echo "Bug: 1805719" >> $(METADATA) # Fedora 32 + @echo "Bug: 1806129" >> $(METADATA) # Fedora 32 + @echo "Bug: 1816787" >> $(METADATA) # Fedora 32 + @echo "Bug: 1818759" >> $(METADATA) # Fedora 32 + @echo "Bug: 1825182" >> $(METADATA) # Fedora 32 + @echo "Bug: 1825188" >> $(METADATA) # Fedora 32 + @echo "Bug: 2355930" >> $(METADATA) # Fedora 43 + @echo "Bug: 2356058" >> $(METADATA) # Fedora 43 + @echo "Bug: 2357154" >> $(METADATA) # Fedora 43 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz624405-pcsc-and-similar/PURPOSE b/selinux-policy/bz624405-pcsc-and-similar/PURPOSE new file mode 100644 index 0000000..c9c36f2 --- /dev/null +++ b/selinux-policy/bz624405-pcsc-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +Author: Milos Malik + +SELinux interferes with pcscd and related programs. + diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf new file mode 100644 index 0000000..eccec8d --- /dev/null +++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf @@ -0,0 +1,65 @@ +summary: SELinux interferes with pcscd +description: |+ + SELinux interferes with pcscd and related programs. + +contact: Milos Malik +component: + - pcsc-lite + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - expect + - grep + - /usr/sbin/service + - libselinux + - libselinux-utils + - pcsc-lite + - policycoreutils + - procps + - selinux-policy + - selinux-policy-mls + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=624405 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=752453 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1605641 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1802423 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1805719 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1806129 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1816787 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1818759 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825182 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825188 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2355930 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2356058 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2357154 +adjust+: + - enabled: false + when: arch == s390, s390x + continue: false + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0057525 +extra-summary: /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +extra-task: /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +id: 43cb4c7e-4e58-4b9b-82ea-8c9438ee0030 diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh new file mode 100755 index 0000000..c202480 --- /dev/null +++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh @@ -0,0 +1,123 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +# Description: SELinux interferes with pcscd +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_NAME="pcscd" +PROCESS_CONTEXT="pcscd_t" +PROCESS_NAME="pcscd" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-mls + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm pcsc-lite + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#624405" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + if rlIsRHEL 5 ; then + rlRun "ls -dZ /sys | grep :sysfs_t" + rlRun "ls -dZ /sys/devices | grep :sysfs_t" + rlSESearchRule "allow pcscd_t sysfs_t : dir { getattr search }" + else + rlSEMatchPathCon "/sys" "sysfs_t" + rlSEMatchPathCon "/sys/devices" "sysfs_t" + rlSESearchRule "allow pcscd_t sysfs_t : dir { getattr open read search }" + rlSESearchRule "allow pcscd_t sysfs_t : file { getattr open read }" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#752453" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + rlSESearchRule "allow pcscd_t usb_device_t : chr_file { getattr read write }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1605641" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + rlSESearchRule "dontaudit pcscd_t pcscd_t : capability { sys_admin }" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#1806129 + bz#1816787 + bz#1818759 + bz#1825182 + bz#1825188" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + rlSESearchRule "dontaudit pcscd_t pcscd_t : capability { sys_nice } [ daemons_dontaudit_scheduling ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1802423 + bz#1805719" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + rlSESearchRule "dontaudit pcscd_t pcscd_t : process { setsched } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2355930 + bz#2356058 + bz#2357154" + rlSESearchRule "allow init_t pcscd_t : process2 { nnp_transition } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- bz#624405" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/bz733494-amanda-and-similar/Makefile b/selinux-policy/bz733494-amanda-and-similar/Makefile new file mode 100644 index 0000000..695123f --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/Makefile @@ -0,0 +1,96 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +# Description: SELinux interferes with amanda and related tools +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE krb5.conf krb5.keytab + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with amanda and related tools" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: amanda" >> $(METADATA) + @echo "Requires: amanda" >> $(METADATA) + @echo "Requires: amanda-client" >> $(METADATA) + @echo "Requires: amanda-server" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: initscripts" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: nc" >> $(METADATA) + @echo "Requires: net-tools" >> $(METADATA) + @echo "Requires: nmap-ncat" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: procps-ng" >> $(METADATA) + @echo "Requires: krb5-workstation" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "Requires: xinetd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 283971" >> $(METADATA) # RHEL-5 + @echo "Bug: 498596" >> $(METADATA) # RHEL-5 + @echo "Bug: 729361" >> $(METADATA) # RHEL-6 + @echo "Bug: 733494" >> $(METADATA) # RHEL-6 + @echo "Bug: 965140" >> $(METADATA) # RHEL-7 + @echo "Bug: 1371561" >> $(METADATA) # RHEL-7 + @echo "Bug: 1452444" >> $(METADATA) # RHEL-7 + @echo "Bug: 1623052" >> $(METADATA) # RHEL-7 + @echo "Bug: 1630963" >> $(METADATA) # RHEL-7 + @echo "Bug: 1739137" >> $(METADATA) # RHEL-8 + @echo "Bug: 1960513" >> $(METADATA) # Fedora 34 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz733494-amanda-and-similar/PURPOSE b/selinux-policy/bz733494-amanda-and-similar/PURPOSE new file mode 100644 index 0000000..f6d2f5d --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +Author: Milos Malik + +SELinux interferes with amandad and related programs. + diff --git a/selinux-policy/bz733494-amanda-and-similar/krb5.conf b/selinux-policy/bz733494-amanda-and-similar/krb5.conf new file mode 100644 index 0000000..981c0de --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/krb5.conf @@ -0,0 +1,27 @@ +# Configuration snippets may be placed in this directory as well +includedir /etc/krb5.conf.d/ + +[logging] + default = FILE:/var/log/krb5libs.log + kdc = FILE:/var/log/krb5kdc.log + admin_server = FILE:/var/log/kadmind.log + +[libdefaults] + dns_lookup_realm = false + ticket_lifetime = 24h + renew_lifetime = 7d + forwardable = true + rdns = false + pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt + default_realm = EXAMPLE.COM + default_ccache_name = KEYRING:persistent:%{uid} + +[realms] + EXAMPLE.COM = { + kdc = kerberos.example.com + admin_server = kerberos.example.com + } + +[domain_realm] + .example.com = EXAMPLE.COM + example.com = EXAMPLE.COM diff --git a/selinux-policy/bz733494-amanda-and-similar/krb5.keytab b/selinux-policy/bz733494-amanda-and-similar/krb5.keytab new file mode 100644 index 0000000..c820713 Binary files /dev/null and b/selinux-policy/bz733494-amanda-and-similar/krb5.keytab differ diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf new file mode 100644 index 0000000..fe87add --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -0,0 +1,66 @@ +summary: SELinux interferes with amanda and related tools +description: |+ + SELinux interferes with amandad and related programs. + +contact: Milos Malik +component: + - amanda + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - amanda + - amanda-client + - amanda-server + - audit + - initscripts + - libselinux + - libselinux-utils + - nc + - net-tools + - nmap-ncat + - policycoreutils + - procps-ng + - krb5-workstation + - selinux-policy + - selinux-policy-targeted + - setools-console + - xinetd +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - TierCandidatesFAIL + - f32friendly + - rhel9-buildroot + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=283971 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=498596 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=729361 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=733494 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=965140 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1371561 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1452444 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1623052 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1630963 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1739137 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1960513 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1065002 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1572696 +adjust+: + - enabled: false + when: distro >= rhel-9 + because: the amanda package is not available there + - enabled: false + when: distro >= centos-stream-9 + because: the amanda package is not available there +extra-nitrate: TC#0114575 +extra-summary: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +extra-task: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +id: d3191af0-4b52-47b8-90bf-fa6fbf3edc47 diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh new file mode 100755 index 0000000..10c06e4 --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -0,0 +1,275 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +# Description: SELinux interferes with amanda and related tools +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/lib/amanda/amandad" +FILE_CONTEXT="amanda_inetd_exec_t" +SERVICE_NAME="amanda" +PROCESS_NAME="amandad" +PROCESS_CONTEXT="amanda_t" + +rlJournalStart + if rlIsRHEL && ! rlIsRHEL 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm amanda + rlAssertRpm amanda-client + rlAssertRpm amanda-server + + if rlIsRHEL 5 6 ; then + rlServiceStop xinetd + fi + rlFileBackup /etc/shadow + rlFileBackup /etc/krb5.conf + rlFileBackup /etc/krb5.keytab + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#283971" + # META-Fixed-In: selinux-policy-2.4.6-91.el5 + if ! rlIsRHEL 5 ; then + rlSEMatchPathCon "/usr/sbin/amandad" "bin_t" + fi + rlSEMatchPathCon "/usr/lib/amanda/amandad" "amanda_inetd_exec_t" + rlSEMatchPortCon "tcp" "389" "ldap_port_t" + if ! rlIsRHEL 7 ; then + rlSESearchRule "allow amanda_t ldap_port_t : tcp_socket { name_connect }" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#498596" + # META-Fixed-In: selinux-policy-2.4.6-230.el5 + rlSEMatchPathCon "/usr/lib/amanda/killpgrp" "amanda_exec_t" + rlSESearchRule "allow amanda_t fsadm_t : process { signal }" + rlPhaseEnd + + if rlIsRHEL 6 ; then + rlPhaseStartTest "bz#729361" + rlSEMatchPathCon "/bin/mailx" "sendmail_exec_t" + rlSEMatchPathCon "/var/lib/amanda/Data/amdump" "amanda_data_t" + rlSEMatchPathCon "/var/lib/amanda/Data/log" "amanda_log_t" + rlSESearchRule "allow sendmail_t amanda_var_lib_t : file { getattr open append }" + # FIXME: based on known AVCs there is a problem with initrc_tmp_t file + rlPhaseEnd + fi + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#733494" + # META-Fixed-In: selinux-policy-3.7.19-109.el6 + rlSESearchRule "allow amanda_t amanda_t : process { setsched }" + rlSESearchRule "allow amanda_t amanda_data_t : lnk_file { create unlink }" + rlSESearchRule "allow amanda_t amanda_data_t : dir { add_name remove_name create rmdir write }" + # FIXME: dontaudit rules for getattr operations on directories in /proc are missing + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1371561" + rlSEMatchPathCon "/var/lib" "var_lib_t" + rlSEMatchPathCon "/var/lib/amanda" "amanda_var_lib_t" + rlSESearchRule "allow amanda_t var_lib_t : dir { add_name write }" + rlSESearchRule "allow amanda_t amanda_t : capability { sys_admin }" + rlSESearchRule "type_transition amanda_t var_lib_t : dir amanda_var_lib_t" + rlSESearchRule "allow amanda_t amanda_var_lib_t : dir { create setattr }" + rlSESearchRule "allow amanda_t amanda_var_lib_t : file { create setattr write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1452444" + rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" + rlSEMatchPathCon "/dev/shm" "tmpfs_t" + rlSESearchRule "type_transition amanda_t tmpfs_t : dir amanda_tmpfs_t" + rlSESearchRule "type_transition amanda_t tmpfs_t : file amanda_tmpfs_t" + rlSESearchRule "allow amanda_t tmpfs_t : filesystem { getattr }" + rlSESearchRule "allow amanda_t tmpfs_t : dir { read write add_name remove_name }" + rlSESearchRule "allow amanda_t amanda_tmpfs_t : dir { getattr open read write search add_name remove_name }" + rlSESearchRule "allow amanda_t amanda_tmpfs_t : file { getattr open read write create link unlink }" + rlSESearchRule "allow amanda_t amanda_t : capability { setgid }" + rlSESearchRule "allow amanda_t proc_net_t : file { getattr open read }" + rlPhaseEnd + fi + + if false ; then + rlPhaseStartTest "bz#1623052" + rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" + rlSEMatchPathCon "/var/tmp/host_0" "krb5_host_rcache_t" + rlSESearchRule "allow amanda_t krb5_host_rcache_t : file { write unlink } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#965140" + if rlIsRHEL 5 ; then + SOURCE_TYPE="inetd_t" # xinetd runs the process + BOOLEANS="[ amanda_disable_trans ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="inetd_t" # xinetd runs the process + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/usr/sbin/prelink" "prelink_exec_t" + rlSEMatchPathCon "/usr/lib/amanda/*" "amanda_exec_t" + rlSEMatchPathCon "/usr/lib64/amanda/*" "amanda_exec_t" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" + rlSESearchRule "allow prelink_t amanda_exec_t : file { getattr }" + rlSESearchRule "allow setroubleshootd_t amanda_exec_t : file { getattr }" + rlSESearchRule "allow unconfined_t amanda_exec_t : file { getattr }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1630963" + rlSESearchRule "allow amanda_t amanda_tmpfs_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1739137" + # xfsdump is executed from amanda_t and stays in amanda_t + rlSEMatchPathCon "/usr/sbin/xfsdump" "bin_t" + rlSEMatchPathCon "/dev/random" "random_device_t" + rlSEMatchPathCon "/var/lib/xfsdump" "var_lib_t" + rlSEMatchPathCon "/var/lib/xfsdump/inventory" "amanda_var_lib_t" + rlSEMatchPathCon "/var/lib/xfsdump/inventory/1fa2bf89-02c1-4bba-bc3d-a265cbd5eff2.InvIndex" "amanda_var_lib_t" + rlSESearchRule "allow amanda_t random_device_t : chr_file { getattr open read } [ ]" + rlSESearchRule "allow amanda_t amanda_var_lib_t : file { create write setattr } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then + rlPhaseStartTest "bz#1960513" + rlRun "ls -l /usr/sbin/amandad" + rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" + rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t" + rlSESearchRule "allow amanda_t cgroup_t : filesystem { getattr } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "real scenario -- amanda-udp" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "systemctl enable amanda-udp.socket" + rlRun "systemctl start amanda-udp.socket" + rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "restart status stop status" 1 + rlRun "systemctl stop amanda-udp.socket" + rlRun "systemctl disable amanda-udp.socket" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- kamanda" + rlRun "rm -f /etc/krb5.conf /etc/krb5.keytab" + FQDN=`hostname -f` + rlRun 'echo -en "read_kt krb5.keytab\nclear\nadd_entry -password -p host/${FQDN}@EXAMPLE.COM -k 2 -e aes128-cts-hmac-sha1-96\nblahblah\nwrite_kt krb5.keytab\nl\nq\n" | ktutil' + rlRun "cp krb5.conf krb5.keytab /etc" + rlRun "restorecon -Rv /etc" + PORT_NUMBER="10082" + HOST_ADDRESS="127.0.0.1" + rlRun "systemctl enable kamanda.socket" + rlRun "systemctl start kamanda.socket" + rlLog "starting provocateur job" + ( tail -f - | ncat ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + sleep 1 + rlRun "netstat -tupan | grep :${PORT_NUMBER}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 + rlRun "systemctl stop kamanda.socket" + rlRun "systemctl disable kamanda.socket" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlPhaseStartTest "real scenario -- xinetd service" + HOST_ADDRESS="127.0.0.1" + PORT_NUMBER="10080" # number or socket path + if rlIsRHEL 5 6 ; then + PORT_TYPE="-u" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) + rlRun "chkconfig ${SERVICE_NAME} on" + rlRun "service xinetd restart" + rlLog "starting provocateur job" + ( echo | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + else + PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + rlLog "starting provocateur job" + ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + fi + sleep 1 + rlRun "netstat -tupan | grep :${PORT_NUMBER}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} off" + rlRun "service xinetd stop" + else + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + fi + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + if rlIsRHEL 5 6 ; then + rlServiceRestore xinetd + fi + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/caddy-and-similar/Makefile b/selinux-policy/caddy-and-similar/Makefile new file mode 100644 index 0000000..30ed418 --- /dev/null +++ b/selinux-policy/caddy-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/caddy-and-similar +# Description: SELinux interferes with caddy services and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/caddy-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with caddy services and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console caddy /usr/sbin/semanage" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL10" >> $(METADATA) + @echo "Bug: 1706651" >> $(METADATA) # Fedora 30 + @echo "Bug: 2122886" >> $(METADATA) # Fedora 36 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/caddy-and-similar/PURPOSE b/selinux-policy/caddy-and-similar/PURPOSE new file mode 100644 index 0000000..b87aa22 --- /dev/null +++ b/selinux-policy/caddy-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/caddy-and-similar +Author: Milos Malik + +Description: SELinux interferes with caddy services and related programs + diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf new file mode 100644 index 0000000..b6fe343 --- /dev/null +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -0,0 +1,44 @@ +summary: SELinux interferes with caddy services and related programs +description: |+ + SELinux interferes with caddy services and related programs + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - caddy + - /usr/sbin/semanage +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - failinfedora + - targeted + - epel + - rhel8-epel + - rhel9-epel + - NoRHIVOS + - avoidImageMode +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, centos-stream-10, rhel-10 + because: the caddy package is not available there +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1706651 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2122886 +extra-summary: /CoreOS/selinux-policy/Regression/caddy-and-similar +extra-task: /CoreOS/selinux-policy/Regression/caddy-and-similar +extra-nitrate: TC#0614303 +id: 31fd828a-6d5a-4977-af70-b751ec50366e diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh new file mode 100755 index 0000000..b970b6a --- /dev/null +++ b/selinux-policy/caddy-and-similar/runtest.sh @@ -0,0 +1,91 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/caddy-and-similar +# Description: SELinux interferes with caddy services and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="caddy" +PROCESS_NAME="caddy" +PROCESS_CONTEXT="httpd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi + + rlServiceStop caddy caddy-api + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1706651" + rlSEMatchPathCon "/usr/bin/caddy" "httpd_exec_t" + rlSEMatchPathCon "/var/lib/caddy" "httpd_var_lib_t" + rlSESearchRule "allow init_t httpd_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition init_t httpd_exec_t : process httpd_t [ ]" + rlSESearchRule "allow init_t httpd_t : process { transition } [ ]" + rlSESearchRule "allow init_t httpd_var_lib_t : dir { mounton } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2122886" + rlSEMatchPathCon "/usr/bin/caddy" "httpd_exec_t" + rlRun "ls -Z /proc/sys/net/core/somaxconn | grep :sysctl_net_t" + rlSESearchRule "allow httpd_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + + if ls /usr/lib/systemd/system/caddy*.service ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "semanage fcontext -l -C | grep caddy" + for SERVICE_NAME in caddy caddy-api ; do + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + done + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore caddy caddy-api + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/capability2-class/Makefile b/selinux-policy/capability2-class/Makefile new file mode 100644 index 0000000..aa75e64 --- /dev/null +++ b/selinux-policy/capability2-class/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/capability2-class +# Description: Does SELinux policy define new capabilities in capability2 class? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/capability2-class +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does SELinux policy define new capabilities in capability2 class?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit git libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 1915264" >> $(METADATA) # Fedora rawhide + + rhts-lint $(METADATA) + diff --git a/selinux-policy/capability2-class/PURPOSE b/selinux-policy/capability2-class/PURPOSE new file mode 100644 index 0000000..c18e355 --- /dev/null +++ b/selinux-policy/capability2-class/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/capability2-class +Author: Milos Malik + +Description: Does SELinux policy define new capabilities in capability2 class? + diff --git a/selinux-policy/capability2-class/main.fmf b/selinux-policy/capability2-class/main.fmf new file mode 100644 index 0000000..a53e8a0 --- /dev/null +++ b/selinux-policy/capability2-class/main.fmf @@ -0,0 +1,33 @@ +path: /selinux-policy/capability2-class +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - git + - libselinux + - libselinux-utils + - policycoreutils + - setools-console + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915264 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + continue: false +extra-nitrate: TC#0615396 +id: 251fd08a-0f65-4592-8d4d-2b79e9479460 +tag: + - NoRHIVOS diff --git a/selinux-policy/capability2-class/runtest.sh b/selinux-policy/capability2-class/runtest.sh new file mode 100755 index 0000000..73e7d37 --- /dev/null +++ b/selinux-policy/capability2-class/runtest.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/capability2-class +# Description: Does SELinux policy define new capabilities in capability2 class? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1915264" + rlRun "seinfo --common cap2 -x" + for CAPABILITY in perfmon bpf checkpoint_restore ; do + rlRun "seinfo --common cap2 -x | grep -w ${CAPABILITY}" + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/chronyd-and-similar/Makefile b/selinux-policy/chronyd-and-similar/Makefile new file mode 100644 index 0000000..a26d46f --- /dev/null +++ b/selinux-policy/chronyd-and-similar/Makefile @@ -0,0 +1,112 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/chronyd-and-similar +# Description: SELinux interferes with chronyd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/chronyd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE chrony-nts-test.sh + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh chrony-nts-test.sh + chcon -t bin_t runtest.sh chrony-nts-test.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with chronyd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 1h" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: chrony" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy-mls selinux-policy-targeted setools-console chrony ksh nscd /usr/bin/certtool /usr/sbin/service socat linuxptp" >> $(METADATA) # EPEL + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Architectures: i386 ppc64 x86_64" >> $(METADATA) + @echo "Bug: 974992" >> $(METADATA) # RHEL-7 + @echo "Bug: 978993" >> $(METADATA) # RHEL-6 + @echo "Bug: 1243764" >> $(METADATA) # RHEL-7 + @echo "Bug: 1243987" >> $(METADATA) # RHEL-7 + @echo "Bug: 1273116" >> $(METADATA) # RHEL-7 + @echo "Bug: 1281473" >> $(METADATA) # RHEL-6 + @echo "Bug: 1290310" >> $(METADATA) # RHEL-6 + @echo "Bug: 1350765" >> $(METADATA) # RHEL-7 + @echo "Bug: 1390657" >> $(METADATA) # RHEL-6 + @echo "Bug: 1416015" >> $(METADATA) # RHEL-7 + @echo "Bug: 1421248" >> $(METADATA) # RHEL-7 + @echo "Bug: 1425408" >> $(METADATA) # RHEL-7 + @echo "Bug: 1440791" >> $(METADATA) # RHEL-7 + @echo "Bug: 1470150" >> $(METADATA) # RHEL-7 + @echo "Bug: 1508486" >> $(METADATA) # RHEL-7 + @echo "Bug: 1509379" >> $(METADATA) # RHEL-7 + @echo "Bug: 1509927" >> $(METADATA) # RHEL-7 + @echo "Bug: 1530525" >> $(METADATA) # RHEL-7 + @echo "Bug: 1567753" >> $(METADATA) # RHEL-7 + @echo "Bug: 1568281" >> $(METADATA) # RHEL-7 + @echo "Bug: 1574418" >> $(METADATA) # RHEL-7 + @echo "Bug: 1575002" >> $(METADATA) # RHEL-7 + @echo "Bug: 1577057" >> $(METADATA) # RHEL-7 + @echo "Bug: 1593267" >> $(METADATA) # RHEL-7 + @echo "Bug: 1593607" >> $(METADATA) # RHEL-8 + @echo "Bug: 1596563" >> $(METADATA) # RHEL-7 + @echo "Bug: 1618757" >> $(METADATA) # RHEL-7 + @echo "Bug: 1622499" >> $(METADATA) # RHEL-8 + @echo "Bug: 1652079" >> $(METADATA) # RHEL-7 + @echo "Bug: 1696252" >> $(METADATA) # RHEL-8 + @echo "Bug: 1772852" >> $(METADATA) # RHEL-8 + @echo "Bug: 1895825" >> $(METADATA) # RHEL-9 + @echo "Bug: 1900143" >> $(METADATA) # Fedora 34 + @echo "Bug: 1961207" >> $(METADATA) # RHEL-8 + @echo "Bug: 2008894" >> $(METADATA) # Fedora 35 + @echo "Bug: 2065313" >> $(METADATA) # RHEL-8 + @echo "Bug: 2118628" >> $(METADATA) # RHEL-8 + @echo "Bug: 2118631" >> $(METADATA) # RHEL-9 + @echo "Bug: 2173604" >> $(METADATA) # RHEL-9 + @echo "Bug: 2169949" >> $(METADATA) # Fedora-38 + @echo "Bug: RHEL-18219" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-82299" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-82308" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/chronyd-and-similar/PURPOSE b/selinux-policy/chronyd-and-similar/PURPOSE new file mode 100644 index 0000000..b67781b --- /dev/null +++ b/selinux-policy/chronyd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/chronyd-and-similar +Author: Milos Malik + +SELinux interferes with chronyc, chronyd and related programs. + diff --git a/selinux-policy/chronyd-and-similar/chrony-nts-test.sh b/selinux-policy/chronyd-and-similar/chrony-nts-test.sh new file mode 100755 index 0000000..4771d70 --- /dev/null +++ b/selinux-policy/chronyd-and-similar/chrony-nts-test.sh @@ -0,0 +1,41 @@ +#!/bin/bash + +set -e + +server_name=chrony-nts-test +cert=/etc/pki/tls/certs/nts.crt +key=/etc/pki/tls/private/nts.key + +sed -i "/ $server_name\$/d" /etc/hosts +echo "127.0.0.1 $server_name" >> /etc/hosts + +cat > cert.cfg < /etc/chrony.conf < +component: + - chrony + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy-mls + - selinux-policy-targeted + - setools-console + - chrony + - ksh + - nscd + - /usr/bin/certtool + - /usr/sbin/service + - socat + - linuxptp +environment: + AVC_ERROR: +no_avc_check +duration: 1h +enabled: true +tag: + - NoRHEL4 + - TIP_fedora_fail + - TIPfail_Security + - TIPfail_fedora + - TIPfail_infra + - TIPpass + - TipWaived6 + - f33friendly + - targeted + - NoRHIVOS +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=974992 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=978993 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243764 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243987 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1273116 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1281473 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1290310 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1350765 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390657 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1416015 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1421248 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1425408 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1440791 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470150 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1508486 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1509379 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1509927 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1530525 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1567753 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1568281 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574418 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1575002 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1577057 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593267 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593607 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1596563 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618757 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1622499 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1652079 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1696252 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772852 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1895825 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900143 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961207 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008894 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2065313 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949493 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118628 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118631 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173604 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2169949 + - verifies: https://issues.redhat.com/browse/RHEL-18219 + - verifies: https://issues.redhat.com/browse/RHEL-82299 + - verifies: https://issues.redhat.com/browse/RHEL-82308 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false + - enabled: false + when: arch == ia64, ppc, s390 + continue: false +extra-nitrate: TC#0202180 +extra-summary: /CoreOS/selinux-policy/Regression/chronyd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/chronyd-and-similar +id: d247a2ee-7ce9-4ee2-b3f7-3b04102c7b83 diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh new file mode 100755 index 0000000..269bb91 --- /dev/null +++ b/selinux-policy/chronyd-and-similar/runtest.sh @@ -0,0 +1,465 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/chronyd-and-similar +# Description: SELinux interferes with chronyd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_PACKAGE="chrony" +SERVICE_NAME="chronyd" +PROCESS_NAME="chronyd" +PROCESS_CONTEXT="chronyd_t" +CHRONYD_RESTRICTED_SERVICE="chronyd-restricted" +CHRONYD_RESTRICTED_UNIT_FILE="/usr/lib/systemd/system/chronyd-restricted.service" +CHRONYD_RESTRICTED_UNIT_DROPIN_DIR="/etc/systemd/system/chronyd-restricted.service.d" +CHRONYD_RESTRICTED_UNIT_DROPIN_FILE="${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}/context.conf" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop `rlSEListServices 123` + rlFileBackup /etc/chrony.conf + rlFileBackup /etc/shadow + rlFileBackup /etc/chrony.keys + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#974992 + bz#978993" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSESearchRule "allow chronyd_t chronyd_t : capability { sys_nice } [ ]" + rlSESearchRule "allow chronyd_t chronyd_t : process { setsched } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1243764 + bz#1243987" + rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t" + rlSEMatchPathCon "/var/run/chrony-helper" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony-helper/added_servers" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony-helper/lock" "chronyd_var_run_t" + rlSEMatchPathCon "/var/lib/dhclient" "dhcpc_state_t" + rlSEMatchPathCon "/var/lib/dhclient/chrony.servers.eth0" "dhcpc_state_t" + rlSEMatchPathCon "/usr/bin/systemctl" "systemd_systemctl_exec_t" + rlSESearchRule "allow dhcpc_t chronyd_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition dhcpc_t chronyd_exec_t : process chronyd_t" + rlSESearchRule "allow dhcpc_t chronyd_t : process { transition }" + rlSESearchRule "allow chronyd_t var_run_t : dir { read write add_name remove_name search open getattr }" + rlSESearchRule "type_transition chronyd_t var_run_t : dir chronyd_var_run_t" + rlSESearchRule "allow chronyd_t chronyd_var_run_t : dir { read write add_name remove_name search open getattr }" + rlSESearchRule "allow chronyd_t chronyd_var_run_t : file { getattr open read write create unlink }" + rlSESearchRule "allow chronyd_t dhcpc_state_t : dir { getattr open read search }" + rlSESearchRule "allow chronyd_t dhcpc_state_t : file { getattr open read }" + rlSESearchRule "allow chronyd_t bin_t : file { getattr open read execute_no_trans }" + rlSESearchRule "allow chronyd_t systemd_systemctl_exec_t : file { getattr open read execute_no_trans }" + rlSESearchRule "allow timemaster_t chronyd_t : process { signal }" + rlPhaseEnd + + rlPhaseStartTest "bz#1350765" + rlSESearchRule "allow chronyd_t chronyd_t : capability2 { block_suspend } [ ]" + rlSESearchRule "allow chronyd_t kernel_t : system { module_request } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1416015 + bz#1421248 + bz#1425408 + bz#1440791" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSEMatchPathCon "/etc/adjtime" "adjtime_t" + rlSEMatchPathCon "/var/run/chrony" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony/chronyd.sock" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony/chronyc.1117.sock" "chronyd_var_run_t" + rlSESearchRule "allow chronyd_t adjtime_t : file { getattr open read }" + rlSESearchRule "allow chronyd_t chronyd_t : capability { chown }" + rlSESearchRule "allow chronyd_t chronyd_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow chronyd_t chronyd_t : capability { net_admin }" + rlPhaseEnd + + rlPhaseStartTest "bz#1508486" + rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow chronyd_t chronyc_exec_t : file { getattr open read execute_no_trans }" + rlSESearchRule "allow chronyd_t chronyc_t : process { transition }" 1 + rlPhaseEnd + + rlPhaseStartTest "bz#1509379" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow chronyc_t chronyc_t : capability { dac_read_search } [ ]" + rlSESearchRule "type_transition chronyd_t chronyc_exec_t : process chronyc_t" 1 + rlSESearchRule "allow chronyd_t chronyd_t : capability { dac_read_search } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1530525" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/etc" "etc_t" + rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t" +# rlSESearchRule "allow chronyc_t etc_t : dir { write add_name }" +# rlSESearchRule "type_transition chronyc_t etc_t : file chronyd_keys_t" + rlSESearchRule "allow chronyc_t chronyd_keys_t : file { getattr ioctl append write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1470150" + rlSEMatchPathCon "/var/run/chrony" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony/chronyc.3781.sock" "chronyd_var_run_t" + rlSESearchRule "allow chronyd_t chronyc_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow chronyc_t chronyd_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow system_cronjob_t chronyc_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition system_cronjob_t chronyc_exec_t : process chronyc_t" + rlSESearchRule "allow system_cronjob_t chronyc_t : process { transition } [ ]" + rlSESearchRule "allow inetd_child_t chronyc_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition inetd_child_t chronyc_exec_t : process chronyc_t" + rlSESearchRule "allow inetd_child_t chronyc_t : process { transition } [ ]" + rlSESearchRule "allow chronyc_t chronyd_var_run_t : sock_file { create write unlink }" + rlPhaseEnd + fi + + if false ; then + rlPhaseStartTest "bz#1273116" # CLOSED as NOT-A-BUG, unable to reproduce it anymore + rlSEMatchPathCon "/usr/lib/systemd/system/chronyd.service" "chronyd_unit_file_t" + rlSESearchRule "allow chronyd_t chronyd_unit_file_t : service { status }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#1281473" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t" + rlSEMatchPathCon "/var/run/timemaster/chrony.conf" "timemaster_var_run_t" + rlSESearchRule "allow chronyd_t chronyd_keys_t : file { append setattr }" + rlSESearchRule "allow chronyd_t timemaster_var_run_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1290310" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/chronyd.sock" "chronyd_var_run_t" + rlSESearchRule "allow chronyd_t var_run_t : dir { getattr open search read write add_name remove_name }" + rlSESearchRule "type_transition chronyd_t var_run_t : sock_file chronyd_var_run_t" + rlSESearchRule "allow chronyd_t chronyd_var_run_t : sock_file { create }" + rlPhaseEnd + + rlPhaseStartTest "bz#1390657" + rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t" + rlSESearchRule "allow logrotate_t chronyd_keys_t : file { getattr open read }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1509927" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow chronyc_t user_devpts_t : chr_file { read write getattr append open } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1574418" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/tmp" "tmp_t" + rlSEMatchPathCon "/var/lib" "var_lib_t" + rlSEMatchPathCon "/var/lib/check_mk_agent" "var_lib_t" + rlSEMatchPathCon "/var/lib/check_mk_agent/cache" "var_lib_t" + rlSEMatchPathCon "/var/lib/check_mk_agent/cache/chrony.cache.new" "var_lib_t" + rlSEMatchPathCon "/var/log" "var_log_t" + rlSESearchRule "allow chronyc_t tmp_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition chronyc_t tmp_t : file chronyd_tmp_t" + rlSESearchRule "allow chronyc_t chronyd_tmp_t : file { create getattr open write } [ ]" + rlSESearchRule "allow chronyc_t var_log_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition chronyc_t var_log_t : file chronyd_var_log_t" + rlSESearchRule "allow chronyc_t chronyd_var_log_t : file { create getattr open write } [ ]" + rlSESearchRule "allow chronyc_t var_lib_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition chronyc_t var_lib_t : file chronyd_var_lib_t" + rlSESearchRule "allow chronyc_t chronyd_var_lib_t : file { create getattr open write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1575002 + bz#1577057 + bz#1593267" + rlSEMatchPathCon "/dev/tty1" "tty_device_t" + rlSESearchRule "allow unconfined_t chronyc_exec_t : file { getattr open read execute }" + rlSESearchRule "allow unconfined_t chronyc_t : process { transition }" + rlSESearchRule "type_transition unconfined_t chronyc_exec_t : process chronyc_t" + rlSESearchRule "type_change unconfined_t tty_device_t : chr_file user_tty_device_t" + rlSESearchRule "allow chronyc_t user_tty_device_t : chr_file { read write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1596563" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/var/run/nscd/socket" "nscd_var_run_t" + rlSEMatchPathCon "/var/db/nscd/passwd" "nscd_var_run_t" + rlSESearchRule "allow chronyc_t nscd_t : unix_stream_socket { connectto }" + rlSESearchRule "allow system_dbusd_t nscd_var_run_t : file { map }" + rlSESearchRule "dontaudit chronyc_t nscd_var_run_t : file { getattr open read }" + rlSESearchRule "allow chronyd_t chronyd_tmpfs_t : file { map }" + rlSESearchRule "allow chronyd_t gpsd_tmpfs_t : file { map }" + rlSESearchRule "allow chronyc_t nscd_t : nscd { shmemhost gethost }" + rlPhaseEnd + + rlPhaseStartTest "bz#1568281" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/run/chrony" "chronyd_var_run_t" + rlSESearchRule "allow logrotate_t chronyc_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition logrotate_t chronyc_exec_t : process chronyc_t" + rlSESearchRule "allow logrotate_t chronyc_t : process { transition } [ ]" + rlSESearchRule "allow chronyc_t chronyd_var_run_t : dir { write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1567753" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSEMatchPathCon "/var/lib/libvirt/dnsmasq" "virt_var_lib_t" + rlSESearchRule "allow chronyd_t virt_var_lib_t : dir { getattr open search read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1618757 + bz#1622499" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow chronyc_t unconfined_t : unix_stream_socket { read write ioctl getattr } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + # bz#1652079 was closed as WONTFIX + rlPhaseStartTest "bz#1652079 + bz#1696252" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/var/lib" "var_lib_t" + rlSEMatchPathCon "/var/lib/test" "var_lib_t" + rlSEMatchPathCon "/var/log" "var_log_t" + rlSEMatchPathCon "/var/log/test" "var_log_t" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/test" "var_run_t" + rlSEMatchPathCon "/var/cache" "var_t" + rlSEMatchPathCon "/var/cache/test" "var_t" + rlSESearchRule "allow chronyc_t var_lib_t : dir { getattr open search write add_name } [ ]" + rlSESearchRule "allow chronyc_t var_lib_t : file { getattr ioctl write append } [ ]" + rlSESearchRule "allow chronyc_t var_log_t : dir { getattr open search write add_name } [ ]" + rlSESearchRule "allow chronyc_t var_log_t : file { getattr ioctl write append } [ ]" + rlSESearchRule "allow chronyc_t var_t : file { getattr ioctl write append } [ ]" + rlSESearchRule "allow chronyc_t var_run_t : file { getattr ioctl write append } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1593607" + rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t" + rlSESearchRule "allow chronyd_t shell_exec_t : file { map } [ ] mls" + rlPhaseEnd + + rlPhaseStartTest "bz#1772852" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/var/db/nscd/hosts" "nscd_var_run_t" + rlSESearchRule "allow chronyc_t nscd_var_run_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 8 ; then + rlPhaseStartTest "bz#1895825" + rlSEMatchPathCon "/run/chrony-dhcp" "chronyd_var_run_t" + rlSEMatchPathCon "/run/chrony-dhcp/something.source" "chronyd_var_run_t" + rlPhaseEnd + + rlPhaseStartTest "bz#1900143" + rlSEMatchPathCon "/run/systemd/resolve/io.systemd.Resolve" "systemd_resolved_var_run_t" + rlSESearchRule "allow chronyd_t systemd_resolved_var_run_t : sock_file { write } [ ]" + # rlRun "grep resolve /etc/nsswitch.conf" + rlPhaseEnd + + if ! rlIsRHEL "<9.3" ; then + rlPhaseStartTest "bz#2173604" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + rlSESearchRule "allow chronyc_t sysctl_net_t : dir { search } [ ]" + rlSESearchRule "allow chronyc_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1961207" + rlSEMatchPortCon tcp 4460 ntske_port_t + rlSEMatchPathCon "/usr/share/pki/ca-trust-source/ca-bundle.trust.p11-ki" "cert_t" + rlSESearchRule "allow chronyd_t ntske_port_t : tcp_socket { name_bind name_connect } [ ]" + rlSESearchRule "allow chronyd_t chronyd_t : tcp_socket { listen accept }" + rlSESearchRule "allow chronyd_t cert_t : file { map } [ ]" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#2008894" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow init_t chronyc_t : process2 { nnp_transition } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- chrony-wait service" + rlServiceStop chrony-wait + rlRun "mkdir -p /run/systemd/system/chrony-wait.service.d" + rlRun "echo -e '[Service]\nDynamicUser=yes' > /run/systemd/system/chrony-wait.service.d/override.conf" + rlRun "systemctl daemon-reload" + rlRun "systemctl start chrony-wait.service" + sleep 5 + rlRun "systemctl stop chrony-wait.service" + rlRun "rm -f /run/systemd/system/chrony-wait.service.d/override.conf" + rlRun "systemctl daemon-reload" + rlServiceRestore chrony-wait + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlRun "echo \"sched_priority 50\" >> /etc/chrony.conf" + rlRun "echo \"refclock SHM 0\" >> /etc/chrony.conf" + rlRun "echo \"refclock SOCK /var/run/chronyd.sock\" >> /etc/chrony.conf" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + if ! rlIsFedora ; then + rlRun "ipcs -m | grep 0x4e545030" + rlRun "ls -Z /var/run/chronyd.sock | grep :chronyd_var_run_t" + fi + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "chronyc tracking" + for OUTPUT_FILE in /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output ; do + rlRun "rm -f ${OUTPUT_FILE}" + rlRun "chronyc tracking > ${OUTPUT_FILE}" + rlRun "test -s ${OUTPUT_FILE}" + rlRun "ls -Z ${OUTPUT_FILE} | grep -e :user_tmp_t -e :chronyd_var_lib_t -e :chronyd_var_log_t" + done + if ! rlIsRHEL 7 ; then + for OUTPUT_FILE in /var/lib/test /var/log/test /var/run/test /var/cache/test ; do + rlRun "rm -f ${OUTPUT_FILE}" + rlRun "chronyc -n tracking > ${OUTPUT_FILE}" + rlRun "test -s ${OUTPUT_FILE}" + rlRun "chronyc -n tracking >> ${OUTPUT_FILE}" + rlRun "ls -Z ${OUTPUT_FILE}" + rlRun "ls -Z ${OUTPUT_FILE} | grep -e :var_lib_t -e :var_log_t -e :var_run_t -e :var_t" + rlRun "rm -f ${OUTPUT_FILE}" + done + fi + if rpm -q nscd >& /dev/null ; then + rlRun "service nscd start" + fi + sleep 2 + rlRun "getsebool -a | grep nscd" + rlRun "chronyc sources" + rlRun "ksh -c \"chronyc sources\"" + if ! rlIsRHEL 5 6 ; then + rlRun "chronyc serverstats" + fi + if rpm -q nscd >& /dev/null ; then + rlRun "service nscd stop" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "real scenario -- bz#1530525" + rlRun "rm -f /etc/chrony.keys" + rlRun "touch /etc/chrony.keys" + rlRun "restorecon -v /etc/chrony.keys" + rlRun "chronyc keygen 1111 SHA1 > /etc/chrony.keys" + rlRun "chronyc keygen 1111 SHA1 >> /etc/chrony.keys" + rlRun "ls -Z /etc/chrony.keys | grep :chronyd_keys_t" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "real scenario -- bz#1961207" + rlRun "./chrony-nts-test.sh" + rlRun "rm -f /var/lib/chrony/*.nts" + rlRun "systemctl restart chronyd" + rlPhaseEnd + + rlPhaseStartTest "bz#2065313" + rlSESearchRule "allow chronyd_t unconfined_t : unix_dgram_socket { sendto }" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#2065313" + rlLog "special socat command talks to chronyd via its UNIX socket" + printf "\x6\x1\x0\x0\x0\x21\x0\x0\x21\xd7\xe4\x22\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0" | socat unix-sendto:/run/chrony/chronyd.sock,bind=/run/chrony/chronyc.sock,umask=0000 - | hexdump -C + rlPhaseEnd + + rlPhaseStartTest "bz#2118628 + bz#2118631" + rlSEMatchPortCon udp 319 ptp_event_port_t + rlSESearchRule "allow chronyd_t ptp_event_port_t : udp_socket { name_bind } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#2118628 + bz#2118631" + rlRun "echo -en '\nallow\nptpport 319\nserver 127.0.0.1 port 319 minpoll 0 maxpoll 0\n' >> /etc/chrony.conf" + rlRun "systemctl restart chronyd" + sleep 5 + rlRun "chronyc ntpdata 127.0.0.1 | grep 'Total RX'" + rlPhaseEnd + fi + + if ! ( rlIsRHEL 9 && rlIsRHEL "<9.7" ) && ! ( rlIsRHEL 10 && rlIsRHEL "<10.1" ) ; then + if rlSEDefined "chronyd_restricted_t" ; then + rlPhaseStartTest "RHEL-82299 + RHEL-82308" + rlSESearchRule "allow chronyc_t chronyd_restricted_t : unix_dgram_socket { sendto } [ ]" + rlSESearchRule "allow chronyd_restricted_t chronyc_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + fi + + if [ -f ${CHRONYD_RESTRICTED_UNIT_FILE} ]; then + rlPhaseStartTest "chronyd-restricted -- bz#2169949 + RHEL-18219" + rlRun "systemctl stop ${SERVICE_NAME}" + rlRun "mkdir -p ${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}" + if ! grep ^SELinuxContext= ${CHRONYD_RESTRICTED_UNIT_FILE} ; then + # temporary configuration change until it becomes a part of the chrony package + rlRun "echo -e '[Service]\nSELinuxContext=system_u:system_r:chronyd_restricted_t:s0\n' > ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" + rlRun "systemctl daemon-reload" + fi + rlRun "systemctl start ${CHRONYD_RESTRICTED_SERVICE}" + sleep 3 + rlRun "ps -o pid,uid,command,context -C chronyd | grep -1 system_u:system_r:chronyd_restricted_t:" + rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "chronyc reload sources" 0,1 + rlRun "systemctl restart ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "systemctl stop ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "rm -f ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" + rlRun "systemctl daemon-reload" + rlPhaseEnd + fi + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlRun "rm -f /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output" + rlFileRestore + rlServiceRestore `rlSEListServices 123` + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/cockpit-ws-and-similar/Makefile b/selinux-policy/cockpit-ws-and-similar/Makefile new file mode 100644 index 0000000..d048f53 --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/Makefile @@ -0,0 +1,85 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +# Description: SELinux interferes with cockpit-ws and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with cockpit-ws and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 cockpit-ws net-tools nmap-ncat cockpit-dashboard cockpit-bridge psmisc selinux-policy-devel" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Architectures: x86_64" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1100808" >> $(METADATA) # RHEL-7 + @echo "Bug: 1214223" >> $(METADATA) # RHEL-7 + @echo "Bug: 1279429" >> $(METADATA) # RHEL-7 + @echo "Bug: 1283955" >> $(METADATA) # RHEL-7 + @echo "Bug: 1374572" >> $(METADATA) # RHEL-7 + @echo "Bug: 1381914" >> $(METADATA) # RHEL-7 + @echo "Bug: 1402316" >> $(METADATA) # RHEL-7 + @echo "Bug: 1402495" >> $(METADATA) # RHEL-7 + @echo "Bug: 1413509" >> $(METADATA) # RHEL-7 + @echo "Bug: 1561053" >> $(METADATA) # Fedora 28 + @echo "Bug: 1584167" >> $(METADATA) # Fedora 28 + @echo "Bug: 1609929" >> $(METADATA) # Fedora 28 + @echo "Bug: 1613638" >> $(METADATA) # Fedora 28 + @echo "Bug: 1615318" >> $(METADATA) # RHEL-8 + @echo "Bug: 1629678" >> $(METADATA) # RHEL-8 + @echo "Bug: 1718814" >> $(METADATA) # RHEL-8 + @echo "Bug: 1979182" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/cockpit-ws-and-similar/PURPOSE b/selinux-policy/cockpit-ws-and-similar/PURPOSE new file mode 100644 index 0000000..b42781c --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +Author: Milos Malik + +SELinux interferes with cockpit-ws, cockpit-ssh, cockpit-session and related programs. + diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf new file mode 100644 index 0000000..a386b3a --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/main.fmf @@ -0,0 +1,68 @@ +summary: SELinux interferes with cockpit-ws and related programs +description: |+ + SELinux interferes with cockpit-ws, cockpit-ssh, cockpit-session and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - cockpit-ws + - net-tools + - nmap-ncat + - cockpit-dashboard + - cockpit-bridge + - psmisc + - selinux-policy-devel +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TierCandidatesPASS + - failinfedora + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1100808 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1214223 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1279429 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1283955 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1374572 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1381914 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402316 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402495 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1413509 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1561053 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1584167 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1609929 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1613638 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1615318 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1629678 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1718814 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1979182 +adjust+: + - enabled: false + when: arch != x86_64 + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0419451 +extra-summary: /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +extra-task: /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +id: 80693544-1e8a-4200-9edd-c3e766d1e433 diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh new file mode 100755 index 0000000..4bb6c98 --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh @@ -0,0 +1,238 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +# Description: SELinux interferes with cockpit-ws and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/cockpit-ws" +FILE_CONTEXT="cockpit_ws_exec_t" +SERVICE_PACKAGE="cockpit-ws" +SERVICE_NAME="cockpit" +if grep "cockpit-tls" /usr/lib/systemd/system/cockpit.service; then + PROCESS_NAME="cockpit-tls" +else + PROCESS_NAME="cockpit-ws" +fi +PROCESS_CONTEXT="cockpit_ws_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1100808" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1214223" + rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" + rlSEMatchPathCon "/var/tmp" "tmp_t" + rlSESearchRule "allow cockpit_session_t tmp_t : dir { read write add_name remove_name getattr open search } [ ]" + rlSESearchRule "type_transition cockpit_session_t tmp_t : file cockpit_tmp_t" + rlSESearchRule "allow cockpit_session_t cockpit_tmp_t : file { create write open unlink } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1279429 + bz#1283955" + rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" + rlSEMatchPathCon "/tmp" "tmp_t" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/cockpit-ws" "cockpit_var_run_t" + rlSESearchRule "allow cockpit_ws_t var_run_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition cockpit_ws_t var_run_t : dir cockpit_var_run_t [ ]" + rlSESearchRule "allow cockpit_ws_t cockpit_var_run_t : dir { create } [ ]" + rlSESearchRule "allow cockpit_ws_t tmp_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition cockpit_ws_t tmp_t : dir cockpit_tmp_t [ ]" + rlSESearchRule "type_transition cockpit_ws_t tmp_t : file cockpit_tmp_t [ ]" + rlSESearchRule "allow cockpit_ws_t cockpit_tmp_t : dir { read write create getattr setattr lock unlink link rename add_name remove_name search rmdir open } [ ]" + rlSESearchRule "allow cockpit_ws_t cockpit_tmp_t : file { read write create getattr setattr lock append unlink link rename open } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1374572" + rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" + rlSEMatchPathCon "/usr/share/cracklib" "crack_db_t" + rlSEMatchPathCon "/usr/share/cracklib/pw_dict.pwd" "crack_db_t" + rlSEMatchPathCon "/etc/nshadow" "shadow_t" + rlSESearchRule "allow cockpit_session_t crack_db_t : dir { search }" + rlSESearchRule "allow cockpit_session_t crack_db_t : file { getattr open read }" + rlSESearchRule "allow cockpit_session_t shadow_t : file { create write setattr }" + rlSESearchRule "allow cockpit_session_t passwd_file_t : file { write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1413509" + rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" + rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" + rlSEMatchPathCon "/var/lib/cockpit" "cockpit_var_lib_t" + rlSEMatchPortCon tcp 22 ssh_port_t + rlSESearchRule "allow cockpit_ws_t cockpit_session_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition cockpit_ws_t cockpit_session_exec_t : process cockpit_session_t" + rlSESearchRule "allow cockpit_ws_t cockpit_session_t : process { transition }" + rlSESearchRule "allow cockpit_session_t cockpit_var_lib_t : dir { search }" + rlSESearchRule "allow cockpit_session_t ssh_port_t : tcp_socket { name_connect } [ ]" + rlPhaseEnd + + if ! rlIsRHEL 7 ; then + rlPhaseStartTest "bz#1584167 + bz#1609929 + bz#1613638 + bz#1615318" + rlSEMatchPathCon "/usr/sbin/sshd" "sshd_exec_t" + rlSEMatchPathCon "/var/run/cockpit" "cockpit_var_run_t" + rlSEMatchPathCon "/var/run/cockpit/active.motd" "cockpit_var_run_t" + rlSESearchRule "allow sshd_t cockpit_var_run_t : dir { getattr open search } [ ]" + rlSESearchRule "allow sshd_t cockpit_var_run_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1629678" + rlSEMatchPathCon "/usr/lib/systemd/system/cockpit.socket" "cockpit_unit_file_t" + rlSESearchRule "allow cockpit_ws_t cockpit_unit_file_t : service { status } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1561053" + rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" + rlRun "ls -Z /proc/cpuinfo | grep :proc_t" + rlSESearchRule "allow cockpit_ws_t proc_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartTest "bz#1402316 + bz#1402495" + rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" + rlSESearchRule "allow cockpit_session_t cockpit_session_t : process { setrlimit }" + rlPhaseEnd + + if ! rlIsRHEL 7 ; then + rlPhaseStartTest "bz#1718814" + # staff_u section + rlSESearchRule "allow staff_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]" + rlSESearchRule "allow staff_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]" + rlSESearchRule "allow staff_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]" + # rlSESearchRule "allow staff_sudo_t staff_t : unix_stream_socket { ioctl } [ ]" + rlSESearchRule "allow cockpit_session_t staff_ssh_agent_t : process { signal } [ ]" + # user_u section + rlSESearchRule "allow user_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]" + rlSESearchRule "allow user_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]" + rlSESearchRule "allow user_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]" + # user_u cannot run sudo - tested in a different TC + rlSESearchRule "allow cockpit_session_t user_ssh_agent_t : process { signal } [ ]" + # sysadm_u section + rlSESearchRule "allow sysadm_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]" + rlSESearchRule "allow sysadm_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]" + + # rlSESearchRule "allow sysadm_sudo_t sysadm_t : unix_stream_socket { ioctl } [ ]" + rlSESearchRule "allow sysadm_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]" + rlSESearchRule "allow cockpit_session_t sysadm_ssh_agent_t : process { signal } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1979182" + rlSESearchRule "allow cockpit_ws_t fs_t : filesystem { getattr } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlPhaseStartTest "real scenario -- xinetd service" + HOST_ADDRESS="127.0.0.1" # IP address or nothing + PORT_NUMBER="9090" # number or socket path + PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} on" + rlRun "service xinetd restart" + rlLog "starting provocateur job" + ( tail -f - | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + else + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + rlLog "starting provocateur job" + ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + fi + sleep 1 + rlRun "netstat -tupan | grep :${PORT_NUMBER}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} off" + rlRun "service xinetd stop" + else + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + fi + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/cockpit-ws-and-similar/testpolicy.te b/selinux-policy/cockpit-ws-and-similar/testpolicy.te new file mode 100644 index 0000000..10b6586 --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/testpolicy.te @@ -0,0 +1,17 @@ +policy_module(testpolicy,1.0) + +require { + type initrc_t; + type cockpit_session_exec_t; + type cockpit_session_t; + type user_devpts_t; + class file { getattr open read execute entrypoint }; + class process { transition }; + class chr_file { getattr open read write append }; +} + +allow initrc_t cockpit_session_exec_t : file { getattr open read execute entrypoint }; +allow initrc_t cockpit_session_t : process { transition }; +type_transition initrc_t cockpit_session_exec_t : process cockpit_session_t; +allow cockpit_session_t user_devpts_t : chr_file { getattr open read write append }; + diff --git a/selinux-policy/colord-and-similar/Makefile b/selinux-policy/colord-and-similar/Makefile new file mode 100644 index 0000000..32ada87 --- /dev/null +++ b/selinux-policy/colord-and-similar/Makefile @@ -0,0 +1,75 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/colord-and-similar +# Description: SELinux interferes with colord and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/colord-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with colord and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: colord" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted glib2 setools-console colord /usr/sbin/service expect" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5 -RHEL6" >> $(METADATA) + @echo "Bug: 1373082" >> $(METADATA) # RHEL-7 + @echo "Bug: 1381579" >> $(METADATA) # RHEL-7 + @echo "Bug: 1398030" >> $(METADATA) # RHEL-7 + @echo "Bug: 1421247" >> $(METADATA) # RHEL-7 + @echo "Bug: 1460480" >> $(METADATA) # RHEL-7 + @echo "Bug: 1772669" >> $(METADATA) # RHEL-8 + @echo "Bug: 2259679" >> $(METADATA) # Fedora 40 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/colord-and-similar/PURPOSE b/selinux-policy/colord-and-similar/PURPOSE new file mode 100644 index 0000000..eca8438 --- /dev/null +++ b/selinux-policy/colord-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/colord-and-similar +Author: Milos Malik + +SELinux interferes with colord and related programs. + diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf new file mode 100644 index 0000000..d3bca10 --- /dev/null +++ b/selinux-policy/colord-and-similar/main.fmf @@ -0,0 +1,59 @@ +summary: SELinux interferes with colord and related programs +description: |+ + SELinux interferes with colord and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - glib2 + - setools-console + - colord + - /usr/sbin/service + - expect +environment: + AVC_ERROR: +no_avc_check + ALLOWED_USERS: staff_u user_u sysadm_u unconfined_u + DENIED_USERS: guest_u xguest_u +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373082 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1381579 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1398030 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1421247 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460480 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2259679 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0276310 +extra-summary: /CoreOS/selinux-policy/Regression/colord-and-similar +extra-task: /CoreOS/selinux-policy/Regression/colord-and-similar +id: c0168fe1-5628-4c40-ba49-f6939ce96d1b diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh new file mode 100755 index 0000000..4d6970d --- /dev/null +++ b/selinux-policy/colord-and-similar/runtest.sh @@ -0,0 +1,165 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/colord-and-similar +# Description: SELinux interferes with colord and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_PACKAGE="colord" +SERVICE_NAME="colord" +PROCESS_NAME="colord" +PROCESS_CONTEXT="colord_t" +ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} +DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1373082 + bz#1381579 + bz#1398030 + bz#1421247 + bz#1460480" + rlSEMatchPathCon "/usr/libexec/colord" "colord_exec_t" + rlSEMatchPathCon "/etc/udev/hwdb.bin" "systemd_hwdb_etc_t" + rlSESearchRule "allow colord_t systemd_hwdb_etc_t : file { getattr open read } [ ]" + rlPhaseEnd + + DESTINATION="org.freedesktop.ColorManager" + if busctl | grep -iq ${DESTINATION} ; then + rlPhaseStartTest "real scenario -- DBus service" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "real scenario -- user session service" + CREATED_USERS="" + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager status colord-session" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager start colord-session" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager stop colord-session" + sleep 2 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + rlPhaseEnd + + rlPhaseStartTest "bz#1772669" + # TODO: find an agreement about which confined users should be allowed + rlSESearchRule "allow staff_t colord_t : dbus { send_msg } [ ]" + rlSESearchRule "allow colord_t staff_t : dbus { send_msg } [ ]" + rlSESearchRule "allow user_t colord_t : dbus { send_msg } [ ]" + rlSESearchRule "allow colord_t user_t : dbus { send_msg } [ ]" + rlSESearchRule "allow sysadm_t colord_t : dbus { send_msg } [ ]" + rlSESearchRule "allow colord_t sysadm_t : dbus { send_msg } [ ]" + rlSESearchRule "allow unconfined_t colord_t : dbus { send_msg } [ ]" + rlSESearchRule "allow colord_t unconfined_t : dbus { send_msg } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#1772669" + CREATED_USERS="" + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost colormgr get-devices" + sleep 2 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#2259679" + rlSEMatchPathCon "/usr/libexec/colord" "colord_exec_t" + rlSEMatchPathCon "/var/lib/colord/mapping.db" "colord_var_lib_t" + rlSESearchRule "allow init_t colord_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow colord_t colord_var_lib_t : file { read write } [ ]" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/colord-and-similar/ssh.exp b/selinux-policy/colord-and-similar/ssh.exp new file mode 100755 index 0000000..1244013 --- /dev/null +++ b/selinux-policy/colord-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command ; sleep 5" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/coreutils-single/main.fmf b/selinux-policy/coreutils-single/main.fmf new file mode 100644 index 0000000..4c4188f --- /dev/null +++ b/selinux-policy/coreutils-single/main.fmf @@ -0,0 +1,37 @@ +summary: Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on. +description: |+ + Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on. + +contact: Veronika Syncakova +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - policycoreutils + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHIVOS +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-141858 +adjust+: + - enabled: false + when: distro < rhel-10.3 + continue: false + because: RHEL-141858 is fixed in RHEL-10.3 diff --git a/selinux-policy/coreutils-single/runtest.sh b/selinux-policy/coreutils-single/runtest.sh new file mode 100755 index 0000000..743b295 --- /dev/null +++ b/selinux-policy/coreutils-single/runtest.sh @@ -0,0 +1,43 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="coreutils-single" +BOOLEAN="corecmd_bin_sys_resource" +INSTALLED_VARIANT="" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + if rpm -q coreutils-single > /dev/null 2>&1; then + INSTALLED_VARIANT="single" + else + INSTALLED_VARIANT="regular" + rlRun "yum -y install ${PACKAGE} --allowerasing" + fi + rlAssertRpm ${PACKAGE} + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + rlPhaseEnd + + rlPhaseStartTest "RHEL-141858" + # Boolean and rule exists + rlRun "getsebool -a | grep ${BOOLEAN}" + rlSESearchRule "allow NetworkManager_dispatcher_chronyc_t self:capability {sys_resource} [ ${BOOLEAN} ]" + INTERFACE_NAME="$(ip link show | head -n 1 | awk -F': ' '/^[0-9]+:/ {print $2}')" + + # No AVC when the boolean is turned on + rlSEBooleanOn ${BOOLEAN} + rlRun "nmcli connection up ${INTERFACE_NAME}" + sleep 5 + rlPhaseEnd + + rlPhaseStartCleanup + rlSECheckAVC + rlSEBooleanRestore ${BOOLEAN} + if [ "$INSTALLED_VARIANT" = "regular" ]; then + rlRun "yum -y install coreutils --allowerasing" + fi + rlPhaseEnd +rlJournalEnd \ No newline at end of file diff --git a/selinux-policy/cups-browsed-and-similar/Makefile b/selinux-policy/cups-browsed-and-similar/Makefile new file mode 100644 index 0000000..f78d4ec --- /dev/null +++ b/selinux-policy/cups-browsed-and-similar/Makefile @@ -0,0 +1,73 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +# Description: SELinux interferes with cups-browsed and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/cups-browsed-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with cups-browsed and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: cups" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/cups-browsed cups /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1395801" >> $(METADATA) # Fedora 26 + @echo "Bug: 1401634" >> $(METADATA) # Fedora 26 + @echo "Bug: 1719754" >> $(METADATA) # RHEL-7 + @echo "Bug: RHEL-47401" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-54579" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/cups-browsed-and-similar/PURPOSE b/selinux-policy/cups-browsed-and-similar/PURPOSE new file mode 100644 index 0000000..91bc83d --- /dev/null +++ b/selinux-policy/cups-browsed-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +Author: Milos Malik + +SELinux interferes with cups-browsed and related programs. + diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf new file mode 100644 index 0000000..ca03382 --- /dev/null +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -0,0 +1,52 @@ +summary: SELinux interferes with cups-browsed and related programs +description: |+ + SELinux interferes with cups-browsed and related programs. + +contact: Milos Malik +component: + - cups + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy + url: https://src.fedoraproject.org/tests/selinux.git +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/cups-browsed + - cups + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - RHEL8 + - f32friendly + - targeted + - NoRHIVOS +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1395801 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1401634 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1719754 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929329 + - verifies: https://issues.redhat.com/browse/RHEL-47401 + - verifies: https://issues.redhat.com/browse/RHEL-54579 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0300676 +extra-summary: /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +extra-task: /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +id: 089ae8a5-999e-415e-bf84-eaa8a77b551d diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh new file mode 100755 index 0000000..0877fdc --- /dev/null +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -0,0 +1,112 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +# Description: SELinux interferes with cups-browsed and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/cups-browsed" +FILE_CONTEXT="cupsd_exec_t" +SERVICE_NAME="cups-browsed" +PROCESS_NAME="cups-browsed" +PROCESS_CONTEXT="cupsd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + SERVICE_PACKAGE=`rpm -qf ${FILE_PATH} | head -n 1` + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlFileBackup /etc/shadow + rlFileBackup /etc/cups/cups-browsed.conf + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow initrc_t ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow initrc_t ${PROCESS_CONTEXT} : process { transition }" + rlSESearchRule "type_transition initrc_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlPhaseEnd + + rlPhaseStartTest "bz#1395801 + bz#1401634 + bz#1719754" + rlSEMatchPathCon "/usr/sbin/cups-browsed" "cupsd_exec_t" + rlSEMatchPathCon "/tmp" "tmp_t" + rlSESearchRule "allow cupsd_t tmp_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition cupsd_t tmp_t : lnk_file cupsd_tmp_t" + rlSESearchRule "allow cupsd_t cupsd_tmp_t : lnk_file { create unlink } [ ]" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "echo -en '\nBrowsePoll localhost\n' >> /etc/cups/cups-browsed.conf" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then + # RHEL-47401 closed as won't fix + # RHEL-54579 will be fixed in RHEL-10 + rlRun "mkdir -p /root/.cups" + rlRun "touch /root/.cups/lpoptions" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + # Ignore specific avc denial on rhel-9 due to RHEL-47401 + if rlIsRHEL 9 || rlIsCentOS 9; then + rlSECheckAVC --ignore 'type=AVC.*comm=cups-browsed.*name=lpoptions.*scontext=.*:cupsd_t:.*tcontext=.*:admin_home_t:.*tclass=file' + else + rlSECheckAVC + fi + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlServiceStop cups + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/cups-lpd-and-similar/Makefile b/selinux-policy/cups-lpd-and-similar/Makefile new file mode 100644 index 0000000..83fe356 --- /dev/null +++ b/selinux-policy/cups-lpd-and-similar/Makefile @@ -0,0 +1,75 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +# Description: SELinux interferes with cups-lpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/cups-lpd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with cups-lpd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: cups" >> $(METADATA) + @echo "Requires: audit expect policycoreutils-python-utils selinux-policy-devel libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console xinetd nmap-ncat nc net-tools cups-lpd chkconfig /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 192216" >> $(METADATA) # Fedora 5 + @echo "Bug: 1004198" >> $(METADATA) # RHEL-7 + @echo "Bug: 1420522" >> $(METADATA) # Fedora 24 + @echo "Bug: 1554118" >> $(METADATA) # RHEL-8 + @echo "Bug: 1919399" >> $(METADATA) # RHEL-8 + @echo "Bug: 1947397" >> $(METADATA) # RHEL-9 + @echo "Bug: 2020531" >> $(METADATA) # Fedora 35 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/cups-lpd-and-similar/PURPOSE b/selinux-policy/cups-lpd-and-similar/PURPOSE new file mode 100644 index 0000000..4bf0246 --- /dev/null +++ b/selinux-policy/cups-lpd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +Author: Milos Malik + +SELinux interferes with cups-lpd and related programs. + diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf new file mode 100644 index 0000000..cd7d489 --- /dev/null +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -0,0 +1,62 @@ +summary: SELinux interferes with cups-lpd and related programs +description: |+ + SELinux interferes with cups-lpd and related programs. + +contact: Milos Malik +component: + - cups + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy + url: https://src.fedoraproject.org/tests/selinux.git +recommend: + - audit + - expect + - policycoreutils-python-utils + - selinux-policy-devel + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - xinetd + - nmap-ncat + - nc + - net-tools + - cups-lpd + - chkconfig + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 20m +enabled: true +tag: + - NoRHEL4 + - RHEL8 + - customer_scenario + - f32friendly + - rhel9-buildroot + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=192216 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1004198 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1420522 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1554118 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919399 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1947397 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2020531 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2039449 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919173 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0305784 +extra-summary: /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +id: 544f74d0-54a4-4174-a4a0-4fe85190a5c6 diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh new file mode 100755 index 0000000..10aa060 --- /dev/null +++ b/selinux-policy/cups-lpd-and-similar/runtest.sh @@ -0,0 +1,166 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +# Description: SELinux interferes with cups-lpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/lib/cups/daemon/cups-lpd" +FILE_CONTEXT="cupsd_lpd_exec_t" +SERVICE_PACKAGE="cups-lpd" +SERVICE_NAME="cups-lpd" +PROCESS_NAME="cups-lpd" +PROCESS_CONTEXT="cupsd_lpd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + if rlIsRHEL 5 6 ; then + rlServiceStop ${SERVICE_NAME} + else + rlSocketStop ${SERVICE_NAME} + fi + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#192216" + rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" + rlSEMatchPathCon "/var/run/cups" "cupsd_var_run_t" + rlSESearchRule "allow cupsd_lpd_t cupsd_var_run_t : dir { search } [ ]" + rlSESearchRule "allow cupsd_lpd_t cupsd_lpd_t : netlink_route_socket { create } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1004198" + if rlIsRHEL 5 ; then + SOURCE_TYPE="inetd_t" # xinetd runs the process + BOOLEANS="[ cupsd_lpd_disable_trans ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="inetd_t" # xinetd runs the process + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPortCon "tcp" "515" "printer_port_t" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" + if ! rlIsRHEL 5 6 ; then + rlSESearchRule "allow ${PROCESS_CONTEXT} printer_port_t : tcp_socket { name_bind }" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#1420522 + bz#1554118" + rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" + rlSESearchRule "allow init_t cupsd_lpd_t : tcp_socket { create setopt bind listen }" + rlPhaseEnd + + rlPhaseStartTest "bz#1919399 + bz#1947397" + rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" + rlSEMatchPathCon "/run/cups/cups.sock" "cupsd_var_run_t" + rlSESearchRule "allow cupsd_lpd_t cupsd_var_run_t : sock_file { read } [ ]" + rlPhaseEnd + + if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then + rlPhaseStartTest "bz#2020531" + rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" + rlRun "ls -Z /proc/1/environ | grep :init_t" + rlSESearchRule "dontaudit cupsd_lpd_t init_t : dir { search } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlPhaseStartTest "real scenario -- bz#1919399 + bz#1947397" + rlRun "systemctl start cups.service" + rlRun "systemctl enable cups-lpd.socket" + rlRun "systemctl start cups-lpd.socket" + sleep 2 + rlRun "lpadmin -p test -o printer-is-shared=true -E" + rlRun "DEVICE_URI=lpd://127.0.0.1/test /usr/lib/cups/backend/lpd 1 user test 1 '' /etc/fstab" + sleep 5 + rlRun "lpadmin -x test" + rlRun "systemctl stop cups-lpd.socket" + rlRun "systemctl disable cups-lpd.socket" + rlRun "systemctl stop cups.service" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlPhaseStartTest "real scenario -- xinetd service" + HOST_ADDRESS="127.0.0.1" # IP address or nothing + PORT_NUMBER="515" # number or socket path + PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} on" + rlRun "service xinetd restart" + rlLog "starting provocateur job" + ( tail -f - | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + else + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + rlLog "starting provocateur job" + ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + fi + sleep 1 + rlRun "netstat -tupan | grep :${PORT_NUMBER}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} off" + rlRun "service xinetd stop" + else + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + fi + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + if rlIsRHEL 5 6 ; then + rlServiceRestore ${SERVICE_NAME} + else + rlSocketRestore ${SERVICE_NAME} + fi + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/cups-pdf-and-similar/Makefile b/selinux-policy/cups-pdf-and-similar/Makefile index b3668ab..4b09310 100644 --- a/selinux-policy/cups-pdf-and-similar/Makefile +++ b/selinux-policy/cups-pdf-and-similar/Makefile @@ -62,7 +62,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL10" >> $(METADATA) @echo "Bug: 560220" >> $(METADATA) # Fedora 12 @echo "Bug: 563977" >> $(METADATA) # Fedora 12 @echo "Bug: 570782" >> $(METADATA) # Fedora 12 @@ -72,6 +72,7 @@ $(METADATA): Makefile @echo "Bug: 1594271" >> $(METADATA) # Fedora 28 @echo "Bug: 1700442" >> $(METADATA) # Fedora 28 @echo "Bug: 1832521" >> $(METADATA) # Fedora 32 + @echo "Bug: 2234765" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index 699c0b8..7b86822 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -1,2 +1,61 @@ -path: /selinux-policy/cups-pdf-and-similar -tier: 2 +summary: SELinux interferes with cups-pdf and related programs +description: |+ + SELinux interferes with cups-pdf and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy + url: https://src.fedoraproject.org/tests/selinux.git +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - shadow-utils + - cups + - cups-pdf + - cups-client + - cups-filters +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - epel + - rhel8-epel + - rhel9-epel + - NoRHIVOS + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560220 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=563977 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=570782 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1516282 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1517509 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1532043 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1594271 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700442 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832521 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2234765 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7, rhel-10, centos-stream-10 + continue: false +extra-nitrate: TC#0607292 +extra-summary: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar +extra-task: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar +id: aa317943-d9be-4434-9731-a43601d39c00 diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index 328ad07..eb81af7 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -27,11 +27,9 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" FILE_PATH="/usr/lib/cups/backend/cups-pdf" FILE_CONTEXT="cups_pdf_exec_t" SERVICE_PACKAGE="cups-pdf" @@ -42,21 +40,26 @@ ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} rlJournalStart - if rlIsRHEL || rlIsFedora "<32"; then + if rlIsFedora "<32"; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if ! rpm -q ${SERVICE_PACKAGE} >& /dev/null ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi rlServiceStart ${SERVICE_NAME} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -103,11 +106,20 @@ rlJournalStart rlSESearchRule "type_transition cups_pdf_t var_log_t : file cupsd_log_t" rlPhaseEnd + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#1832521" rlSESearchRule "allow cups_pdf_t cups_pdf_t : unix_dgram_socket { create connect } [ ]" rlPhaseEnd + if ! rlIsRHEL "<9.3" ; then + rlPhaseStartTest "bz#2234765" + rlSESearchRule "allow cups_pdf_t kernel_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + fi + rlPhaseStartTest "real scenario -- confined users" + CREATED_USERS="" rlRun "lpadmin -x cups-pdf" 0-255 rlRun "lpadmin -p cups-pdf -v cups-pdf:/ -E -P /usr/share/cups/model/CUPS-PDF_opt.ppd" rlRun "setsebool ssh_sysadm_login on" @@ -122,12 +134,14 @@ rlJournalStart rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost lpr -P cups-pdf /usr/share/cups/data/testprint" sleep 5 rlRun "find /home/${USER_NAME} -type f | grep testprint-job" - rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" done rlRun "setsebool selinuxuser_tcp_server off" rlRun "setsebool ssh_sysadm_login off" rlRun "lpadmin -x cups-pdf" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf new file mode 100644 index 0000000..d3774c7 --- /dev/null +++ b/selinux-policy/deny-rules/main.fmf @@ -0,0 +1,37 @@ +summary: Basic functional test of the deny rules in SELinux policy +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +recommend: + - libsepol + - libsemanage + - libselinux + - policycoreutils + - selinux-policy + - strace + - expect +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 + because: deny rules are not recognized/implemented there +extra-nitrate: TC#0616661 +id: 3221e55d-6039-40f6-b9ff-6a02e85948e7 diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh new file mode 100755 index 0000000..2fb86c6 --- /dev/null +++ b/selinux-policy/deny-rules/runtest.sh @@ -0,0 +1,143 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +USER_CONTEXT=${USER_CONTEXT:-"sysadm_u:sysadm_r:sysadm_t"} +SELINUX_USER=`echo ${USER_CONTEXT} | cut -d : -f 1` +USER_ROLE=`echo ${USER_CONTEXT} | cut -d : -f 2` +USER_TYPE=`echo ${USER_CONTEXT} | cut -d : -f 3` +USER_NAME="user${RANDOM}" +USER_SECRET="S3krET${RANDOM}" + +rlJournalStart + CUR_VERSION=`rpm -q --qf "%{version}" policycoreutils | head -n 1` + if rlTestVersion ${CUR_VERSION} '<' 3.6 ; then + rlLog "The installed SELinux userspace does NOT support deny rules." + rlLog "The automated test is NOT relevant for this environment." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm libsepol + rlAssertRpm libsemanage + rlAssertRpm libselinux + rlAssertRpm policycoreutils + rlAssertRpm selinux-policy + if ! rpm -q strace ; then + rlRun "yum -y install strace" 0-255 + fi + + rlRun "setenforce 1" + rlRun "sestatus" + rlRun "useradd -o -u 0 -g 0 -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "setsebool ssh_sysadm_login on" + + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + if [ -d /etc/ssh/sshd_config.d ] ; then + rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" + fi + rlRun "service sshd restart" + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "prevent the reading of a file" + rlRun "stat /etc/shadow" 0 + rlRun "grep ^bin /etc/shadow" 0 + rlRun "echo -e '( deny ${USER_TYPE} shadow_t ( file ( getattr read )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost stat /etc/shadow" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost grep ^bin /etc/shadow" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun "semodule -r testpolicy" + rlPhaseEnd + + rlPhaseStartTest "prevent the execution of a file" + rlRun "dmesg >& /dev/null" + rlRun "echo -e '( deny ${USER_TYPE} dmesg_exec_t ( file ( execute execute_no_trans )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost dmesg" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun "semodule -r testpolicy" + rlPhaseEnd + + rlPhaseStartTest "prevent removal of a file" + if [ -f /etc/machine-id ] ; then + rlRun "cp -a /etc/machine-id /home/${USER_NAME}/" + else + rlRun "cp -a /run/machine-id /home/${USER_NAME}/" + fi + rlRun "ls -Z /home/${USER_NAME}/machine-id" + rlRun "echo -e '( deny ${USER_TYPE} machineid_t ( file ( unlink )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost rm -f /home/${USER_NAME}/machine-id" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun "semodule -r testpolicy" + rlRun "rm -f /home/${USER_NAME}/machine-id" + rlPhaseEnd + + rlPhaseStartTest "prevent the search in a directory" + rlRun "ls -lZR /etc/pki >& /dev/null" + rlRun "echo -e '( deny ${USER_TYPE} cert_t ( dir ( search )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost ls -lZR /etc/pki" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun "semodule -r testpolicy" + rlPhaseEnd + + rlPhaseStartTest "prevent ptracing of processes" + rlWatchdog "strace -p $$" 5 + rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( process ( ptrace )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost strace -p $$" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun "semodule -r testpolicy" + rlPhaseEnd + + rlPhaseStartTest "prevent loading of kernel modules" + if lsmod | grep -q dummy ; then + rlRun "modprobe -r dummy" + fi + rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( system ( module_load module_request )))' > testpolicy.cil" + rlRun "echo -e '( deny kmod_t kmod_t ( system ( module_load module_request )))' >> testpolicy.cil" + rlRun "echo -e '( deny kmod_t modules_object_t ( system ( module_load )))' >> testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost modprobe dummy" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun "lsmod | grep ^dummy" 1 + rlRun "semodule -r testpolicy" + rlRun "modprobe dummy" + rlRun "lsmod | grep dummy" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "setsebool ssh_sysadm_login off" + rlRun "userdel -rfZ ${USER_NAME}" + rlFileRestore + if [ -d /etc/ssh/sshd_config.d ] ; then + rlRun "rm -f /etc/ssh/sshd_config.d/001-enable-password.conf" + fi + rlRun "service sshd restart" + rlSECheckAVC --ignore 'type=AVC .* denied { unlink } .* comm=rm .*:sysadm_t:.*:machineid_t:.*tclass=file' --ignore 'type=AVC .* denied { module_load } .* comm=modprobe .*:kmod_t:.*:modules_object_t:.*tclass=system' --ignore 'type=AVC.*module_load.*:kmod_t:.*:kmod_t:.*tclass=system' + rlPhaseEnd +rlJournalEnd + diff --git a/selinux-policy/deny-rules/ssh.exp b/selinux-policy/deny-rules/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/deny-rules/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/dhclient-and-similar/Makefile b/selinux-policy/dhclient-and-similar/Makefile index 4779e3c..e372ff7 100644 --- a/selinux-policy/dhclient-and-similar/Makefile +++ b/selinux-policy/dhclient-and-similar/Makefile @@ -63,6 +63,9 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1897388" >> $(METADATA) # Fedora 33 + @echo "Bug: 2035117" >> $(METADATA) # Fedora 35 + @echo "Bug: 2093709" >> $(METADATA) # Fedora 36 + @echo "Bug: 2094155" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf index d61123a..909d0a7 100644 --- a/selinux-policy/dhclient-and-similar/main.fmf +++ b/selinux-policy/dhclient-and-similar/main.fmf @@ -1,2 +1,40 @@ -path: /selinux-policy/dhclient-and-similar -tier: 2 +summary: SELinux interferes with dhclient and related programs +description: |+ + SELinux interferes with dhclient and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - psmisc + - chrony + - dhcp-client +environment: + AVC_ERROR: +no_avc_check +duration: 10m +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1897388 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2035117 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093709 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094155 +adjust+: + - when: trigger == build + enabled: false + because: the test may mess up the IP address +extra-summary: /CoreOS/selinux-policy/Regression/dhclient-and-similar +extra-task: /CoreOS/selinux-policy/Regression/dhclient-and-similar +extra-nitrate: TC#0613884 +id: bce71943-38b6-428b-af69-20b9e6a60708 +tag: + - NoRHIVOS diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index 4db364a..247727e 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -27,11 +27,9 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" SERVICE_PACKAGE="chrony" SERVICE_NAME="chronyd" @@ -39,13 +37,14 @@ rlJournalStart rlLog "If this test fails, please contact mmalik on IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} rlServiceStart ${SERVICE_NAME} + rlFileBackup --missing-ok /run/chrony-dhcp rlSESetEnforce rlSEStatus @@ -53,6 +52,7 @@ rlJournalStart sleep 2 rlPhaseEnd + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#1897388" rlSEMatchPathCon "/usr/sbin/dhclient-script" "dhcpc_exec_t" rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" @@ -61,17 +61,38 @@ rlJournalStart rlSESearchRule "allow dhcpc_t chronyc_t : process { transition } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#2035117 + bz#2093709 + bz#2094155" + rlSEMatchPathCon "/usr/sbin/dhclient-script" "dhcpc_exec_t" + rlSEMatchPathCon "/run/chrony-dhcp" "chronyd_var_run_t" + rlSEMatchPathCon "/run/chrony-dhcp/eth0.sources" "chronyd_var_run_t" + rlSESearchRule "type_transition dhcpc_t var_run_t : dir chronyd_var_run_t chrony-dhcp" + rlSESearchRule "allow dhcpc_t chronyd_var_run_t : dir { read write } [ ]" + rlSESearchRule "allow dhcpc_t chronyd_var_run_t : file { create getattr append } [ ]" + rlPhaseEnd + fi + + if which dhclient >& /dev/null ; then rlPhaseStartTest "real scenario" + rlRun "rm -rf /run/chrony-dhcp" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlRun "dhclient" DHCLIENT_PID=`pgrep dhclient` rlRun "ps -efZ | grep dhclient" rlRun "ps -efZ | grep ':dhcpc_t:.*dhclient'" + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + rlRun "grep CHRONY_SOURCEDIR /etc/dhcp/dhclient.d/chrony.sh" + rlRun "grep sourcedir /etc/chrony.conf" + sleep 5 + rlRun "ls -alZ /run/chrony-dhcp" + fi rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 rlSECheckAVC kill ${DHCLIENT_PID} + rlFileRestore rlServiceRestore ${SERVICE_NAME} rlPhaseEnd rlJournalPrintText diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile new file mode 100644 index 0000000..5ed2841 --- /dev/null +++ b/selinux-policy/dhcpcd-and-similar/Makefile @@ -0,0 +1,78 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +# Description: SELinux interferes with dhcpcd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/dhcpcd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with dhcpcd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute systemd-resolved" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1585971" >> $(METADATA) # Fedora 28 + @echo "Bug: 1602343" >> $(METADATA) # Fedora 28 + @echo "Bug: RHEL-15326" >> $(METADATA) # RHEL-9 + @echo "Bug: 2269708" >> $(METADATA) # Fedora 40 + @echo "Bug: 2270733" >> $(METADATA) # Fedora 41 + @echo "Bug: RHEL-33081" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-43417" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-113937" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-113941" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-147153" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-147155" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/dhcpcd-and-similar/PURPOSE b/selinux-policy/dhcpcd-and-similar/PURPOSE new file mode 100644 index 0000000..503905e --- /dev/null +++ b/selinux-policy/dhcpcd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +Author: Milos Malik + +SELinux interferes with dhcpcd and related programs. + diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf new file mode 100644 index 0000000..1f828c1 --- /dev/null +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -0,0 +1,55 @@ +summary: SELinux interferes with dhcpcd and related programs +description: |+ + SELinux interferes with dhcpcd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - dhcpcd + - /usr/sbin/service + - iproute + - systemd-resolved +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1602343 + - verifies: https://issues.redhat.com/browse/RHEL-15326 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2269708 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270733 + - verifies: https://issues.redhat.com/browse/RHEL-33081 + - verifies: https://issues.redhat.com/browse/RHEL-43417 + - verifies: https://issues.redhat.com/browse/RHEL-113937 + - verifies: https://issues.redhat.com/browse/RHEL-113941 + - verifies: https://issues.redhat.com/browse/RHEL-147153 + - verifies: https://issues.redhat.com/browse/RHEL-147155 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + because: the dhcpcd package is not available there +extra-nitrate: TC#0574611 +extra-summary: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +id: 16f95682-f375-4789-86a5-a59b9d70ff3a diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh new file mode 100755 index 0000000..37583a1 --- /dev/null +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -0,0 +1,159 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +# Description: SELinux interferes with dhcpcd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/dhcpcd" +FILE_CONTEXT="dhcpc_exec_t" +SERVICE_PACKAGE="dhcpcd" +SERVICE_NAME="dhcpcd" +PROCESS_NAME="dhcpcd" +PROCESS_CONTEXT="dhcpc_t" + +rlJournalStart + rlPhaseStartSetup + if rlIsRHEL 4 5 6 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + rlRun "rpm -qa | grep systemd | sort" + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1585971 + bz#1602343" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/dhcpcd" "dhcpc_var_run_t" + rlSEMatchPathCon "/var/run/dhcpcd/sock" "dhcpc_var_run_t" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow dhcpc_t dhcpc_t : netlink_generic_socket { create bind }" + rlSESearchRule "allow dhcpc_t dhcpc_t : netlink_kobject_uevent_socket { create setopt bind getattr }" + rlSESearchRule "allow dhcpc_t dhcpc_t : rawip_socket { create setopt }" + rlSESearchRule "allow dhcpc_t var_run_t : dir { write add_name }" + rlSESearchRule "type_transition dhcpc_t var_run_t : sock_file dhcpc_var_run_t" + rlSESearchRule "allow dhcpc_t dhcpc_var_run_t : sock_file { create unlink }" + rlPhaseEnd + + if ( rlIsRHEL 9 && rlIsRHEL ">9.3" ) || rlIsCentOS 9 ; then + rlPhaseStartTest "RHEL-15326" + rlSESearchRule "allow dhcpc_t dhcpc_t : capability2 { bpf } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 8 && ! ( rlIsRHEL 9 && rlIsRHEL "<9.5" ); then + rlPhaseStartTest "bz#2269708 + bz#2270733" + rlSEMatchPathCon "/run/netns" "ifconfig_var_run_t" + rlSESearchRule "allow dhcpc_t ifconfig_var_run_t : dir { read } [ ]" + rlPhaseEnd + fi + + if rlIsRHEL 10 || rlIsCentOS 10 ; then + rlPhaseStartTest "RHEL-33081" + rlSEMatchPathCon "/run/dhcpcd/eth0-4.unpriv.sock" "dhcpc_var_run_t" + rlSESearchRule "allow dhcpc_t dhcpc_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-43417" + rlSESearchRule "allow dhcpc_t dhcpc_t : capability { kill } [ ]" + rlPhaseEnd + fi + + if rlIsRHEL '> 9.7' || rlIsRHEL '> 10.1' ; then + rlPhaseStartTest "RHEL-113937 + RHEL-113941" + rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "dhcpc_hook_exec_t" + CONF_FILE_CONTEXT=`secon --type --file /etc/chrony.conf` + rlSESearchRule "allow dhcpc_hook_t ${CONF_FILE_CONTEXT} : file { write } [ ]" + rlPhaseEnd + fi + + if rlIsRHEL '> 9.8' || rlIsRHEL '> 10.2' ; then + rlPhaseStartTest "RHEL-147153 + RHEL-147155" + rlSEMatchPathCon "/usr/bin/resolvectl" "bin_t" + rlSESearchRule "allow dhcpc_hook_t dhcpc_hook_t : unix_dgram_socket { create ioctl } [ ]" + rlSESearchRule "allow dhcpc_hook_t init_t : unix_stream_socket { getattr } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlIsRHEL "<9.5" ; then + rlRun "ip netns add test-ns" + rlRun "ip netns del test-ns" + rlRun "ls -lZR /run/netns" + fi + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/dmidecode-and-similar/Makefile b/selinux-policy/dmidecode-and-similar/Makefile new file mode 100644 index 0000000..03a223f --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/Makefile @@ -0,0 +1,74 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/dmidecode-and-similar +# Description: SELinux interferes with dmidecode and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/dmidecode-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with dmidecode and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: dmidecode" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dmidecode selinux-policy-devel shadow-utils openssh-clients expect" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 263141" >> $(METADATA) # RHEL-5 + @echo "Bug: 1289274" >> $(METADATA) # RHEL-7 + @echo "Bug: 1300799" >> $(METADATA) # RHEL-7 + @echo "Bug: 1608480" >> $(METADATA) # RHEL-7 + @echo "Bug: 1926696" >> $(METADATA) # Fedora 34 + @echo "Bug: RHEL-16104" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/dmidecode-and-similar/PURPOSE b/selinux-policy/dmidecode-and-similar/PURPOSE new file mode 100644 index 0000000..06eaabe --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/dmidecode-and-similar +Author: Milos Malik + +SELinux interferes with dmidecode and related programs. + diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf new file mode 100644 index 0000000..2a1b60d --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/main.fmf @@ -0,0 +1,55 @@ +summary: SELinux interferes with dmidecode and related programs +description: |+ + SELinux interferes with dmidecode and related programs. + +contact: Milos Malik +component: + - selinux-policy + - dmidecode +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - dmidecode + - selinux-policy-devel + - shadow-utils + - openssh-clients + - expect +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=263141 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1289274 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1300799 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1608480 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1926696 + - verifies: https://issues.redhat.com/browse/RHEL-16104 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false + - enabled: false + when: arch != aarch64 and arch != i386 and arch != x86_64 + continue: false +extra-nitrate: TC#0550595 +extra-summary: /CoreOS/selinux-policy/Regression/dmidecode-and-similar +extra-task: /CoreOS/selinux-policy/Regression/dmidecode-and-similar +id: 8b3954c3-5475-4a03-aad9-0a31a68bcdce diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh new file mode 100755 index 0000000..b8ff02c --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -0,0 +1,168 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/dmidecode-and-similar +# Description: SELinux interferes with dmidecode and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ALLOWED_USERS=${ALLOWED_USERS:-"sysadm_u unconfined_u"} +DENIED_USERS=${DENIED_USERS:-"staff_u user_u guest_u xguest_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm dmidecode + + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#263141" + rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" + rlSESearchRule "allow dmidecode_t sysfs_t : dir { getattr open search } [ ]" + rlSESearchRule "allow dmidecode_t sysfs_t : file { getattr open read } [ ]" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1289274" + rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" + rlSEMatchPathCon "/dev/urandom" "urandom_device_t" + rlSESearchRule "allow dmidecode_t urandom_device_t : chr_file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1300799" + rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" + rlSEMatchPathCon "/run/lock/subsys/rhsmcertd" "rhsmcertd_lock_t" + rlSEMatchPathCon "/var/log/rhsm/rhsm.log" "rhsmcertd_log_t" + rlSESearchRule "allow dmidecode_t rhsmcertd_lock_t : file { open }" + rlSESearchRule "allow dmidecode_t rhsmcertd_log_t : file { open read }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1608480" + rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" + rlSESearchRule "allow rhsmcertd_t dmidecode_exec_t : file { map } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- runcon" + # this TC does not belong to the small set of SELinux domains which can run dmidecode in the system_u:system_r:dmidecode_t:s0 context, therefore we need some help + # TODO: use sysadm_t user instead of initrc_t to run dmidecode, because sysadm_t is allowed to transition to dmidecode_t + rlRun "ls -l testpolicy.*" + rlRun "make -f /usr/share/selinux/devel/Makefile testpolicy.pp" + rlRun "semodule -i testpolicy.pp" + + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/dmidecode" + if [ -f /usr/sbin/biosdecode ] ; then + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/biosdecode" + fi + if [ -f /usr/sbin/vpddecode ] ; then + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/vpddecode" + fi + if [ -f /usr/sbin/ownership ] ; then + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/ownership" + fi + + rlRun "semodule -l | grep testpolicy" + rlRun "semodule -r testpolicy" + rlRun "semodule -l | grep testpolicy" 1 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- confined users" + CREATED_USERS="" + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -o -u 0 -g 0 -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + if [ -f /usr/sbin/dmidecode ] ; then + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/dmidecode" + fi + if [ -f /usr/sbin/biosdecode ] ; then + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/biosdecode" + fi + if [ -f /usr/sbin/vpddecode ] ; then + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/vpddecode" + fi + if [ -f /usr/sbin/ownership ] ; then + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/ownership" + fi + sleep 2 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + rlPhaseEnd + + if ! rlIsRHEL "<9.5"; then + rlPhaseStartTest "RHEL-16104" + rlSEMatchPathCon "/var" "var_t" + rlSEMatchPathCon "/var/log" "var_log_t" + rlSEMatchPathCon "/var/log/sudo-io" "sudo_log_t" + rlSESearchRule "allow sysadm_sudo_t var_t : dir { read } [ ]" + rlSESearchRule "allow sysadm_sudo_t var_log_t : dir { read } [ ]" + rlSESearchRule "allow sysadm_sudo_t sudo_log_t : dir { read } [ ]" + rlRun "setsebool ssh_sysadm_login on" + rlRun "useradd -Z sysadm_u -G wheel sysadm-user" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "echo ${USER_SECRET} | passwd --stdin sysadm-user" + rlRun "echo -en 'Defaults log_output\nDefaults log_input\nDefaults iolog_dir=/var/log/sudo-io\nsysadm-user ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/sysadm-user" + rlRun "rm -rf /var/log/sudo-io" + rlRun -s "./ssh.exp sysadm-user ${USER_SECRET} localhost sudo dmidecode" + rlRun "grep DMI $rlRun_LOG" + rlRun "rm -f $rlRun_LOG" + rlRun "rm -rf /var/log/sudo-io" + rlRun -s "./ssh.exp sysadm-user ${USER_SECRET} localhost sudo -r sysadm_r dmidecode" + rlRun "grep DMI $rlRun_LOG" + rlRun "rm -f $rlRun_LOG" + rlRun "rm -f /etc/sudoers.d/sysadm-user" + rlRun "userdel -rfZ sysadm-user" + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/dmidecode-and-similar/ssh.exp b/selinux-policy/dmidecode-and-similar/ssh.exp new file mode 100755 index 0000000..1244013 --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command ; sleep 5" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/dmidecode-and-similar/testpolicy.te b/selinux-policy/dmidecode-and-similar/testpolicy.te new file mode 100644 index 0000000..9f732dd --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/testpolicy.te @@ -0,0 +1,18 @@ +policy_module(testpolicy,1.0) + +require { + type initrc_t; + type dmidecode_t; + type dmidecode_exec_t; + type console_device_t; + class file { getattr open read execute }; + class process { transition }; + class chr_file { read write }; +} + +allow initrc_t dmidecode_exec_t : file { getattr open read execute }; +type_transition initrc_t dmidecode_exec_t : process dmidecode_t; +allow initrc_t dmidecode_t : process { transition }; +allow dmidecode_t initrc_t:process { sigchld }; +allow dmidecode_t console_device_t : chr_file { read write }; + diff --git a/selinux-policy/exim-and-similar/Makefile b/selinux-policy/exim-and-similar/Makefile new file mode 100644 index 0000000..4982ecb --- /dev/null +++ b/selinux-policy/exim-and-similar/Makefile @@ -0,0 +1,74 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/exim-and-similar +# Description: SELinux interferes with exim and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/exim-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with exim and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console at exim lsof" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 1025315" >> $(METADATA) # RHEL-6 + @echo "Bug: 1444441" >> $(METADATA) # RHEL-7 + @echo "Bug: RHEL-14110" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-14186" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-21902" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-21903" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-94268" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/exim-and-similar/PURPOSE b/selinux-policy/exim-and-similar/PURPOSE new file mode 100644 index 0000000..8501e39 --- /dev/null +++ b/selinux-policy/exim-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/exim-and-similar +Author: Milos Malik + +SELinux interferes with exim and related programs. + diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf new file mode 100644 index 0000000..de59c51 --- /dev/null +++ b/selinux-policy/exim-and-similar/main.fmf @@ -0,0 +1,61 @@ +summary: SELinux interferes with exim and related programs +description: |+ + SELinux interferes with exim and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/service + - setools-console + - at + - exim + - lsof +environment: + AVC_ERROR: +no_avc_check +duration: 5m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted + - epel + - rhel8-epel + - rhel9-epel + - rhel10-epel + - NoRHIVOS + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1025315 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1444441 + - verifies: https://issues.redhat.com/browse/RHEL-14110 + - verifies: https://issues.redhat.com/browse/RHEL-14186 + - verifies: https://issues.redhat.com/browse/RHEL-21902 + - verifies: https://issues.redhat.com/browse/RHEL-21903 + - verifies: https://issues.redhat.com/browse/RHEL-94268 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-alt-7 + continue: false + - enabled: false + when: arch == i386, ppc64, s390 + continue: false +extra-nitrate: TC#0057402 +extra-summary: /CoreOS/selinux-policy/Regression/exim-and-similar +extra-task: /CoreOS/selinux-policy/Regression/exim-and-similar +id: 4b7d4e3b-8ab3-4cab-b984-13be2a78252f diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh new file mode 100755 index 0000000..01b5036 --- /dev/null +++ b/selinux-policy/exim-and-similar/runtest.sh @@ -0,0 +1,145 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/exim-and-similar +# Description: SELinux interferes with exim and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/exim" +FILE_CONTEXT="exim_exec_t" +SERVICE_PACKAGE="exim" +SERVICE_NAME="exim" +PROCESS_NAME="exim" +PROCESS_CONTEXT="exim_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlFileBackup /etc/exim/exim.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#1025315" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + rlSEMatchPathCon "/sys/devices/system/cpu" "sysfs_t" + rlSEMatchPathCon "/sys/devices/system/cpu/online" "sysfs_t" + rlSESearchRule "allow exim_t sysfs_t : file { getattr open read }" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + rlSEMatchPathCon "/sys/devices/system/cpu" "sysfs_t" + rlSEMatchPathCon "/sys/devices/system/cpu/online" "cpu_online_t" + rlSESearchRule "allow exim_t cpu_online_t : file { getattr open read }" + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow exim_t sysfs_t : dir { search }" + rlPhaseEnd + fi + + if rlIsRHEL 7 ; then + rlPhaseStartTest "bz#1444441" + rlSEMatchPathCon "/usr/sbin/exim" "exim_exec_t" + rlSESearchRule "allow exim_t sysctl_net_t : dir { getattr open search } [ ]" + rlSESearchRule "allow exim_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if rlIsRHEL 8 || ( rlIsRHEL 9 && rlIsRHEL ">9.3" ) || rlIsCentOS 8 9 ; then + rlPhaseStartTest "RHEL-21902 + RHEL-21903" + rlSEMatchPathCon "/var/spool/exim/exim_daemon_notify" "exim_spool_t" + rlSESearchRule "allow exim_t exim_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + fi + + if rlIsRHEL '>9.6' || rlIsRHEL '>10.0' || rlIsFedora ; then + rlPhaseStartTest "RHEL-94268" + rlRun "ls -dZ /proc/sys/net/ | grep :sysctl_net_t" + rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + rlSESearchRule "allow exim_t sysctl_net_t : dir { search } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="sendmail_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "lsof | grep exim_daemon_notify" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + if ! ( rlIsRHEL 9 && rlIsRHEL "<9.4" ) ; then + rlPhaseStartTest "real scenario -- RHEL-14110 + RHEL-14186" + rlSEMatchPathCon "/var/spool/exim/input" "exim_spool_t" + rlSESearchRule "allow system_mail_t exim_spool_t : dir { create } [ ]" + rlRun "sed -i 's/^.*\(split_spool_directory\).*=.*$/\1 = true/' /etc/exim/exim.conf" + rlRun "service exim start" + rlRun "service atd start" + rlRun "echo '/usr/bin/id -Z' | at now" + sleep 15s + rlRun "ls -lZ /var/spool/exim/input" + rlRun "service atd stop" + rlRun "service exim stop" + rlPhaseEnd + fi + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/fapolicyd-and-similar/Makefile b/selinux-policy/fapolicyd-and-similar/Makefile index 5ceb8a2..17eef10 100644 --- a/selinux-policy/fapolicyd-and-similar/Makefile +++ b/selinux-policy/fapolicyd-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: fapolicyd" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console fapolicyd fapolicyd-selinux" >> $(METADATA) + @echo "Requires: audit /usr/sbin/service libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console fapolicyd fapolicyd-selinux systemd-container" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -66,6 +66,8 @@ $(METADATA): Makefile @echo "Bug: 1865818" >> $(METADATA) # RHEL-8 @echo "Bug: 1874491" >> $(METADATA) # Fedora 33 @echo "Bug: 1876538" >> $(METADATA) # Fedora 33 + @echo "Bug: 1932225" >> $(METADATA) + @echo "Bug: RHEL-77071" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index 8faf6ba..e4e8de2 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -1,2 +1,51 @@ -path: /selinux-policy/fapolicyd-and-similar -tier: 2 +summary: SELinux interferes with fapolicyd and related programs +description: |+ + SELinux interferes with fapolicyd and related programs. + +contact: Milos Malik +component: + - fapolicyd + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - /usr/sbin/service + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - fapolicyd + - fapolicyd-selinux + - systemd-container +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - fedora-wanted + - failinfedora + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1865818 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1874491 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1876538 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932225 + - verifies: https://issues.redhat.com/browse/RHEL-77071 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0608224 +extra-summary: /CoreOS/selinux-policy/Regression/fapolicyd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/fapolicyd-and-similar +id: b489ccc7-3f8e-452d-b46f-37dcc6d1a64d diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh index 720f008..21e183b 100755 --- a/selinux-policy/fapolicyd-and-similar/runtest.sh +++ b/selinux-policy/fapolicyd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -41,7 +40,7 @@ PROCESS_CONTEXT="fapolicyd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -88,6 +87,22 @@ rlJournalStart rlSESearchRule "allow fapolicyd_t rpm_var_lib_t : file { create } [ ]" rlPhaseEnd + if seinfo --common file -x | grep -q watch ; then + rlPhaseStartTest "bz#1932225" + rlSEMatchPathCon "/boot" "boot_t" + rlSEMatchPathCon "/" "root_t" + rlSEMatchPathCon "/dev/shm" "tmpfs_t" + rlSEMatchPathCon "/tmp" "tmp_t" + rlSEMatchPathCon "/run/user/0" "user_tmp_t" + rlSESearchRule "allow fapolicyd_t boot_t : dir { watch_mount watch_with_perm } [ ]" + rlSESearchRule "allow fapolicyd_t root_t : dir { watch_mount watch_with_perm } [ ]" + rlSESearchRule "allow fapolicyd_t tmpfs_t : dir { watch_mount watch_with_perm } [ ]" + rlSESearchRule "allow fapolicyd_t tmp_t : dir { watch_mount watch_with_perm } [ ]" + rlSESearchRule "allow fapolicyd_t user_tmp_t : dir { watch_mount watch_with_perm } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -95,9 +110,25 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "RHEL-77071" + if rlIsCentOS 10 || rlIsRHEL 10 ; then + rlSESearchRule "allow fapolicyd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" + fi + rlRun "service systemd-machined start" + rlRun "service systemd-machined status -l" + rlRun "service fapolicyd start" + rlRun "service fapolicyd status -l" + sleep 5 + rlRun "service fapolicyd stop" + rlRun "service systemd-machined stop" + rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/fedora-third-party-and-similar/Makefile b/selinux-policy/fedora-third-party-and-similar/Makefile new file mode 100644 index 0000000..0f350ab --- /dev/null +++ b/selinux-policy/fedora-third-party-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +# Description: SELinux interferes with the fedora-third-party service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the fedora-third-party service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service fedora-third-party" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Bug: 2093453" >> $(METADATA) # Fedora 37 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/fedora-third-party-and-similar/PURPOSE b/selinux-policy/fedora-third-party-and-similar/PURPOSE new file mode 100644 index 0000000..a57c27d --- /dev/null +++ b/selinux-policy/fedora-third-party-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +Author: Milos Malik + +SELinux interferes with the fedora-third-party service and related programs. + diff --git a/selinux-policy/fedora-third-party-and-similar/main.fmf b/selinux-policy/fedora-third-party-and-similar/main.fmf new file mode 100644 index 0000000..e1a16d5 --- /dev/null +++ b/selinux-policy/fedora-third-party-and-similar/main.fmf @@ -0,0 +1,47 @@ +summary: SELinux interferes with the fedora-third-party service and related programs +description: |+ + SELinux interferes with the fedora-third-party service and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - fedora-third-party +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - targeted + - NoRHIVOS +tier: 2 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093453 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + because: the fedora-third-party package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +extra-task: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +extra-nitrate: TC#0614304 +id: 98743019-2a5a-48c2-9be6-7b8caa3add4d diff --git a/selinux-policy/fedora-third-party-and-similar/runtest.sh b/selinux-policy/fedora-third-party-and-similar/runtest.sh new file mode 100755 index 0000000..bc6e4a3 --- /dev/null +++ b/selinux-policy/fedora-third-party-and-similar/runtest.sh @@ -0,0 +1,97 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +# Description: SELinux interferes with the fedora-third-party service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/fedora-third-party" +FILE_CONTEXT="fedoratp_exec_t" +SERVICE_PACKAGE="fedora-third-party" +SERVICE_NAME="fedora-third-party-refresh" +PROCESS_NAME="fedora-third-party" +PROCESS_CONTEXT="fedoratp_t" + +rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup --missing-ok /run/ostree-booted + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2093453" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/etc/passwd" "passwd_file_t" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow ${PROCESS_CONTEXT} passwd_file_t : file { getattr open read } [ ]" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for OSes where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "touch /run/ostree-booted" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlRun "fedora-third-party list" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlRun "rm -f /run/ostree-booted" + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/files-ownership/main.fmf b/selinux-policy/files-ownership/main.fmf new file mode 100644 index 0000000..302f725 --- /dev/null +++ b/selinux-policy/files-ownership/main.fmf @@ -0,0 +1,27 @@ +summary: test if selinux-policy owns tree with interface files +contact: Veronika Syncakova +test: ./runtest.sh +duration: 5m +enabled: true +require: + - selinux-policy +recommend: + - selinux-policy-targeted + - selinux-policy-mls + - selinux-policy-minimum +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-141659 + - verifies: https://redhat.atlassian.net/browse/RHEL-157952 + - verifies: https://redhat.atlassian.net/browse/FC-1681 +id: ee9a0250-4a0a-4c56-bf4e-15228324dbc5 + diff --git a/selinux-policy/files-ownership/runtest.sh b/selinux-policy/files-ownership/runtest.sh new file mode 100755 index 0000000..d5e79f1 --- /dev/null +++ b/selinux-policy/files-ownership/runtest.sh @@ -0,0 +1,47 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of selinux-policy/files-ownership/runtest.sh +# Description: test if selinux-policy owns tree with interface files +# Author: Veronika Syncakova +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm selinux-policy + rlPhaseEnd + + rlPhaseStartTest "RHEL-141659 + RHEL-157952 + FC-1681" + for LOCATION in devel devel/include devel/include/distributed \ + packages/targeted packages/minimum packages/mls; do + rlRun -s "rpm -qf /usr/share/selinux/${LOCATION}" + rlAssertGrep "selinux-policy-" $rlRun_LOG -i + rm -f $rlRun_LOG + done + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd \ No newline at end of file diff --git a/selinux-policy/firewalld-and-similar/Makefile b/selinux-policy/firewalld-and-similar/Makefile new file mode 100644 index 0000000..1912dab --- /dev/null +++ b/selinux-policy/firewalld-and-similar/Makefile @@ -0,0 +1,88 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/firewalld-and-similar +# Description: SELinux interferes with firewalld and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/firewalld-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with firewalld and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: firewalld" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console firewalld glib2 nftables procps-ng /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 907902" >> $(METADATA) # RHEL-7 + @echo "Bug: 989922" >> $(METADATA) # RHEL-7 + @echo "Bug: 1067494" >> $(METADATA) # RHEL-7 + @echo "Bug: 1214853" >> $(METADATA) # RHEL-7 + @echo "Bug: 1221326" >> $(METADATA) # RHEL-7 + @echo "Bug: 1243403" >> $(METADATA) # RHEL-7 + @echo "Bug: 1284902" >> $(METADATA) # RHEL-7 + @echo "Bug: 1304721" >> $(METADATA) # RHEL-7 + @echo "Bug: 1304723" >> $(METADATA) # RHEL-7 + @echo "Bug: 1342235" >> $(METADATA) # RHEL-7 + @echo "Bug: 1342587" >> $(METADATA) # RHEL-7 + @echo "Bug: 1346316" >> $(METADATA) # RHEL-7 + @echo "Bug: 1375576" >> $(METADATA) # RHEL-7 + @echo "Bug: 1418391" >> $(METADATA) # RHEL-7 + @echo "Bug: 1438708" >> $(METADATA) # RHEL-7 + @echo "Bug: 1573501" >> $(METADATA) # RHEL-8 + @echo "Bug: 1593687" >> $(METADATA) # RHEL-8 + @echo "Bug: 1600903" >> $(METADATA) # RHEL-8 + @echo "Bug: 1759010" >> $(METADATA) # RHEL-8 + @echo "Bug: 1989641" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/firewalld-and-similar/PURPOSE b/selinux-policy/firewalld-and-similar/PURPOSE new file mode 100644 index 0000000..04c3f20 --- /dev/null +++ b/selinux-policy/firewalld-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/firewalld-and-similar +Author: Milos Malik + +SELinux interferes with firewalld and related programs. + diff --git a/selinux-policy/firewalld-and-similar/main.fmf b/selinux-policy/firewalld-and-similar/main.fmf new file mode 100644 index 0000000..ec559bc --- /dev/null +++ b/selinux-policy/firewalld-and-similar/main.fmf @@ -0,0 +1,72 @@ +summary: SELinux interferes with firewalld and related programs +description: |+ + SELinux interferes with firewalld and related programs. + +contact: Milos Malik +component: + - selinux-policy + - firewalld +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - firewalld + - glib2 + - nftables + - procps-ng + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIP_fedora_pass + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - NoRHIVOS +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=907902 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=989922 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1067494 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1214853 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1221326 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243403 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1284902 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1304721 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1304723 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1342235 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1342587 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1346316 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1375576 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1418391 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1438708 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1573501 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593687 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600903 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1759010 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1989641 +adjust+: + - enabled: false + when: distro < rhel-7 + continue: false +extra-nitrate: TC#0175059 +extra-summary: /CoreOS/selinux-policy/Regression/firewalld-and-similar +extra-task: /CoreOS/selinux-policy/Regression/firewalld-and-similar +id: e856e8cc-0893-457b-a1ef-a71c09b6fef9 diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh new file mode 100755 index 0000000..496e8d0 --- /dev/null +++ b/selinux-policy/firewalld-and-similar/runtest.sh @@ -0,0 +1,235 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/firewalld-and-similar +# Description: SELinux interferes with firewalld and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_PACKAGE="firewalld" +SERVICE_NAME="firewalld" +PROCESS_NAME="firewalld" +PROCESS_CONTEXT="firewalld_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/firewalld/lockdown-whitelist.xml + rlFileBackup /etc/shadow + rlFileBackup /run/firewalld + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#907902" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/usr/lib64/python2.7/site.pyc" "lib_t" + rlSESearchRule "allow firewalld_t lib_t : dir { getattr open read search }" + rlSESearchRule "allow firewalld_t lib_t : file { getattr open read execute }" + rlPhaseEnd + + rlPhaseStartTest "bz#989922" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/etc/firewalld/lockdown-whitelist.xml" "firewalld_etc_rw_t" + rlSESearchRule "allow firewalld_t firewalld_etc_rw_t : lnk_file { getattr read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1067494" + for USER_TYPE in user_t staff_t unconfined_t ; do + rlSESearchRule "allow ${USER_TYPE} firewalld_t : dbus { send_msg }" + rlSESearchRule "allow firewalld_t ${USER_TYPE} : dbus { send_msg }" + done + rlPhaseEnd + + if rlSEDefined "puppetagent_t" ; then + rlPhaseStartTest "bz#1214853" + rlSESearchRule "allow firewalld_t puppetagent_t : dbus { send_msg }" + rlSESearchRule "allow puppetagent_t firewalld_t : dbus { send_msg }" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#1221326" + rlSESearchRule "allow firewalld_t openshift_initrc_t : dbus { send_msg }" + rlSESearchRule "allow openshift_initrc_t firewalld_t : dbus { send_msg }" + rlPhaseEnd + + rlPhaseStartTest "bz#1243403" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/xtables.lock" "iptables_var_run_t" + rlSESearchRule "allow iptables_t iptables_var_run_t : file { getattr open read lock } [ ]" + rlSESearchRule "type_transition iptables_t var_run_t : file iptables_var_run_t [ ]" + rlSESearchRule "allow iptables_t var_run_t : dir { read write add_name remove_name getattr open search } [ ]" + rlRun "sesearch -s unconfined_t -t var_run_t -c file -T | grep \"iptables_var_run_t.*xtables.lock\"" + rlPhaseEnd + + rlPhaseStartTest "bz#1284902" + rlSESearchRule "allow firewalld_t system_cronjob_t : dbus { send_msg }" + rlSESearchRule "allow system_cronjob_t firewalld_t : dbus { send_msg }" + rlPhaseEnd + + rlPhaseStartTest "bz#1342235" + rlSEMatchPathCon "/var/run/firewalld" "firewalld_var_run_t" + rlSESearchRule "allow iptables_t firewalld_var_run_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1304723 + bz#1346316" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/var/log" "var_log_t" + rlSEMatchPathCon "/var/log/firewalld" "firewalld_var_log_t" + rlSEMatchPathCon "/etc/sysconfig/network-scripts" "net_conf_t" + rlSEMatchPathCon "/etc/sysconfig/network-scripts/ifcfg-enp0s25.NdcLYC" "net_conf_t" + rlSESearchRule "allow firewalld_t var_log_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition firewalld_t var_log_t : file firewalld_var_log_t [ ]" + rlSESearchRule "allow firewalld_t firewalld_var_log_t : file { create } [ ]" + rlSESearchRule "allow firewalld_t net_conf_t : dir { write add_name }" + rlSESearchRule "allow firewalld_t net_conf_t : file { getattr open read write rename create unlink setattr }" + rlPhaseEnd + + rlPhaseStartTest "bz#1342587" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/firewalld" "firewalld_var_run_t" + rlSESearchRule "allow firewalld_t var_run_t : dir { read write add_name remove_name getattr open search } [ ]" + rlSESearchRule "type_transition firewalld_t var_run_t : dir firewalld_var_run_t [ ]" + rlSESearchRule "allow firewalld_t firewalld_var_run_t : dir { create } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1304721" + rlSESearchRule "allow firewalld_t firewalld_etc_rw_t : file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open } ;" + rlPhaseEnd + + rlPhaseStartTest "bz#1418391" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSESearchRule "allow firewalld_t modules_object_t : dir { getattr open read search }" + rlPhaseEnd + + rlPhaseStartTest "bz#1438708" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/root" "admin_home_t" + rlSESearchRule "dontaudit firewalld_t admin_home_t : dir { write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1375576" + rlSESearchRule "allow firewalld_t ldconfig_exec_t : file { getattr open read execute_no_trans } [ ]" + rlSESearchRule "type_transition firewalld_t ldconfig_exec_t : process ldconfig_t" 1 + rlSESearchRule "allow firewalld_t ldconfig_t : process { transition }" 1 + rlPhaseEnd + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1573501 + bz#1593687 + bz#1600903" + rlSEMatchPathCon "/usr/sbin/nft" "iptables_exec_t" + rlSESearchRule "allow firewalld_t firewalld_t : netlink_netfilter_socket { create }" + rlSESearchRule "allow firewalld_t kernel_t : system { module_request } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1759010" + rlSEMatchPathCon "/root/.cache" "cache_home_t" + rlSEMatchPathCon "/home/user/.cache" "cache_home_t" + rlSESearchRule "dontaudit firewalld_t firewalld_t : capability { dac_override }" + rlSESearchRule "allow firewalld_t cache_home_t : dir { create }" 1 + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "remnants from BZ#1574383" + rlSESearchRule "allow firewalld_t iptables_exec_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then + rlPhaseStartTest "bz#1989641" + rlSESearchRule "allow firewalld_t firewalld_t : capability { setpcap } [ ]" + rlSESearchRule "allow firewalld_t firewalld_t : process { setcap } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- bz#1304721" + rlServiceStart "firewalld" + rlRun "firewall-cmd --add-port 1234/tcp --permanent" + rlRun "firewall-cmd --remove-port 1234/tcp --permanent" + rlPhaseEnd + + DESTINATION="org.fedoraproject.FirewallD1" + if busctl | grep -iq ${DESTINATION} ; then + rlPhaseStartTest "real scenario -- DBus service" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlServiceStop "firewalld" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlRun "rm -rf /run/firewalld" + rlRun "rm -f /run/xtables.lock" + if [ -f /etc/firewalld/lockdown-whitelist.xml ] ; then + rlRun "mv /etc/firewalld/lockdown-whitelist.xml /etc/firewalld/lockdown-whitelist.xml.orig" + rlRun "ln -s /etc/firewalld/lockdown-whitelist.xml.orig /etc/firewalld/lockdown-whitelist.xml" + fi + # see https://bugzilla.redhat.com/show_bug.cgi?id=907902#c7 + # rlRun "rm -f /usr/lib{,64}/python2.7/site.{pyc,pyo}" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "rm -f /etc/firewalld/lockdown-whitelist.xml*" + rlRun "ls -dZ /run/firewalld | grep :firewalld_var_run_t" + if rlIsRHEL 7 ; then + rlRun "ls -Z /run/xtables.lock | grep :iptables_var_run_t" + fi + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/fwupd-and-similar/Makefile b/selinux-policy/fwupd-and-similar/Makefile new file mode 100644 index 0000000..be34447 --- /dev/null +++ b/selinux-policy/fwupd-and-similar/Makefile @@ -0,0 +1,73 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/fwupd-and-similar +# Description: SELinux interferes with fwupd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/fwupd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with fwupd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: fwupd" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 fwupd /usr/sbin/service expect" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + @echo "Bug: 1772619" >> $(METADATA) # RHEL-8 + @echo "Bug: 1832231" >> $(METADATA) # RHEL-8 + @echo "Bug: 1832234" >> $(METADATA) # RHEL-8 + @echo "Bug: 1832772" >> $(METADATA) # RHEL-8 + @echo "Bug: 1851932" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/fwupd-and-similar/PURPOSE b/selinux-policy/fwupd-and-similar/PURPOSE new file mode 100644 index 0000000..b988125 --- /dev/null +++ b/selinux-policy/fwupd-and-similar/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/fwupd-and-similar +Author: Milos Malik + +SELinux interferes with fwupd and related programs. +Standalone service and confined users are tested. + diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf new file mode 100644 index 0000000..237d4da --- /dev/null +++ b/selinux-policy/fwupd-and-similar/main.fmf @@ -0,0 +1,54 @@ +summary: SELinux interferes with fwupd and related programs +description: |+ + SELinux interferes with fwupd and related programs. + Standalone service and confined users are tested. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - fwupd + - /usr/sbin/service + - expect +environment: + AVC_ERROR: +no_avc_check + ALLOWED_USERS: staff_u user_u sysadm_u unconfined_u + DENIED_USERS: guest_u xguest_u +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TierCandidatesPASS + - targeted + - NoRHIVOS +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772619 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832231 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832234 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832772 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851932 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1860924 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0563429 +extra-summary: /CoreOS/selinux-policy/Regression/fwupd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/fwupd-and-similar +id: 12996742-5ad6-4dd2-b04d-b4c781fcce79 diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh new file mode 100755 index 0000000..eaf601a --- /dev/null +++ b/selinux-policy/fwupd-and-similar/runtest.sh @@ -0,0 +1,188 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/fwupd-and-similar +# Description: SELinux interferes with fwupd and related programs. +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/fwupd/fwupd" +FILE_CONTEXT="fwupd_exec_t" +SERVICE_PACKAGE="fwupd" +SERVICE_NAME="fwupd" +PROCESS_NAME="fwupd" +PROCESS_CONTEXT="fwupd_t" +ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} +DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + fi + + DESTINATION="org.freedesktop.fwupd" + if busctl | grep -iq ${DESTINATION} ; then + rlPhaseStartTest "real scenario -- DBus service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # RHEL-4, RHEL-5, RHEL-6 is excluded + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" 0,1 + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # RHEL-4, RHEL-5, RHEL-6 is excluded + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + if rlSEDefined "fwupd_t" ; then + rlPhaseStartTest "bz#1772619" + # TODO: find an agreement about which confined users should be allowed + rlSESearchRule "allow staff_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t staff_t : dbus { send_msg } [ ]" + rlSESearchRule "allow user_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t user_t : dbus { send_msg } [ ]" + rlSESearchRule "allow sysadm_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t sysadm_t : dbus { send_msg } [ ]" + rlSESearchRule "allow unconfined_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t unconfined_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + + if rlSEDefined "fwupd_var_lib_t" ; then + rlPhaseStartTest "bz#1832231" + rlSEMatchPathCon "/var/lib/fwupd" "fwupd_var_lib_t" + rlSESearchRule "allow init_t fwupd_var_lib_t : dir { setattr } [ init_create_dirs ]" + rlPhaseEnd + fi + + if rlSEDefined "fwupd_cache_t" ; then + rlPhaseStartTest "bz#1832234" + rlSEMatchPathCon "/var/cache/fwupd" "fwupd_cache_t" + rlSEMatchPathCon "/var/cache/fwupd/motd.d" "fwupd_cache_t" + rlSEMatchPathCon "/var/cache/fwupd/motd.d/85-fwupd" "fwupd_cache_t" + rlSESearchRule "allow init_t pam_var_run_t : dir { mounton } [ init_create_dirs ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1851932" + rlSESearchRule "allow systemd_logind_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t systemd_logind_t : dbus { send_msg } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1832772" + rlSEMatchPathCon "/dev/shm/lldpad.state" "lldpad_tmpfs_t" + rlSESearchRule "allow init_t lldpad_tmpfs_t : file { getattr } [ ]" + rlSESearchRule "allow init_t squid_tmpfs_t : file { getattr } [ ]" + rlSESearchRule "allow init_t vhostmd_tmpfs_t : file { getattr } [ ]" + rlSESearchRule "allow init_t wdmd_tmpfs_t : file { getattr } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#1832772" + rlRun "ls -Z /dev/shm" + rlRun "service fwupd-refresh start" 0-255 + sleep 1 + rlRun "service fwupd-refresh status" 0-255 + sleep 1 + rlRun "service fwupd-refresh stop" 0-255 + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- confined users -- bz#1772619" + CREATED_USERS="" + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost fwupdmgr get-devices" + sleep 2 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/fwupd-and-similar/ssh.exp b/selinux-policy/fwupd-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/fwupd-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index 2ddf9f6..6c545f7 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -1,5 +1,48 @@ -path: /selinux-policy/getrlimit-permission -tier: 2 -adjust: -- enabled: false - when: distro < rhel-7 +summary: Is the getrlimit permission defined? Are appropriate checks applied? +description: |+ + Is the getrlimit permission defined? Are { getrlimit } SELinux denials triggered when certain access happens? + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - util-linux +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - f33friendly + - targeted + - NoRHIVOS +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549691 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549772 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0574397 +extra-summary: /CoreOS/selinux-policy/Sanity/getrlimit-permission +extra-task: /CoreOS/selinux-policy/Sanity/getrlimit-permission +id: d266c52f-08b3-4ab6-80bb-c41370e9e8b2 diff --git a/selinux-policy/getrlimit-permission/runtest.sh b/selinux-policy/getrlimit-permission/runtest.sh index 846434e..9d4ee00 100755 --- a/selinux-policy/getrlimit-permission/runtest.sh +++ b/selinux-policy/getrlimit-permission/runtest.sh @@ -27,14 +27,13 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/gnome-remote-desktop-and-similar/Makefile b/selinux-policy/gnome-remote-desktop-and-similar/Makefile new file mode 100644 index 0000000..c68a44f --- /dev/null +++ b/selinux-policy/gnome-remote-desktop-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +# Description: SELinux interferes with gnome-remote-desktop-daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with gnome-remote-desktop-daemon and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: gnome-remote-desktop" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service gnome-remote-desktop gdm freerdp" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2321236" >> $(METADATA) # Fedora 42 + @echo "Bug: RHEL-35877" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/gnome-remote-desktop-and-similar/PURPOSE b/selinux-policy/gnome-remote-desktop-and-similar/PURPOSE new file mode 100644 index 0000000..ba1be55 --- /dev/null +++ b/selinux-policy/gnome-remote-desktop-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +Author: Milos Malik + +SELinux interferes with gnome-remote-desktop-daemon and related programs. + diff --git a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf new file mode 100644 index 0000000..362abd7 --- /dev/null +++ b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf @@ -0,0 +1,46 @@ +summary: SELinux interferes with gnome-remote-desktop and related programs +description: |+ + SELinux interferes with gnome-remote-desktop-daemon and related programs. + +contact: Milos Malik +component: + - gnome-remote-desktop + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - gnome-remote-desktop + - gdm + - freerdp +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2321236 + - verifies: https://issues.redhat.com/browse/RHEL-35877 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +extra-task: /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +extra-nitrate: TC#0617929 diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh new file mode 100755 index 0000000..2349eb1 --- /dev/null +++ b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh @@ -0,0 +1,107 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +# Description: SELinux interferes with gnome-remote-desktop-daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/gnome-remote-desktop-daemon" +SERVICE_PACKAGE="gnome-remote-desktop" +SERVICE_NAME="gnome-remote-desktop" +PROCESS_NAME="gnome-remote-desktop-daemon" +if semodule -l | grep -q gnome_remote_desktop ; then + FILE_CONTEXT="gnome_remote_desktop_exec_t" + PROCESS_CONTEXT="gnome_remote_desktop_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined "gnome_remote_desktop_t" ; then + rlPhaseStartTest "bz#2321236" + rlSEMatchPathCon "/usr/libexec/gnome-remote-desktop-daemon" "gnome_remote_desktop_exec_t" + rlSEMatchPathCon "/etc/gnome-remote-desktop" "etc_t" + rlSESearchRule "allow gnome_remote_desktop_t etc_t : dir { watch } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-35877" + rlSESearchRule "allow gnome_remote_desktop_t policykit_t : dbus { send_msg } [ ]" + rlSESearchRule "allow policykit_t gnome_remote_desktop_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/gnome-remote-desktop.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "rm -rf ~gnome-remote-desktop/.local/share/gnome-remote-desktop" + rlRun "sudo -u gnome-remote-desktop mkdir -p ~gnome-remote-desktop/.local/share/gnome-remote-desktop" + rlRun "sudo -u gnome-remote-desktop winpr-makecert -silent -rdp -path ~gnome-remote-desktop/.local/share/gnome-remote-desktop tls" + rlRun "grdctl --system rdp set-tls-key ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.key" + rlRun "grdctl --system rdp set-tls-cert ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.crt" + rlRun "grdctl --system rdp set-credentials nobody nothing" + rlRun "grdctl --system rdp enable" + rlRun "systemctl enable --now gdm" + sleep 2 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "grdctl --headless status" + rlRun "grdctl --system status" + rlRun "grdctl --system rdp enable" + rlRun "grdctl --system vnc enable" + rlRun "grdctl --system status" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "systemctl stop gdm" + rlPhaseEnd + fi + + # TODO: test the gnome-remote-desktop service under normal/confined users + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/hostapd-and-similar/Makefile b/selinux-policy/hostapd-and-similar/Makefile new file mode 100644 index 0000000..4c1c5dd --- /dev/null +++ b/selinux-policy/hostapd-and-similar/Makefile @@ -0,0 +1,82 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/hostapd-and-similar +# Description: SELinux interferes with hostapd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/hostapd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with hostapd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: hostapd" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console hostapd /usr/sbin/service kernel-modules-internal" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1224405" >> $(METADATA) # Fedora 22 + @echo "Bug: 1225245" >> $(METADATA) # Fedora 22 + @echo "Bug: 1237343" >> $(METADATA) # Fedora 22 + @echo "Bug: 1266068" >> $(METADATA) # Fedora 23 + @echo "Bug: 1273570" >> $(METADATA) # Fedora 23 + @echo "Bug: 1278569" >> $(METADATA) # Fedora 23 + @echo "Bug: 1282179" >> $(METADATA) # Fedora 23 + @echo "Bug: 1334021" >> $(METADATA) # Fedora 24 + @echo "Bug: 1343683" >> $(METADATA) # Fedora 24 + @echo "Bug: 1977676" >> $(METADATA) # RHEL-8 + @echo "Bug: 1979968" >> $(METADATA) # RHEL-9 + @echo "Bug: 1784253" >> $(METADATA) # Fedora 35 + @echo "Bug: 2032277" >> $(METADATA) # Fedora 35 + @echo "Bug: RHEL-59683" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/hostapd-and-similar/PURPOSE b/selinux-policy/hostapd-and-similar/PURPOSE new file mode 100644 index 0000000..7f50b6d --- /dev/null +++ b/selinux-policy/hostapd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/hostapd-and-similar +Author: Milos Malik + +SELinux interferes with hostapd and related programs. + diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf new file mode 100644 index 0000000..a99ac23 --- /dev/null +++ b/selinux-policy/hostapd-and-similar/main.fmf @@ -0,0 +1,64 @@ +summary: SELinux interferes with hostapd and related programs +description: |+ + SELinux interferes with hostapd and related programs. + +contact: Milos Malik +component: + - hostapd + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - hostapd + - /usr/sbin/service + - kernel-modules-internal +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL8 + - TIPpass_Security + - failinfedora + - targeted + - NoRHIVOS + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1224405 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1225245 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1237343 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1266068 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1273570 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1278569 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1282179 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1334021 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1343683 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1977676 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1979968 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1784253 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2032277 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2064688 + - verifies: https://issues.redhat.com/browse/RHEL-59683 +adjust+: + - enabled: false + when: arch == s390x + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0602539 +extra-summary: /CoreOS/selinux-policy/Regression/hostapd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/hostapd-and-similar +id: 83fb3ff1-3bd6-4400-a677-fe38f712d966 diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh new file mode 100755 index 0000000..1ed5ed0 --- /dev/null +++ b/selinux-policy/hostapd-and-similar/runtest.sh @@ -0,0 +1,134 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/hostapd-and-similar +# Description: SELinux interferes with hostapd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/hostapd" +FILE_CONTEXT="hostapd_exec_t" +SERVICE_PACKAGE="hostapd" +SERVICE_NAME="hostapd" +PROCESS_NAME="hostapd" +PROCESS_CONTEXT="hostapd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + rlRun "rpm -qa kernel\*" + rlRun "uname -a" + rlRun "yum -y install kernel-modules-internal-`uname -r` --enablerepo '*'" + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlFileBackup /etc/hostapd/hostapd.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "bz#1224405" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/run/hostapd" "hostapd_var_run_t" + rlSEMatchPathCon "/run/hostapd/wlan0" "hostapd_var_run_t" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "dontaudit hostapd_t debugfs_t : dir { search } [ ]" + rlSESearchRule "allow hostapd_t hostapd_var_run_t : sock_file { create setattr unlink } [ ]" + rlSESearchRule "allow hostapd_t hostapd_t : capability { fsetid } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1225245" + rlSESearchRule "allow hostapd_t hostapd_t : capability { net_admin } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1237343" + rlSESearchRule "allow hostapd_t hostapd_t : capability { net_raw } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1266068 + bz#1273570 + bz#1278569 + bz#1282179 + bz#1334021 + bz#1343683" + rlSESearchRule "allow hostapd_t hostapd_t : netlink_generic_socket { create setopt bind getattr } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1977676 + bz#1979968" + rlSEMatchPathCon "/usr/sbin/hostapd" "hostapd_exec_t" + rlSEMatchPortCon udp 67 dhcpd_port_t + rlSESearchRule "allow hostapd_t hostapd_t : capability { net_bind_service } [ ]" + rlSESearchRule "allow hostapd_t dhcpd_port_t : udp_socket { name_bind } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1784253 + bz#2032277" + rlSESearchRule "allow hostapd_t user_tmp_t : sock_file { write } [ ]" + rlSESearchRule "allow hostapd_t unconfined_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlRun "modprobe mac80211_hwsim" + rlRun "lsmod | grep mac80211_hwsim" + rlRun "sed -i 's/^interface=.*$//' /etc/hostapd/hostapd.conf" + rlRun "sed -i 's/^hw_mode=.*$//' /etc/hostapd/hostapd.conf" + rlRun "sed -i 's/^channel=.*$//' /etc/hostapd/hostapd.conf" + rlRun "sed -i 's/^ssid=.*//' /etc/hostapd/hostapd.conf" + rlRun "echo interface=wlan0 >> /etc/hostapd/hostapd.conf" + rlRun "echo hw_mode=g >> /etc/hostapd/hostapd.conf" + rlRun "echo channel=10 >> /etc/hostapd/hostapd.conf" + rlRun "echo ssid=somename >> /etc/hostapd/hostapd.conf" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlRun "hostapd_cli all_sta" + rlRun "systemd-run hostapd_cli ping" + sleep 5 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/icecast-and-similar/Makefile b/selinux-policy/icecast-and-similar/Makefile new file mode 100644 index 0000000..51ccee4 --- /dev/null +++ b/selinux-policy/icecast-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/icecast-and-similar +# Description: SELinux interferes with icecast and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/icecast-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with icecast and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service icecast" >> $(METADATA) # EPEL + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Architectures: aarch64 ppc64le s390x x86_64" >> $(METADATA) + @echo "Bug: 894387" >> $(METADATA) # RHEL-6 + @echo "Bug: 2156763" >> $(METADATA) # Fedora 36 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/icecast-and-similar/PURPOSE b/selinux-policy/icecast-and-similar/PURPOSE new file mode 100644 index 0000000..7a60dce --- /dev/null +++ b/selinux-policy/icecast-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/icecast-and-similar +Author: Milos Malik + +SELinux interferes with icecast and related programs. + diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf new file mode 100644 index 0000000..5a60241 --- /dev/null +++ b/selinux-policy/icecast-and-similar/main.fmf @@ -0,0 +1,52 @@ +summary: SELinux interferes with icecast and related programs +description: |+ + SELinux interferes with icecast and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - icecast +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=894387 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2156763 +adjust+: + - enabled: false + when: arch == i386, ppc, ppc64, s390 + because: the icecast package is not available for all architectures + - enabled: false + when: distro >= rhel-8 + because: the icecast package is not available there + - enabled: false + when: distro == centos-stream-8, centos-stream-9 + because: the icecast package is not available there +extra-nitrate: TC#0388472 +extra-summary: /CoreOS/selinux-policy/Regression/icecast-and-similar +extra-task: /CoreOS/selinux-policy/Regression/icecast-and-similar +id: 59e31ab5-6779-410c-8acb-97380a6843cd diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh new file mode 100755 index 0000000..bcce208 --- /dev/null +++ b/selinux-policy/icecast-and-similar/runtest.sh @@ -0,0 +1,138 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/icecast-and-similar +# Description: SELinux interferes with icecast and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/bin/icecast" +FILE_CONTEXT="icecast_exec_t" +SERVICE_PACKAGE="icecast" +SERVICE_NAME="icecast" +PROCESS_NAME="icecast" +PROCESS_CONTEXT="icecast_t" + +rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/icecast.xml + + rlRun "setenforce 1" + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "bz#894387" + rlSEMatchPathCon "/usr/bin/icecast" "icecast_exec_t" + rlSEMatchPortCon tcp 8080 http_cache_port_t + rlSESearchRule "allow icecast_t http_cache_port_t : tcp_socket { name_bind } [ icecast_use_any_tcp_ports ]" + if rlIsRHEL 6 ; then + rlSESearchRule "dontaudit icecast_t tmp_t : dir { read }" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#2156763" + rlSEMatchPathCon "/usr/bin/icecast" "icecast_exec_t" + rlSEMatchPathCon "/var/log/icecast" "icecast_log_t" + rlSEMatchPathCon "/var/log/icecast/error.log" "icecast_log_t" + rlSESearchRule "allow icecast_t icecast_log_t : dir { remove_name } [ ]" + rlSESearchRule "allow icecast_t icecast_log_t : file { rename } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- bz#894387" + if rlIsRHEL 5 6 ; then + rlRun "setsebool icecast_connect_any on" + else + rlRun "setsebool icecast_use_any_tcp_ports on" + fi + rlRun "sed -i \"s|8000|8080|\" /etc/icecast.xml" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "sed -i 's|^\(.*logsize>\).*\(\).*$|\1|' /etc/icecast.xml" + rlRun "grep logarchive /etc/icecast.xml" + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + if rlIsRHEL 5 6 ; then + rlRun "setsebool icecast_connect_any off" + else + rlRun "setsebool icecast_use_any_tcp_ports off" + fi + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/iio-sensor-proxy-and-similar/Makefile b/selinux-policy/iio-sensor-proxy-and-similar/Makefile new file mode 100644 index 0000000..d79e134 --- /dev/null +++ b/selinux-policy/iio-sensor-proxy-and-similar/Makefile @@ -0,0 +1,72 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +# Description: SELinux interferes with iio-sensor-proxy and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with iio-sensor-proxy and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: iio-sensor-proxy" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console iio-sensor-proxy /usr/sbin/service gdm" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-17346" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-62355" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-70850" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-110090" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE b/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE new file mode 100644 index 0000000..b41c372 --- /dev/null +++ b/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +Author: Milos Malik + +SELinux interferes with the iio-sensor-proxy service and related programs. + +Known interactions: iio-sensor-proxy + gdm. diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf new file mode 100644 index 0000000..691dbb8 --- /dev/null +++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf @@ -0,0 +1,52 @@ +summary: SELinux interferes with iio-sensor-proxy and related programs +description: |+ + SELinux interferes with the iio-sensor-proxy and related programs. + +contact: Milos Malik +component: + - iio-sensor-proxy + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - iio-sensor-proxy + - /usr/sbin/service + - gdm +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - failinfedora + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-17346 + - verifies: https://issues.redhat.com/browse/RHEL-62355 + - verifies: https://issues.redhat.com/browse/RHEL-70850 + - verifies: https://issues.redhat.com/browse/RHEL-110090 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the iio-sensor-proxy package is not available there + - enabled: false + when: arch == s390x + because: the service is not activatable there +extra-summary: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +extra-task: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +extra-nitrate: TC#0617897 +id: f951c38a-3013-490f-893a-fb18e9ad7cbb diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh new file mode 100755 index 0000000..d4b6599 --- /dev/null +++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh @@ -0,0 +1,115 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +# Description: SELinux interferes with iio-sensor-proxy and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/iio-sensor-proxy" +SERVICE_NAME="iio-sensor-proxy" +PROCESS_NAME="iio-sensor-proxy" +if seinfo -t | grep -q iiosensor ; then + PROCESS_CONTEXT="iiosensorproxy_t" + FILE_CONTEXT="iiosensorproxy_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + if rlIsRHEL 7 || rlIsCentOS 7 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/systemd/system/iio-sensor-proxy.service + rlServiceStart gdm + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if seinfo -t | grep -q iiosensorproxy ; then + rlPhaseStartTest "RHEL-17346 + RHEL-62355 + RHEL-70850" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSESearchRule "allow xdm_t iiosensorproxy_t : dbus { send_msg } [ ]" + rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]" + rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : capability2 { bpf } [ ]" + rlPhaseEnd + fi + + if seinfo -t | grep -q iio_device_t ; then + rlPhaseStartTest "RHEL-110090" + rlRun "semanage fcontext -l | grep '/dev/iio:device.*character.*iio_device_t'" + rlSEMatchPathCon "/dev/iio:device3" "iio_device_t" + rlSESearchRule "allow iiosensorproxy_t sysfs_t : dir { write } [ ]" + rlSESearchRule "allow iiosensorproxy_t sysfs_t : file { write } [ ]" + rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : unix_dgram_socket { create } [ ]" + rlSESearchRule "allow iiosensorproxy_t iio_device_t : chr_file { read } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "cp -f /usr/lib/systemd/system/iio-sensor-proxy.service /etc/systemd/system/" + rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /etc/systemd/system/iio-sensor-proxy.service" + rlRun "systemctl daemon-reload" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_LIGHT_SENSOR=1/' /etc/systemd/system/iio-sensor-proxy.service" + rlRun "systemctl daemon-reload" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "gdbus introspect --system --dest net.hadess.SensorProxy --object-path /net/hadess/SensorProxy" 0,1 + rlWatchdog "monitor-sensor --all" 10 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlRun "systemctl daemon-reload" + rlServiceRestore ${SERVICE_NAME} + rlServiceRestore gdm + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/install-uninstall-dsp-packages/Makefile b/selinux-policy/install-uninstall-dsp-packages/Makefile new file mode 100644 index 0000000..b801290 --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +# Description: Test and discover conflicts if any, during installation of +# third-party or DSP packages. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) additional-dsp-packages.txt dbus-sendmsg.pl runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Amith Kumar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Install-uninstall dsp packages to discover conflicts" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 40m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL6 -RHELClient5 -RHELServer5 -RHEL7" >> $(METADATA) + + + rhts-lint $(METADATA) + diff --git a/selinux-policy/install-uninstall-dsp-packages/PURPOSE b/selinux-policy/install-uninstall-dsp-packages/PURPOSE new file mode 100644 index 0000000..f065acb --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +Author: Amith Kumar + +Test and discover conflicts if any, during installation of third-party or +DSP packages. diff --git a/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt b/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt new file mode 100644 index 0000000..bb3d718 --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt @@ -0,0 +1,13 @@ +# List of additional DSP packages which distribute its custom SELinux module, +# but not in a subpackage with the "-selinux" suffix +# This file is being maintained manually + +BackupPC +# beah - temporary not working in rawhide +ec2-hibinit-agent +google-compute-engine-oslogin +mariadb-cracklib-password-check +mariadb-server-galera +postsrsd +qm +receptor diff --git a/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl b/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl new file mode 100755 index 0000000..cc46f51 --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl @@ -0,0 +1,71 @@ +#!/usr/bin/perl -w +### Check if dbus communication is allowed bidirectionally + +use strict; + +my $sesearch_cmd="/usr/bin/sesearch"; +my $sesearch_args="-A -c dbus -p send_msg"; +my ($line, @output); +my (@seoutarray, $seout, $seline); +my $count=0; + +# Take all allow rules matching the description +open SESEARCH, "$sesearch_cmd $sesearch_args |" + or die "Cannot run sesearch: $!"; +while ($line =) { + $count++; + #debug printf "%4d %s", $count, $line; + chomp $line; + # > sesearch -A -t systemd_timedated_t -s initrc_t -c dbus -p send_msg + # allow dbusd_unconfined nsswitch_domain:dbus send_msg; + # allow system_bus_type system_dbusd_t:dbus { acquire_svc send_msg }; + # allow NetworkManager_t xguest_t:dbus send_msg; [ xguest_connect_network ]:True + @output = split /[ :]/, $line; + next if $output[2] eq "self"; + next if $output[2] eq $output[1]; + # Look for the rule in the inverse direction + open $seout, "$sesearch_cmd $sesearch_args -s $output[2] -t $output[1] |" + or die "Cannot run sesearch: $!"; + @seoutarray = <$seout>; + if (@seoutarray == 0) { + print "No reverse match: $line\n"; + } + else { + foreach $seline (@seoutarray) { + if ($seline =~ /\]:/) { + print "Conditional rule: $seline"; + print " Original line: $line\n"; + } + } + } + close $seout; +} +print "Total dbus:send_msg rules number: $count\n"; + +__END__ + +State as of 2024.03.05 +f39: 1738 rules, 8 asymmetrical +RHEL9: 1731 rules, 6 asymmetrical +RHEL8: 2359 rules, 52 asymmetrical + +f39 +No reverse match: allow cronjob_t openshift_app_t:dbus send_msg; +No reverse match: allow cronjob_t openshift_t:dbus send_msg; +No reverse match: allow cronjob_t staff_t:dbus send_msg; +No reverse match: allow cronjob_t sysadm_t:dbus send_msg; +No reverse match: allow cronjob_t user_t:dbus send_msg; +No reverse match: allow pasta_t init_t:dbus send_msg; +No reverse match: allow pasta_t system_dbusd_t:dbus send_msg; +No reverse match: allow pasta_t systemd_hostnamed_t:dbus send_msg; + +RHEL9 +No reverse match: allow cronjob_t openshift_app_t:dbus send_msg; +No reverse match: allow cronjob_t openshift_t:dbus send_msg; +No reverse match: allow cronjob_t staff_t:dbus send_msg; +No reverse match: allow cronjob_t sysadm_t:dbus send_msg; +No reverse match: allow cronjob_t user_t:dbus send_msg; +No reverse match: allow nvme_stas_t system_dbusd_t:dbus { acquire_svc send_msg }; + +RHEL8 + diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf new file mode 100644 index 0000000..cd594e9 --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -0,0 +1,43 @@ +summary: Install-Uninstall third-party or dsp packages to discover conflicts. +description: |+ + Test and discover rpm package installaton conflicts if any, during installation + of third-party or DSP selinux packages. + +contact: Amith Kumar +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - selinux-policy + - selinux-policy-targeted + - dnf + - perl +environment: + AVC_ERROR: +no_avc_check +duration: 60m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPfail_Security + - failinfedora + - targeted + - NoRHIVOS + - rhel9_broken + - rhel10_broken + - avoidImageMode +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0617855 +extra-summary: /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +extra-task: /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +id: 22a728a8-c83b-49f9-8a20-57f0d35c7dc9 diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh new file mode 100755 index 0000000..8b77fb6 --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh @@ -0,0 +1,230 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +# Description: Test and discover conflicts if any, during installation of +# third-party or DSP packages. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SKIP_REMOVAL=${SKIP_REMOVAL:-""} +SKIP_INSTALL=${SKIP_INSTALL:-""} +INSTALL_ONLY=${INSTALL_ONLY:-""} +ADDITIONAL_DSP_PACKAGES="additional-dsp-packages.txt" +TMPDIR=${TMPDIR-"/var/tmp"} +OUTDIR="${TMPDIR}/test-output" +FCONTEXT_LIST="${OUTDIR}/semanage-fcontext" +FCONTEXT_LIST2="${OUTDIR}/semanage-fcontext2" +FCONTEXT_LIST_VARRUN="${OUTDIR}/semanage-fcontext-varrun" +RESTORECON_RVN_RUN="${OUTDIR}/restorecon-rvn-run" +RPMQA="${OUTDIR}/rpmqa" +SEMODULE_LIST="${OUTDIR}/semodule-list" +SEMODULE_LIST_DSP="${OUTDIR}/semodule-list-dsp" +PERMISSIVE_DOMAINS="${OUTDIR}/permissive-domains" +UNCONFINED_DOMAINS="${OUTDIR}/unconfined-domains" +DBUS_SENDMSG="${OUTDIR}/dbus-sendmsg" +mkdir -p ${OUTDIR} + +# Function to create a report template for install test +function install_report() { +echo "" > pkglist.report +echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report +echo '@ LIST OF PACKAGES TO BE INSTALLED @' >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +cat install-pkgs >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +echo "" >> pkglist.report +echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report +echo '@ INSTALLATION : Test Report @' >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +} + +# Function to create a report template for uninstall test +function uninstall_report() { +echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report +echo '@ UNINSTALLATION : Test Report @' >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +} + +# Function to summarize the test report +function summary_report() { +echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report +echo '@ TEST SUMMARY @' >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +SEL=`cat install-pkgs | wc -l` +PASS1=`grep "installation : PASS" pkglist.report | wc -l` +FAIL1=`grep "installation : FAIL" pkglist.report | wc -l` +PASS2=`grep "removal : PASS" pkglist.report | wc -l` +FAIL2=`grep "removal : FAIL" pkglist.report | wc -l` +echo "Total no. of packages selected for installation : $SEL" >> pkglist.report +echo "Total no. of successful package installation : $PASS1" >> pkglist.report +echo "Total no. of failed package installation : $FAIL1" >> pkglist.report +echo "Total no. of successful package removal : $PASS2" >> pkglist.report +echo "Total no. of failed package removal : $FAIL2" >> pkglist.report +echo "" >> pkglist.report +if [ -f "Err_file" ]; then + echo "DETAILED ERROR LOG (IF ANY)" >> pkglist.report + echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report + cat Err_file >> pkglist.report +fi +} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "Install test for dsp packages" + # test can fail when selinux-policy-mls is installed + if rpm -q selinux-policy-mls > /dev/null + then rlRun "dnf -y remove selinux-policy-mls" + fi + rlRun "dnf list \"*-selinux*\" --enablerepo=\"*\" --disablerepo=\"beaker-tasks\" --disablerepo=\"*-source\" --disablerepo=\"*-debuginfo\" > install-list" + # limit the list to not installed packages + rlRun "sed -i '1,/Available Packages/d' install-list" + # exclude packages from the beaker-tasks repo + rlRun "sed -i '/beaker-tasks/d' install-list" + # exclude debuginfo packages + rlRun "sed -i '/-debuginfo/d' install-list" + # packages names only + rlRun "awk '{print \$1}' install-list > pkgonlylist" + # exclude updates-source + rlRun "grep -vE '(.src)' pkgonlylist | sort -u > install-pkgs" + # include additional packages which do not match the "*-selinux" pattern + # currently for Fedora only + if rlIsFedora ">=38" + then + # remove comments and blank lines + rlRun "sed '/^[#]/d;/^$/d' ${ADDITIONAL_DSP_PACKAGES} >> install-pkgs" + fi + # use the same list for checks of the subsequent uninstallation + rlRun "cp -f install-pkgs uninstall-pkgs" + rlRun "install_report" + # Following loop will read each package from file install-pkgs + # and will attempt to install it using dnf utility. Both + # successful and failed attempts will be reported and the + # report will be published in the end. + cat install-pkgs | while read line + do + if dnf -q -y install --enablerepo="*" $line + then + rlLog "$line installation : PASS" + echo "$line installation : PASS" >> pkglist.report + else + rlLog "$line installation : FAIL" + echo "$line installation : FAIL" >> pkglist.report + sed -i "/$line/d" uninstall-pkgs + echo "Installation Failed for : $line" >> Err_file + dnf -q -y install --enablerepo="*" $line 2>> Err_file + echo "" >> Err_file + fi + done + echo "" >> pkglist.report + rlPhaseEnd + + ### Checks performed with all dsp packages installed + + ### Status of /run and /var/run equivalency + rlPhaseStartTest "Check /run equivalency status" + rlRun "semanage fcontext -l > ${FCONTEXT_LIST}" + if grep -q "/run = /var/run" ${FCONTEXT_LIST}; then + rlLogInfo "Legacy equivalency settings \"/run = /var/run\" are in place." + elif grep -q "/var/run = /run" ${FCONTEXT_LIST}; then + rlLog "New equivalency settings \"/var/run = /run\" are in place." + grep -v "/var/run = /run" ${FCONTEXT_LIST} > ${FCONTEXT_LIST2} + if grep -q "^/var/run" ${FCONTEXT_LIST2}; then + rlLogWarning "/var/run entries found in the file context database" + rlRun "sed '/^\/var\/run/!d; s|[ \t].*$||' ${FCONTEXT_LIST2} | uniq > ${FCONTEXT_LIST_VARRUN}" + + # List /var/run rules which do not have an equivalent one in /run + while read line + do + if ! grep -q "^${line#/var}" ${FCONTEXT_LIST2}; then + rlLog "Dup rule does not exist in /run: \"$line\"" + fi + done < ${FCONTEXT_LIST_VARRUN} + fi + else rlLogWarning "None or unknown /run equivalency settings." + fi + + [ "$DEBUG" = "yes" ] || + rlRun "rm -f ${FCONTEXT_LIST} ${FCONTEXT_LIST_VARRUN}" + rlPhaseEnd + + ### Store some data which might be of some use later + rlPhaseStartTest "Gather relevant data" + if [ "${DEBUG}" = "yes" ]; then + rlRun "restorecon -Rvn /run > ${RESTORECON_RVN_RUN}" + rlRun "rpm -qa | sort > ${RPMQA}" + rlRun "semanage permissive -l > ${PERMISSIVE_DOMAINS}" + rlRun "seinfo -xa unconfined_domain_type > ${UNCONFINED_DOMAINS}" + rlRun "semodule -lfull > ${SEMODULE_LIST}" + rlRun "grep -v ^100 ${SEMODULE_LIST} > ${SEMODULE_LIST_DSP}" + rlRun "./dbus-sendmsg.pl > ${DBUS_SENDMSG}" + fi + rlPhaseEnd + + rlPhaseStartTest "Uninstall test for dsp packages" + rlRun "uninstall_report" + # Following loop will read each package from file install-pkgs + # and will attempt to un-install it using dnf utility. + cat uninstall-pkgs | while read line + do + if dnf -q -y remove $line + then + rlLog "$line removal : PASS" + echo "$line removal : PASS" >> pkglist.report + else + rlLog "$line removal : FAIL" + echo "$line removal : FAIL" >> pkglist.report + echo "Removal Failed for : $line" >> Err_file + dnf -q -y remove $line 2>> Err_file + echo "" >> Err_file + fi + done + echo "" >> pkglist.report + rlRun "summary_report" + rlAssertNotGrep "FAIL" pkglist.report + rlRun "cat pkglist.report" + rlPhaseEnd + + rlPhaseStartCleanup + if [ -f "Err_file" ]; then + rlRun "rm -f Err_file" + fi + [ "$DEBUG" = "yes" ] || + rlRun "rm -f install-list pkgonlylist install-pkgs uninstall-pkgs pkglist.report" + rlSECheckAVC --ignore 'type=USER_AVC.*denied.* send_msg .*scontext=.*:unconfined_t:.*tcontext=.*:system_dbusd_t:.*tclass=dbus' \ + --ignore 'type=USER_AVC.* start .*:unconfined_t:.*:init_t:.*tclass=system' \ + --ignore 'type=USER_AVC.* start .*:unconfined_t:.*:init_var_run_t:.*tclass=service' + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/selinux-policy/interface-definitions/main.fmf b/selinux-policy/interface-definitions/main.fmf new file mode 100644 index 0000000..6bf6d98 --- /dev/null +++ b/selinux-policy/interface-definitions/main.fmf @@ -0,0 +1,34 @@ +summary: Are all policy interfaces defined correctly? +contact: Milos Malik +component: + - selinux-policy + - policycoreutils +recommend: + - /usr/bin/sepolgen-ifgen + - selinux-policy + - selinux-policy-devel + - selinux-policy-targeted +test: ./runtest.sh +framework: beakerlib +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - targeted + - failinfedora + - NoRHIVOS + - avoidImageMode +link: + - verifies: https://issues.redhat.com/browse/RHEL-2616 + - verifies: https://issues.redhat.com/browse/RHEL-16185 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2254169 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2254206 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2277925 + - verifies: https://issues.redhat.com/browse/RHEL-34769 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + because: decision was made not to fix the problem there +extra-nitrate: TC#0615941 +id: a6785475-8446-47cc-9167-f2d6ad52d58e diff --git a/selinux-policy/interface-definitions/runtest.sh b/selinux-policy/interface-definitions/runtest.sh new file mode 100755 index 0000000..29c0826 --- /dev/null +++ b/selinux-policy/interface-definitions/runtest.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm selinux-policy + rlAssertRpm policycoreutils + rlPhaseEnd + + if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then + # the bug is fixed on RHEL-8 but it was auto-closed on RHEL-9 + rlPhaseStartTest "RHEL-2616 + RHEL-16185" + rlRun "sepolgen-ifgen -v -d 2>/dev/null | sort | uniq > output.txt" + rlRun "grep -i missing output.txt" 1 + rlPhaseEnd + fi + + rlPhaseStartTest "bz#2254169 + bz#2254206 + bz#2277925" + rlRun "yum -y reinstall selinux-policy-devel >& output.txt" + rlRun "grep -i illegal output.txt" 1 + rlRun "sepolgen-ifgen --verbose >& output.txt" + rlRun "grep -i illegal output.txt" 1 + rlPhaseEnd + + rlPhaseStartCleanup + rm -f output.txt + rlPhaseEnd +rlJournalEnd + diff --git a/selinux-policy/journalctl-and-similar/Makefile b/selinux-policy/journalctl-and-similar/Makefile new file mode 100644 index 0000000..bbc6bec --- /dev/null +++ b/selinux-policy/journalctl-and-similar/Makefile @@ -0,0 +1,88 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/journalctl-and-similar +# Description: SELinux interferes with journalctl executed by various users +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/journalctl-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with journalctl executed by various users" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients systemd shadow-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1176713" >> $(METADATA) # Fedora 21 + @echo "Bug: 1288255" >> $(METADATA) # RHEL-7 + @echo "Bug: 1685689" >> $(METADATA) # RHEL-8 + @echo "Bug: 1825894" >> $(METADATA) # RHEL-8 + @echo "Bug: 2017838" >> $(METADATA) # RHEL-9 + @echo "Bug: 2075527" >> $(METADATA) # Fedora 37 + @echo "Bug: 2124427" >> $(METADATA) # Fedora 37 + @echo "Bug: 2125762" >> $(METADATA) # Fedora 37 + @echo "Bug: 2136189" >> $(METADATA) # RHEL-8 + @echo "Bug: 2137323" >> $(METADATA) # Fedora 37 + @echo "Bug: 2139623" >> $(METADATA) # Fedora 37 + @echo "Bug: 2143157" >> $(METADATA) # Fedora 37 + @echo "Bug: 2143746" >> $(METADATA) # Fedora 37 + @echo "Bug: 2144150" >> $(METADATA) # Fedora 37 + @echo "Bug: 2149093" >> $(METADATA) # Fedora 37 + @echo "Bug: 2149346" >> $(METADATA) # Fedora 37 + @echo "Bug: 2152544" >> $(METADATA) # Fedora 37 + @echo "Bug: 2152588" >> $(METADATA) # Fedora 37 + @echo "Bug: 2152823" >> $(METADATA) # RHEL-9 + @echo "Bug: 2153782" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/journalctl-and-similar/PURPOSE b/selinux-policy/journalctl-and-similar/PURPOSE new file mode 100644 index 0000000..806f597 --- /dev/null +++ b/selinux-policy/journalctl-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/journalctl-and-similar +Author: Milos Malik + +SELinux interferes with journalctl executed by various users. + diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf new file mode 100644 index 0000000..0205049 --- /dev/null +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -0,0 +1,65 @@ +summary: SELinux interferes with journalctl executed by various users +description: |+ + SELinux interferes with journalctl executed by various users. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - systemd + - shadow-utils +environment: + AVC_ERROR: +no_avc_check + ALLOWED_USERS: staff_u user_u sysadm_u unconfined_u + DENIED_USERS: guest_u xguest_u +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1176713 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1288255 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1685689 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825894 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2017838 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2075527 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2124427 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2125762 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2136189 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2137323 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2139623 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143157 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143746 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2144150 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149093 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149346 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152544 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152588 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152823 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2153782 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0597884 +extra-summary: /CoreOS/selinux-policy/Regression/journalctl-and-similar +extra-task: /CoreOS/selinux-policy/Regression/journalctl-and-similar +id: f56e6a4a-9f30-47ad-bf6c-cc6a388d82d9 diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh new file mode 100755 index 0000000..87426c5 --- /dev/null +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -0,0 +1,156 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/journalctl-and-similar +# Description: SELinux interferes with journalctl executed by various users +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/journalctl" +FILE_CONTEXT="journalctl_exec_t" +SERVICE_PACKAGE="systemd" +PROCESS_NAME="journalctl" +PROCESS_CONTEXT="journalctl_t" +ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} +DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1176713" + rlSEMatchPathCon "/usr/bin/journalctl" "journalctl_exec_t" + rlSEMatchPathCon "/dev/urandom" "urandom_device_t" + rlSESearchRule "allow journalctl_t urandom_device_t : chr_file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1288255" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlSEDefined "staff_t" ; then + rlSESearchRule "allow staff_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow staff_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition staff_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + fi + if rlSEDefined "sysadm_t" ; then + rlSESearchRule "allow sysadm_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow sysadm_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition sysadm_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + fi + if rlSEDefined "user_t" ; then + rlSESearchRule "allow user_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow user_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition user_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#1685689" + rlSEMatchPathCon "/usr/bin/journalctl" "journalctl_exec_t" + rlSEMatchPathCon "/run/log/journal/bfd37efc55db4f44a0f350821db2b810/system.journal" "syslogd_var_run_t" + if rlIsRHEL 7 ; then + # the domain_can_mmap_files boolean is enabled by default + rlSESearchRule "allow journalctl_t syslogd_var_run_t : file { map }" + else + # the domain_can_mmap_files boolean is disabled by default + rlSESearchRule "allow journalctl_t syslogd_var_run_t : file { map } [ ]" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#1825894" + rlSEMatchPathCon "/usr/bin/journalctl" "journalctl_exec_t" + rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]" + rlPhaseEnd + + if ! rlIsFedora && rlSEDefined "user_t" ; then + rlPhaseStartTest "bz#2017838" + rlSEMatchPathCon "/run/log/journal/somehash/system.journal" "syslogd_var_run_t" + rlSEMatchPathCon "/var/lib/systemd/catalog/database" "init_var_lib_t" + rlSESearchRule "allow user_t init_var_lib_t : file { open read map } [ ]" + rlSESearchRule "allow user_t syslogd_var_run_t : file { open read map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 7 8 && ! rlIsCentOS 7 8 ; then + rlPhaseStartTest "bz#2075527 + bz#2152823" + rlSESearchRule "allow syslogd_t syslogd_var_run_t : file { relabelfrom relabelto } [ ]" + rlRun "journalctl --rotate" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- confined users" + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "usermod -G systemd-journal ${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --user" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --system" + USER_ID=`id -u ${USER_NAME}` + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl status user@${USER_ID}" + rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 + done + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + + if ! ( IrIsRHEL 8 && rlIsRHEL "<8.8" ) && ! ( rlIsRHEL 9 && rlIsRHEL "<9.3" ); then + rlPhaseStartTest "bz#2136189 + bz#2153782" + rlSESearchRule "allow journalctl_t journalctl_t : capability { sys_resource } [ ]" + rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]" + + rlRun "setsebool ssh_sysadm_login on" + USER_NAME="toor" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -o -u 0 -g 0 -Z sysadm_u ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -l --no-pager" + rlRun "userdel -rfZ ${USER_NAME}" + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC --ignore 'type=AVC .* create .*systemd.* scontext=.*:user_t:.* tcontext=.*:user_tmp_t:.* tclass=dir' + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/journalctl-and-similar/ssh.exp b/selinux-policy/journalctl-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/journalctl-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/kerberos-and-similar/main.fmf b/selinux-policy/kerberos-and-similar/main.fmf index f55e70a..a06bb2f 100644 --- a/selinux-policy/kerberos-and-similar/main.fmf +++ b/selinux-policy/kerberos-and-similar/main.fmf @@ -1,5 +1,63 @@ -path: /selinux-policy/kerberos-and-similar -summary: SELinux interferes with various kerberos daemons and related programs. -description: | - Test coverage for SELinux AVC issues against kerberos daemon and related - programs. +summary: SELinux interferes with kerberos programs +description: |+ + SELinux interferes with various kerberos daemons and related programs. + +contact: Milos Malik +component: + - selinux-policy + - krb5 +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - selinux-policy + - selinux-policy-targeted + - setools-console + - libselinux + - libselinux-utils + - policycoreutils + - krb5-server + - krb5-libs +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TipWaived6 + - TipWaived7 + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=698923 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=713218 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=860666 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=910837 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1041629 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1065460 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1153561 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1210421 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1220691 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1220763 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1319933 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1337895 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1368492 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1452215 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600705 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1601004 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1619252 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1664983 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1669975 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0230498 +extra-summary: /CoreOS/selinux-policy/Regression/kerberos-and-similar +extra-task: /CoreOS/selinux-policy/Regression/kerberos-and-similar +id: 74c9284d-5001-4270-838b-8af50422631c diff --git a/selinux-policy/kerberos-and-similar/runtest.sh b/selinux-policy/kerberos-and-similar/runtest.sh index 79acf20..e306888 100755 --- a/selinux-policy/kerberos-and-similar/runtest.sh +++ b/selinux-policy/kerberos-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -35,12 +34,11 @@ ROOT_PASSWORD="redhat" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm krb5-libs - rlAssertRpm krb5-server + rlRun "rpm -qa | grep krb | sort" rlServiceStop kprop kadmin rlFileBackup /etc/shadow @@ -67,10 +65,6 @@ rlJournalStart rlPhaseStartTest "bz#860666" rlSEMatchPathCon "/usr/sbin/krb5kdc" "krb5kdc_exec_t" rlSEMatchPathCon "/usr/sbin/kadmind" "kadmind_exec_t" - rlSESearchRule "allow krb5kdc_t anon_inodefs_t : file { getattr read write }" - rlSESearchRule "allow krb5kdc_t anon_inodefs_t : dir { getattr search }" - rlSESearchRule "allow kadmind_t anon_inodefs_t : file { getattr read write }" - rlSESearchRule "allow kadmind_t anon_inodefs_t : dir { getattr search }" rlPhaseEnd if ! rlIsRHEL 5 6 ; then @@ -202,13 +196,18 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/kprop.service ] ; then rlPhaseStartTest "real scenario for kpropd" + rlRun "mkdir -p /var/kerberos/krb5kdc" rlRun "touch /var/kerberos/krb5kdc/kpropd.acl" rlRun "rm -f /etc/krb5.conf" rlRun "cp ./krb5.conf /etc" rlRun "restorecon -v /etc/krb5.conf" - rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "start status restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf new file mode 100644 index 0000000..3d1594f --- /dev/null +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -0,0 +1,41 @@ +summary: Test that kernel cannot execute arbitrary helper binaries +description: | + Ensures that the kernel is not allowed to execute unauthorized binaries + and that a transition to a confined domain is enforced on those that it + can execute, so that overwriting usermode helper paths doesn't lead to + an exploitable privilege escalation. +contact: Ondrej Mosnacek +component: + - selinux-policy +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy + - policycoreutils + - gcc +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +duration: 20m +tier: 2 +enabled: true +adjust+: + - enabled: false + when: distro < fedora-38 + because: This hardening applies only to F38+ + - enabled: false + when: distro < centos-stream-10 + because: Not yet backported to CentOS + - enabled: false + when: distro < rhel-10 + because: Not yet backported to RHEL +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068579 +extra-nitrate: TC#0614676 +id: 4400999a-aa60-4522-b0f7-d7b0656110a3 +tag: + - NoRHIVOS + - avoidImageMode diff --git a/selinux-policy/kernel-confined-exec/runtest.sh b/selinux-policy/kernel-confined-exec/runtest.sh new file mode 100755 index 0000000..274e0a0 --- /dev/null +++ b/selinux-policy/kernel-confined-exec/runtest.sh @@ -0,0 +1,147 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function trigger_modprobe() { + # ensure gre modules are unloaded + modprobe -r ip_gre gre || return 2 + ip link add mygre type gretap local 127.0.0.1 remote 127.0.0.1 + ret=$? + ip link del mygre 2>/dev/null + if [ $ret -eq 0 ]; then + return 0 + else + return 1 + fi +} + +rlJournalStart + rlPhaseStartSetup + rlImport 'selinux-policy/common' 0,1 + + rlAssertRpm selinux-policy + rlAssertRpm selinux-policy-targeted + + rlSESetEnforce + rlSEStatus + + original_modprobe="$(sysctl -nb kernel.modprobe)" + original_core_pattern="$(sysctl -nb kernel.core_pattern)" + + rlRun "gcc -o trigger_segfault trigger_segfault.c" + rlPhaseEnd + + rlPhaseStartTest "Policy rules" + rlLog "kernel_t shouldn't be allowed to execute any file without transition" + + # Only check execute_no_trans and a couple of unexpected type + # transitions. Plain 'execute' has to be allowed broadly due to + # overlayfs mounter checks. (Think overlayfs mounted before policy + # is loaded.) + rlSESearchRule "allow kernel_t file_type:file { execute_no_trans } []" 1 \ + "kernel_t shouldn't be allowed to execute any file without transition" + rlSESearchRule "type_transition kernel_t user_home_t:process domain;" 1 \ + "kernel_t shouldn't have any transition defined over files in user home directories" + rlSESearchRule "type_transition kernel_t user_tmp_t:process domain;" 1 \ + "kernel_t shouldn't have any transition defined over user temporary files" + rlPhaseEnd + + rlPhaseStartTest "Legit modprobe" + rlLog "Should work with no AVCs" + + rlSESetTimestamp + sleep 1 + rlRun "trigger_modprobe" + sleep 1 + rlSECheckAVC + rlPhaseEnd + + rlPhaseStartTest "Modprobe set to /usr/bin/true" + rlLog "Should fail but cause no AVCs" + + rlRun "sysctl kernel.modprobe=/usr/bin/true" 0 \ + "Set kernel.modprobe to /usr/bin/true" + rlSESetTimestamp + sleep 1 + rlRun "trigger_modprobe" 1 + sleep 1 + rlSECheckAVC + rlRun "sysctl kernel.modprobe=\"\$original_modprobe\"" 0 \ + "Reset kernel.modprobe to default" + rlPhaseEnd + + rlPhaseStartTest "Modprobe set to /usr/sbin/load_policy" + rlLog "Should fail with AVCs denying the execution" + + rlRun "sysctl kernel.modprobe=/usr/sbin/load_policy" 0 \ + "Set kernel.modprobe to /usr/sbin/load_policy" + rlSESetTimestamp + sleep 1 + rlRun "trigger_modprobe" 1 + sleep 1 + rlRun "rlSEAVCCheck" 1 + rlRun "sysctl kernel.modprobe=\"\$original_modprobe\"" 0 \ + "Reset kernel.modprobe to default" + rlPhaseEnd + + rlPhaseStartTest "Modprobe relabeled to bin_t" + rlLog "Should fail with AVCs denying operation after transition" + rlRun "chcon -t bin_t \"\$(readlink -f \"\$original_modprobe\")\"" 0 \ + "Set kernel.modprobe to /usr/sbin/load_policy" + rlSESetTimestamp + sleep 1 + rlRun "trigger_modprobe" 1 + sleep 1 + rlRun "rlSEAVCCheck" 1 + rlRun "restorecon \"\$(readlink -f \"\$original_modprobe\")\"" 0 \ + "Reset kernel.modprobe to default" + rlPhaseEnd + + rlPhaseStartTest "Legit coredump helper" + rlLog "Should work with no AVCs" + + rlSESetTimestamp + sleep 1 + rlRun "./trigger_segfault" 139 + sleep 2 + rlSECheckAVC + rlPhaseEnd + + rlPhaseStartTest "Core pattern set to |/usr/sbin/load_policy" + rlLog "Should fail with AVCs denying the execution" + + rlRun "sysctl kernel.core_pattern='|/usr/sbin/load_policy'" 0 \ + "Set kernel.core_pattern to |/usr/sbin/load_policy" + rlSESetTimestamp + sleep 1 + rlRun "./trigger_segfault" 139 + sleep 1 + rlRun "rlSEAVCCheck" 1 + rlRun "sysctl kernel.core_pattern=\"\$original_core_pattern\"" 0 \ + "Reset kernel.core_pattern to default" + rlPhaseEnd + + rlPhaseStartTest "Core pattern set to |/usr/bin/false" + rlLog "Should work with no AVCs" + + rlRun "sysctl kernel.core_pattern='|/usr/bin/false'" 0 \ + "Set kernel.core_pattern to |/usr/bin/false" + rlSESetTimestamp + sleep 1 + rlRun "./trigger_segfault" 139 + sleep 2 + rlSECheckAVC + rlRun "sysctl kernel.core_pattern=\"\$original_core_pattern\"" 0 \ + "Reset kernel.core_pattern to default" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f trigger_segfault" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/selinux-policy/kernel-confined-exec/trigger_segfault.c b/selinux-policy/kernel-confined-exec/trigger_segfault.c new file mode 100644 index 0000000..0ee0ab4 --- /dev/null +++ b/selinux-policy/kernel-confined-exec/trigger_segfault.c @@ -0,0 +1,6 @@ +#include + +int main(void) +{ + return *(int *)NULL; +} diff --git a/selinux-policy/ksm-and-similar/Makefile b/selinux-policy/ksm-and-similar/Makefile new file mode 100644 index 0000000..9a107c7 --- /dev/null +++ b/selinux-policy/ksm-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/ksm-and-similar +# Description: SELinux interferes with ksm and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/ksm-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with ksm and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/libexec/ksmctl /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2021131" >> $(METADATA) # RHEL-9 + @echo "Bug: 2091416" >> $(METADATA) # Fedora 36 + @echo "Bug: 2091417" >> $(METADATA) # Fedora 36 + @echo "Bug: 2091418" >> $(METADATA) # Fedora 36 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/ksm-and-similar/PURPOSE b/selinux-policy/ksm-and-similar/PURPOSE new file mode 100644 index 0000000..1f11e4b --- /dev/null +++ b/selinux-policy/ksm-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/ksm-and-similar +Author: Milos Malik + +SELinux interferes with the ksm service (the ksmctl program) and related programs. + diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf new file mode 100644 index 0000000..03a19db --- /dev/null +++ b/selinux-policy/ksm-and-similar/main.fmf @@ -0,0 +1,46 @@ +summary: SELinux interferes with ksm and related programs +description: |+ + SELinux interferes with the ksm service (the ksmctl program) and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/libexec/ksmctl + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +tier: 2 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2021131 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091416 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091417 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091418 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0613684 +extra-summary: /CoreOS/selinux-policy/Regression/ksm-and-similar +extra-task: /CoreOS/selinux-policy/Regression/ksm-and-similar +id: 712ce354-8733-4938-bfba-3801432e5278 diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh new file mode 100755 index 0000000..b4533f0 --- /dev/null +++ b/selinux-policy/ksm-and-similar/runtest.sh @@ -0,0 +1,106 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/ksm-and-similar +# Description: SELinux interferes with ksm and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/ksmctl" +FILE_CONTEXT="ksm_exec_t" +SERVICE_NAME="ksm" +PROCESS_NAME="ksmctl" +PROCESS_CONTEXT="ksm_t" + +rlJournalStart + if rlIsRHEL 7 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/systemd/system/ksm.service + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "bz#2021131" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/sys/kernel/mm/ksm" "sysfs_t" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow ${PROCESS_CONTEXT} sysfs_t : dir { write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2091416 + bz#2091417 + bz#2091418" + rlSEMatchPathCon "/usr/libexec/ksmctl" "ksm_exec_t" + rlSEMatchPathCon "/sys/kernel/mm/ksm" "sysfs_t" + rlSEMatchPathCon "/sys/kernel/mm/ksm/run" "sysfs_t" + rlSESearchRule "allow ksm_t sysfs_t : dir { write add_name } [ ]" + rlSESearchRule "allow ksm_t sysfs_t : file { create } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/ksm.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "cp -f /usr/lib/systemd/system/ksm.service /etc/systemd/system/" + rlRun "sed -i 's/^ConditionVirtualization=.*$//' /etc/systemd/system/ksm.service" + rlRun "systemctl daemon-reload" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlRun "systemctl daemon-reload" + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/ladvd/Makefile b/selinux-policy/ladvd/Makefile index 8572b36..45928c4 100644 --- a/selinux-policy/ladvd/Makefile +++ b/selinux-policy/ladvd/Makefile @@ -6,7 +6,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. # # This copyrighted material is made available to anyone wishing # to use, modify, copy, or redistribute it subject to the terms diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index 4e8b1a5..4bba87f 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -1,8 +1,41 @@ -path: /selinux-policy/ladvd -summary: Test ladvd utility to verify AVC denials -description: | - Test coverage for SELinux AVC issues related ladvd service. This - test suite primarily verifies two bugs ie bz1834325 and bz1855163. -adjust: -- enabled: false - when: distro <= rhel-8 +summary: Tests for ladvd service +description: |+ + Test coverage for SELinux AVC issues related to ladvd service. + +contact: Amith Kumar +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - initscripts + - kernel-headers + - ladvd + - ladvd-selinux + - libpcap + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 1h +tag: + - failinfedora + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834325 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1855163 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + because: the ladvd package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/ladvd +extra-task: /CoreOS/selinux-policy/Regression/ladvd +extra-nitrate: TC#0614606 +id: db945166-3e6e-41cc-a76d-9e4f6e4b641c diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh index b0080a9..4af6367 100755 --- a/selinux-policy/ladvd/runtest.sh +++ b/selinux-policy/ladvd/runtest.sh @@ -8,7 +8,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. # # This copyrighted material is made available to anyone wishing # to use, modify, copy, or redistribute it subject to the terms @@ -27,19 +27,26 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ladvd rlAssertRpm ladvd-selinux + + rlSESetTimestamp + rlRun "setsebool domain_kernel_load_modules on" rlServiceStop ladvd rlSESetEnforce rlSEStatus @@ -48,7 +55,7 @@ rlJournalStart rlPhaseStartTest "ladvd service selinux denials, bz#1834325" rlServiceStart ladvd sleep 2 - rlRun "ausearch -m AVC -c ladvd --raw > /tmp/avcfile" 1 + rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 0,1 if grep "tclass=process2" /tmp/avcfile; then grep "tclass=process2" /tmp/avcfile > /tmp/avc_class_file rlAssertNotGrep "denied { nnp_transition }" /tmp/avc_class_file @@ -70,7 +77,7 @@ rlJournalStart rlPhaseStartTest "ladvd selinux denials due to libpcap, bz#1855163" rlServiceStart ladvd sleep 2 - rlRun "ausearch -m AVC -c 'ladvd' --raw > /tmp/avcfile" 1 + rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 0,1 if grep "tclass=netlink_rdma_socket" /tmp/avcfile; then grep "tclass=netlink_rdma_socket" /tmp/avcfile > /tmp/avc_class_file rlAssertNotGrep "denied { create }" /tmp/avc_class_file @@ -84,6 +91,8 @@ rlJournalStart rlPhaseEnd rlPhaseStartCleanup + rlSECheckAVC + rlRun "setsebool domain_kernel_load_modules off" rlServiceRestore ladvd rlRun "rm -f /tmp/avcfile" rlRun "rm -f /tmp/avc_class_file" diff --git a/selinux-policy/libvirt-dbus-and-similar/Makefile b/selinux-policy/libvirt-dbus-and-similar/Makefile new file mode 100644 index 0000000..127fc47 --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +# Description: SELinux interferes with libvirt-dbus and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with libvirt-dbus and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: libvirt-dbus" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console libvirt-dbus /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-46893" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-73914" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/libvirt-dbus-and-similar/PURPOSE b/selinux-policy/libvirt-dbus-and-similar/PURPOSE new file mode 100644 index 0000000..94dfc9b --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +Author: Milos Malik + +SELinux interferes with libvirt-dbus and related programs. + diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf new file mode 100644 index 0000000..0b16766 --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/main.fmf @@ -0,0 +1,44 @@ +summary: SELinux interferes with libvirt-dbus and related programs +description: |+ + SELinux interferes with libvirt-dbus and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - libvirt-dbus + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS + - avoidImageMode +link: + - verifies: https://issues.redhat.com/browse/RHEL-46893 + - verifies: https://issues.redhat.com/browse/RHEL-73914 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the libvirt-dbus package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +extra-task: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +extra-nitrate: TC#0617675 +id: 051fa33d-fa04-4ccc-b4e3-91078ec2199f diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh new file mode 100755 index 0000000..e0d9a7d --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/runtest.sh @@ -0,0 +1,140 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +# Description: SELinux interferes with libvirt-dbus and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/libvirt-dbus" +SERVICE_PACKAGE="libvirt-dbus" +SERVICE_NAME="libvirt-dbus" +PROCESS_NAME="libvirt-dbus" + +if seinfo -t | grep -q virt_dbus ; then + FILE_CONTEXT="virt_dbus_exec_t" + PROCESS_CONTEXT="virt_dbus_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlRun "yum -y install libvirt\* --skip-broken -x \*i686\* -x glibc32" 0,1 + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if seinfo -t | grep -q virt_dbus ; then + rlPhaseStartTest "RHEL-46893" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSESearchRule "allow virt_dbus_t virtqemud_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow virtqemud_t virt_dbus_t : dir { search } [ ]" + rlSESearchRule "allow virtqemud_t virt_dbus_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-73914" + rlSESearchRule "allow staff_t virt_dbus_t : dbus { send_msg } [ ]" + rlSESearchRule "allow virt_dbus_t staff_t : dbus { send_msg } [ ]" + rlSESearchRule "allow sysadm_t virt_dbus_t : dbus { send_msg } [ ]" + rlSESearchRule "allow virt_dbus_t sysadm_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- confined users" + if [ -f /usr/lib/systemd/system/virtqemud.service ] ; then + rlRun "service virtqemud start" + fi + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" + for SELINUX_USER in staff_u sysadm_u ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} -G libvirt ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost busctl call org.libvirt /org/libvirt/QEMU org.libvirt.Connect ListDomains u 0" + rlRun "userdel -rfZ ${USER_NAME}" + done + rlRun "setsebool ssh_sysadm_login off" + if [ -f /usr/lib/systemd/system/virtqemud.service ] ; then + rlRun "service virtqemud stop" + fi + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- communication with other virt* services" + for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do + if [ -f /usr/lib/systemd/system/${VIRT_SERVICE}.service ] ; then + rlRun "service ${VIRT_SERVICE} start" + fi + done + + AVAIL_DAEMONS="QEMU" + if [ -f /usr/lib/systemd/system/virtlxcd.service ] ; then + AVAIL_DAEMONS="LXC QEMU" + fi + + for DAEMON in ${AVAIL_DAEMONS} ; do + for METHOD in ListDomains ListInterfaces ListNWFilters ListNetworks ListNodeDevices ListSecrets ListStoragePools ; do + rlRun "busctl call org.libvirt /org/libvirt/${DAEMON} org.libvirt.Connect ${METHOD} u 0" 0,1 + done + done + + for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do + if [ -f /usr/lib/systemd/system/${VIRT_SERVICE}.service ] ; then + rlRun "service ${VIRT_SERVICE} stop" + fi + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/libvirt-dbus-and-similar/ssh.exp b/selinux-policy/libvirt-dbus-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/logwatch-and-similar/Makefile b/selinux-policy/logwatch-and-similar/Makefile new file mode 100644 index 0000000..3292741 --- /dev/null +++ b/selinux-policy/logwatch-and-similar/Makefile @@ -0,0 +1,72 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/logwatch-and-similar +# Description: SELinux interferes with logwatch and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/logwatch-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with logwatch and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console logwatch sendmail /usr/sbin/service iproute" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2183432" >> $(METADATA) # Fedora 38 + @echo "Bug: 2270484" >> $(METADATA) # Fedora 40 + @echo "Bug: RHEL-34135" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-160896" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-160897" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/logwatch-and-similar/PURPOSE b/selinux-policy/logwatch-and-similar/PURPOSE new file mode 100644 index 0000000..6820548 --- /dev/null +++ b/selinux-policy/logwatch-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/logwatch-and-similar +Author: Milos Malik + +Description: SELinux interferes with logwatch and related programs + diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf new file mode 100644 index 0000000..e2ba6c5 --- /dev/null +++ b/selinux-policy/logwatch-and-similar/main.fmf @@ -0,0 +1,50 @@ +summary: SELinux interferes with logwatch and related programs +description: |+ + SELinux interferes with logwatch and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - logwatch + - sendmail + - /usr/sbin/service + - iproute +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS +tier: 3 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2183432 + - verifies: https://issues.redhat.com/browse/RHEL-34135 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270484 + - verifies: https://issues.redhat.com/browse/RHEL-160896 + - verifies: https://issues.redhat.com/browse/RHEL-160897 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the logwatch service is not available there +extra-summary: /CoreOS/selinux-policy/Regression/logwatch-and-similar +extra-task: /CoreOS/selinux-policy/Regression/logwatch-and-similar +extra-nitrate: TC#0617270 +id: 047f2fac-7362-412d-8f6a-95cb8af71230 diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh new file mode 100755 index 0000000..2c06f96 --- /dev/null +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -0,0 +1,127 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/logwatch-and-similar +# Description: SELinux interferes with logwatch and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_CONTEXT="logwatch_exec_t" +SERVICE_PACKAGE="logwatch" +SERVICE_NAME="logwatch" +PROCESS_NAME="logwatch" +PROCESS_CONTEXT="logwatch_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/systemd/system/logwatch.timer + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL "<9.5" ; then + rlPhaseStartTest "bz#2183432 + RHEL-34135" + rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + rlSESearchRule "allow logwatch_mail_t sysctl_net_t : dir { search } [ ]" + rlSESearchRule "allow logwatch_mail_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then + rlPhaseStartTest "bz#2270484" + rlSEMatchPathCon "/usr/share/logwatch/scripts/logwatch.pl" "logwatch_exec_t" + rlSEMatchPathCon "/usr/sbin/sendmail.sendmail" "sendmail_exec_t" + rlSEMatchPathCon "/run/systemd/sessions/" "systemd_logind_sessions_t" + rlSESearchRule "allow logwatch_t systemd_logind_sessions_t : dir { read } [ ]" + rlSESearchRule "type_transition logwatch_t sendmail_exec_t : process logwatch_mail_t" + if rlIsFedora ; then + rlSESearchRule "allow logwatch_mail_t init_t : unix_stream_socket { getattr } [ ]" + fi + rlPhaseEnd + fi + + if rlIsRHEL '>= 9.8' || rlIsRHEL '>= 10.2' ; then + rlPhaseStartTest "RHEL-160896 + RHEL-160897" + rlSESearchRule "allow logwatch_t nsfs_t : file { getattr } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "mkdir -p /var/cache/logwatch" + NS_NAME="test-ns-${RANDOM}" + rlRun "ip netns add ${NS_NAME}" + rlRun "ip netns list | grep ${NS_NAME}" + rlRun "ls -lZ /run/netns/ | grep :nsfs_t" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "ip netns del ${NS_NAME}" + rlRun "ip netns list | grep ${NS_NAME}" 1 + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.timer ] ; then + rlPhaseStartTest "real scenario -- timer" + rlRun "systemctl enable ${SERVICE_NAME}.timer" + rlRun "systemctl start ${SERVICE_NAME}.timer" + rlRun "systemctl list-timers --all" + NEXT_TIME=`date -d "now + 1 minute" "+%H:%M"` + rlRun "cp -f /usr/lib/systemd/system/${SERVICE_NAME}.timer /etc/systemd/system/" + rlRun "sed -i 's/AccuracySec=.*$/AccuracySec=1s\nOnCalendar=*-*-* $NEXT_TIME/' /etc/systemd/system/${SERVICE_NAME}.timer" + rlRun "systemctl daemon-reload" + rlRun "systemctl list-timers --all" + rlRun "sleep 2m" + rlRun "systemctl stop ${SERVICE_NAME}.timer" + rlRun "systemctl disable ${SERVICE_NAME}.timer" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/m4-bad-data/PURPOSE b/selinux-policy/m4-bad-data/PURPOSE new file mode 100644 index 0000000..ea14daa --- /dev/null +++ b/selinux-policy/m4-bad-data/PURPOSE @@ -0,0 +1,10 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/m4-bad-data +Author: Akhil Kohli + +Description: Negative bad-data tests for the M4 preprocessing stage of modular +SELinux policy builds (.if, .te, and .fc inputs before checkmodule). + +Execution is via FMF/TMT (main.fmf -> runtest.sh) using beakerlib rlRun +phases. Support macros prefer SELINUX_POLICY_SRC, else installed +selinux-policy-devel (/usr/share/selinux/devel/include/support), else a +git clone (Fedora falls back to rawhide when f$N is missing). diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc new file mode 100644 index 0000000..06aec43 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc @@ -0,0 +1 @@ +/usr/bin/bad not_a_valid_selinux_context diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc new file mode 100644 index 0000000..13821d6 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc @@ -0,0 +1 @@ +only_one_field_on_this_line diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc new file mode 100644 index 0000000..7f4dca9 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc @@ -0,0 +1 @@ +divert(-1 diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc new file mode 100644 index 0000000..7c14f2e --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc @@ -0,0 +1 @@ +/usr/bin/foo_only_path_no_context diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc new file mode 100644 index 0000000..7c122e4 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc @@ -0,0 +1 @@ +/usr/bin/[unclosed(regex -- system_u:object_r:test_good_exec_t:s0 diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc new file mode 100644 index 0000000..12b26ca --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc @@ -0,0 +1 @@ +/usr/bin/test_good -- system_u:object_r:test_good_exec_t:s0 diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if new file mode 100644 index 0000000..1e887a5 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if @@ -0,0 +1,6 @@ +interface(`dup_iface',` + type dup_t; +') +interface(`dup_iface',` + type dup2_t; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if new file mode 100644 index 0000000..536347f --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if @@ -0,0 +1,3 @@ +interface(``,` + type empty_name_t; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if new file mode 100644 index 0000000..bbfd2f6 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if @@ -0,0 +1,3 @@ +interface(`bad_garbage',` + @@@not_valid_selinux_or_m4@@@ +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if new file mode 100644 index 0000000..02c4e15 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if @@ -0,0 +1,3 @@ +interface(`bad_gen_if_build',` + gen_require(`type $1 +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if new file mode 100644 index 0000000..bbfa3a8 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if @@ -0,0 +1,4 @@ +interface(`bad_gen_require',` + gen_require(`type $1 class file { read };') + allow $1 self:file read; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if new file mode 100644 index 0000000..1d9bc85 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if @@ -0,0 +1 @@ +define(`broken_define' diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if new file mode 100644 index 0000000..0111414 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if @@ -0,0 +1,3 @@ +interface(`bad_module_line',` + module duplicate_module_line 1.0; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if new file mode 100644 index 0000000..8f5ed17 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if @@ -0,0 +1,3 @@ +interface(`bad_trunc',` + gen_require(`type $1; class file { read };') + allow $1 self:file { diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if new file mode 100644 index 0000000..7c377dd --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if @@ -0,0 +1,3 @@ +interface(`bad_unclosed',` + gen_require(`type $1;') + allow $1 self:file read; diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if new file mode 100644 index 0000000..94b83de --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if @@ -0,0 +1,4 @@ +interface(`bad_unknown_perm',` + gen_require(`type $1; class file { read };') + allow $1 self:file circular_ref; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if new file mode 100644 index 0000000..710f141 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if @@ -0,0 +1,3 @@ +interface(`bad_unknown_type',` + allow undeclared_type_t self:file read; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/good.if b/selinux-policy/m4-bad-data/fixtures/interfaces/good.if new file mode 100644 index 0000000..bc5261d --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/good.if @@ -0,0 +1,4 @@ +interface(`test_good_iface',` + gen_require(`type $1; class file { read };') + allow $1 self:file read; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if b/selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if new file mode 100644 index 0000000..00b619e --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if @@ -0,0 +1,4 @@ +interface(`needs_arg',` + gen_require(`type $1; class file { read };') + allow $1 self:file read; +') diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te b/selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te new file mode 100644 index 0000000..c33368a --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te @@ -0,0 +1,8 @@ +module te_bad_mod 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_module_line() diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te b/selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te new file mode 100644 index 0000000..7ac9436 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te @@ -0,0 +1,8 @@ +module te_few 1.0; + +require { + type foo_t; + class file { read }; +} + +needs_arg() diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te b/selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te new file mode 100644 index 0000000..cb7daf4 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te @@ -0,0 +1,8 @@ +module te_garbage 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_garbage() diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te b/selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te new file mode 100644 index 0000000..8c84961 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te @@ -0,0 +1,8 @@ +module te_gen_require 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_gen_require(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_good.te b/selinux-policy/m4-bad-data/fixtures/modules/te_good.te new file mode 100644 index 0000000..753237a --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_good.te @@ -0,0 +1,8 @@ +module te_good 1.0; + +require { + type foo_t; + class file { read }; +} + +test_good_iface(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te b/selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te new file mode 100644 index 0000000..e481b8a --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te @@ -0,0 +1,8 @@ +module te_many 1.0; + +require { + type foo_t; + class file { read }; +} + +needs_arg(foo_t, extra_unused) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te b/selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te new file mode 100644 index 0000000..4f56f72 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te @@ -0,0 +1,8 @@ +module te_trunc 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_trunc(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te new file mode 100644 index 0000000..03dd324 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te @@ -0,0 +1,8 @@ +module te_unknown_perm 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_unknown_perm(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te new file mode 100644 index 0000000..ea4724c --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te @@ -0,0 +1,8 @@ +module te_unknown_type 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_unknown_type() diff --git a/selinux-policy/m4-bad-data/main.fmf b/selinux-policy/m4-bad-data/main.fmf new file mode 100644 index 0000000..7ecf218 --- /dev/null +++ b/selinux-policy/m4-bad-data/main.fmf @@ -0,0 +1,18 @@ +summary: M4 bad-data tests for modular policy preprocessing +contact: Akhil Kohli +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy + - checkpolicy +require: + - checkpolicy + - m4 + - git + - policycoreutils + - selinux-policy-devel +recommend: + - selinux-policy + - selinux-policy-targeted +duration: 15m +enabled: true diff --git a/selinux-policy/m4-bad-data/runtest.sh b/selinux-policy/m4-bad-data/runtest.sh new file mode 100755 index 0000000..8a3ee22 --- /dev/null +++ b/selinux-policy/m4-bad-data/runtest.sh @@ -0,0 +1,379 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/m4-bad-data +# Description: M4 bad-data tests for modular policy preprocessing +# Author: Akhil Kohli +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +POLICY_GIT="${SELINUX_POLICY_GIT:-https://github.com/fedora-selinux/selinux-policy.git}" +POLICY_DIR="${SELINUX_POLICY_SRC:-}" + +BASEDIR="$(cd "$(dirname "$0")" && pwd)" +FIXTURES="${BASEDIR}/fixtures" + +M4=${M4:-m4} +CHECKMODULE=${CHECKMODULE:-checkmodule} +SEMODULE_PACKAGE=${SEMODULE_PACKAGE:-semodule_package} + +# Prefer explicit override; otherwise pick a clone branch for local/fallback use. +# Fedora Rawhide may report VERSION_ID=rawhide or a numeric ID ahead of any fN +# branch (e.g. 45 while only rawhide/f44 exist). Clone falls back to rawhide. +if [ -n "${SELINUX_POLICY_BRANCH:-}" ]; then + POLICY_BRANCH="${SELINUX_POLICY_BRANCH}" +else + test -e /etc/os-release && os_release='/etc/os-release' || os_release='/usr/lib/os-release' + # shellcheck disable=SC1090 + . "${os_release}" + if rlIsOSLike fedora; then + fedora_rel="" + if [[ "${VERSION_ID}" =~ ^[0-9]+$ ]]; then + fedora_rel="${VERSION_ID}" + elif [[ "${REDHAT_BUGZILLA_PRODUCT_VERSION:-}" =~ ^[0-9]+$ ]]; then + fedora_rel="${REDHAT_BUGZILLA_PRODUCT_VERSION}" + elif [[ "${REDHAT_SUPPORT_PRODUCT_VERSION:-}" =~ ^[0-9]+$ ]]; then + fedora_rel="${REDHAT_SUPPORT_PRODUCT_VERSION}" + fi + if [ -n "${fedora_rel}" ]; then + POLICY_BRANCH="f${fedora_rel}" + else + POLICY_BRANCH="rawhide" + fi + else + VERSION="${VERSION_ID%.*}" + POLICY_BRANCH="c${VERSION}s" + fi +fi + +DEVEL_SUPPORT="/usr/share/selinux/devel/include/support" + +# Configure M4SUPPORT/IFERROR from a selinux-policy git checkout layout. +setup_m4_from_git_tree() { + local root="$1" + M4SUPPORT="${root}/support/divert.m4 \ + ${root}/policy/support/misc_macros.spt \ + ${root}/policy/support/mls_mcs_macros.spt \ + ${root}/policy/support/loadable_module.spt \ + ${root}/policy/support/obj_perm_sets.spt \ + ${root}/support/undivert.m4" + IFERROR="${root}/support/iferror.m4" + POLICY_ROOT="${root}" +} + +# Configure M4SUPPORT from installed selinux-policy-devel (flat support/). +setup_m4_from_devel() { + local support="$1" + M4SUPPORT="${support}/divert.m4 \ + ${support}/misc_macros.spt \ + ${support}/mls_mcs_macros.spt \ + ${support}/loadable_module.spt \ + ${support}/obj_perm_sets.spt \ + ${support}/undivert.m4" + # iferror.m4 is build-tree only; recreate the upstream one-liner when absent. + if [ -f "${support}/iferror.m4" ]; then + IFERROR="${support}/iferror.m4" + else + IFERROR="${OUTDIR}/iferror.m4" + cat >"${IFERROR}" <<'EOF' +ifdef(`__if_error',`m4exit(1)') +EOF + fi + POLICY_ROOT="${support}" +} + +# Build all_interfaces.conf from one or more .if files (usual modular M4 recipe). +build_all_interfaces() { + local out="$1" + shift + + echo 'divert(-1)' >"${out}" + # shellcheck disable=SC2086 + ${M4} ${M4PARAM} ${M4SUPPORT} "$@" "${IFERROR}" >"${out}.tmp" 2>"${out}.err" + local rc=$? + sed -e 's/dollarsstar/$*/g' "${out}.tmp" >>"${out}" + echo 'divert' >>"${out}" + return "${rc}" +} + +# Expand a module .te with interfaces (usual modular M4 recipe; /dev/null for gen defs). +expand_module_te() { + local interfaces="$1" + local te="$2" + local out="$3" + + # shellcheck disable=SC2086 + ${M4} ${M4PARAM} -s ${M4SUPPORT} "${EMPTY_GEN_DEF}" "${interfaces}" "${te}" \ + >"${out}" 2>"${out}.err" + return $? +} + +# Expand file_contexts (usual modular M4 recipe for .fc -> .mod.fc). +expand_fc() { + local fc="$1" + local out="$2" + + # shellcheck disable=SC2086 + ${M4} ${M4PARAM} ${M4SUPPORT} "${fc}" >"${out}" 2>"${out}.err" + return $? +} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm checkpolicy + rlRun "command -v m4" + rlRun "command -v checkmodule" + rlRun "command -v semodule_package" + + OUTDIR=$(mktemp -d "${TMPDIR:-/var/tmp}/selinux-policy-m4-bad-data.XXXXXX") + rlRun "test -d ${OUTDIR}" + CLONED_POLICY_DIR="" + + # Macro source priority (Petr): explicit checkout > installed devel > git clone. + if [ -n "${POLICY_DIR}" ]; then + rlAssertExists "${POLICY_DIR}/Rules.modular" + setup_m4_from_git_tree "${POLICY_DIR}" + rlLog "Using SELINUX_POLICY_SRC=${POLICY_DIR}" + elif [ -f "${DEVEL_SUPPORT}/loadable_module.spt" ]; then + rlAssertRpm selinux-policy-devel + setup_m4_from_devel "${DEVEL_SUPPORT}" + rlLog "Using selinux-policy-devel support macros from ${DEVEL_SUPPORT}" + else + CLONED_POLICY_DIR="$(mktemp -d /var/tmp/selinux-policy-src.XXXXXX)" + rlLog "Cloning ${POLICY_GIT} branch ${POLICY_BRANCH}" + if rlIsOSLike fedora && [ "${POLICY_BRANCH}" != "rawhide" ]; then + # fN may not exist yet on Rawhide (e.g. f45); allow failure then retry. + rlRun "git clone --depth=1 -b ${POLICY_BRANCH} ${POLICY_GIT} ${CLONED_POLICY_DIR}" 0-255 + if [ ! -f "${CLONED_POLICY_DIR}/Rules.modular" ]; then + rlLog "Branch ${POLICY_BRANCH} unavailable; falling back to rawhide" + rlRun "rm -rf ${CLONED_POLICY_DIR}" + CLONED_POLICY_DIR="$(mktemp -d /var/tmp/selinux-policy-src.XXXXXX)" + rlRun "git clone --depth=1 -b rawhide ${POLICY_GIT} ${CLONED_POLICY_DIR}" + fi + else + rlRun "git clone --depth=1 -b ${POLICY_BRANCH} ${POLICY_GIT} ${CLONED_POLICY_DIR}" + fi + rlAssertExists "${CLONED_POLICY_DIR}/Rules.modular" + setup_m4_from_git_tree "${CLONED_POLICY_DIR}" + fi + + # shellcheck disable=SC2086 + rlRun "test -f $(echo ${M4SUPPORT} | awk '{print $1}')" + rlRun "test -f ${IFERROR}" + + M4PARAM="-D enable_mcs -D distro_redhat -D hide_broken_symptoms -D mls_num_sens=16 -D mls_num_cats=1024 -D mcs_num_cats=1024" + EMPTY_GEN_DEF=/dev/null + + rlRun "ln -sf /nonexistent/test_good.if ${OUTDIR}/broken_symlink.if" + rlRun "ln -sf /nonexistent/test_good.mod.fc ${OUTDIR}/broken_symlink.fc" + rlRun "printf '' > ${OUTDIR}/empty.fc" + rlPhaseEnd + + # --- .if -> all_interfaces.conf --- + rlPhaseStartTest "unclosed interface definition" + rlRun "build_all_interfaces ${OUTDIR}/b1_unclosed.interfaces ${FIXTURES}/interfaces/bad_unclosed.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken M4 syntax in interface file" + rlRun "build_all_interfaces ${OUTDIR}/b1_m4_syntax.interfaces ${FIXTURES}/interfaces/bad_m4_syntax.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "duplicate interface definition" + rlRun "build_all_interfaces ${OUTDIR}/b1_duplicate.interfaces ${FIXTURES}/interfaces/bad_duplicate.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken gen_require block in interface file" + rlRun "build_all_interfaces ${OUTDIR}/b1_bad_gen_if.interfaces ${FIXTURES}/interfaces/bad_gen_if_build.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "empty interface template name" + rlRun "build_all_interfaces ${OUTDIR}/b1_empty_ifname.interfaces ${FIXTURES}/interfaces/bad_empty_ifname.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "missing .if path" + rlRun "build_all_interfaces ${OUTDIR}/b1_missing.interfaces ${OUTDIR}/does_not_exist.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "directory instead of .if file" + rlRun "build_all_interfaces ${OUTDIR}/b1_directory.interfaces ${BASEDIR}" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken symlink for .if" + rlRun "build_all_interfaces ${OUTDIR}/b1_symlink.interfaces ${OUTDIR}/broken_symlink.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "unreadable .if file" + if [ "$(id -u)" -eq 0 ]; then + rlLog "SKIP: root can read mode 000 files; unreadable check is non-root only" + else + rlRun "cp ${FIXTURES}/interfaces/good.if ${OUTDIR}/unreadable.if" + rlRun "chmod 000 ${OUTDIR}/unreadable.if" + rlRun "build_all_interfaces ${OUTDIR}/unreadable_if.interfaces ${OUTDIR}/unreadable.if" 1-255 + fi + rlPhaseEnd + + rlPhaseStartTest "control good interface" + rlRun "build_all_interfaces ${OUTDIR}/b1_good.interfaces ${FIXTURES}/interfaces/good.if" + rlRun "test -s ${OUTDIR}/b1_good.interfaces" + rlPhaseEnd + + GOOD_IF="${OUTDIR}/b1_good.interfaces" + + # --- .te + M4 with interfaces --- + rlPhaseStartTest "control good .if + .te through M4 and checkmodule" + rlRun "expand_module_te ${GOOD_IF} ${FIXTURES}/modules/te_good.te ${OUTDIR}/b2_good.tmp" + rlRun "test -s ${OUTDIR}/b2_good.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_good.mod ${OUTDIR}/b2_good.tmp" + rlRun "test -s ${OUTDIR}/te_good.mod" + rlPhaseEnd + + rlPhaseStartTest "missing .te path at M4 expand" + rlRun "expand_module_te ${GOOD_IF} ${OUTDIR}/does_not_exist.te ${OUTDIR}/b2_missing_te.tmp" 1-255 + rlPhaseEnd + + NEEDS_ARG_IF="${OUTDIR}/needs_arg.interfaces" + + rlPhaseStartTest "interface called with too few arguments" + rlRun "build_all_interfaces ${NEEDS_ARG_IF} ${FIXTURES}/interfaces/needs_arg.if" + rlRun "expand_module_te ${NEEDS_ARG_IF} ${FIXTURES}/modules/te_few_args.te ${OUTDIR}/b2_few_args.tmp" + rlRun "test -s ${OUTDIR}/b2_few_args.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_few.mod ${OUTDIR}/b2_few_args.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "interface called with too many arguments" + rlLog "DOCUMENT: extra interface args are ignored by M4" + rlRun "test -s ${NEEDS_ARG_IF}" + rlRun "expand_module_te ${NEEDS_ARG_IF} ${FIXTURES}/modules/te_many_args.te ${OUTDIR}/b2_many_args.tmp" + rlRun "test -s ${OUTDIR}/b2_many_args.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_many.mod ${OUTDIR}/b2_many_args.tmp" + rlRun "test -s ${OUTDIR}/te_many.mod" + rlPhaseEnd + + # --- M4 OK, bad expanded TE -> checkmodule fails --- + # bad_trunc.if is unclosed at the M4 interface stage (EOF in string), so it is + # rejected before module expand — same class of failure as other broken .if files. + rlPhaseStartTest "truncated allow from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_trunc.interfaces ${FIXTURES}/interfaces/bad_trunc.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken gen_require expanded from interface" + rlRun "build_all_interfaces ${OUTDIR}/bad_gen_require.interfaces ${FIXTURES}/interfaces/bad_gen_require.if" + rlRun "expand_module_te ${OUTDIR}/bad_gen_require.interfaces ${FIXTURES}/modules/te_gen_require.te ${OUTDIR}/b5_gen_require.tmp" + rlRun "test -s ${OUTDIR}/b5_gen_require.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_gen_require.mod ${OUTDIR}/b5_gen_require.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "unknown type from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_unknown_type.interfaces ${FIXTURES}/interfaces/bad_unknown_type.if" + rlRun "expand_module_te ${OUTDIR}/bad_unknown_type.interfaces ${FIXTURES}/modules/te_unknown_type.te ${OUTDIR}/b5_unknown_type.tmp" + rlRun "test -s ${OUTDIR}/b5_unknown_type.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_unknown_type.mod ${OUTDIR}/b5_unknown_type.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "unknown permission from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_unknown_perm.interfaces ${FIXTURES}/interfaces/bad_unknown_perm.if" + rlRun "expand_module_te ${OUTDIR}/bad_unknown_perm.interfaces ${FIXTURES}/modules/te_unknown_perm.te ${OUTDIR}/b5_unknown_perm.tmp" + rlRun "test -s ${OUTDIR}/b5_unknown_perm.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_unknown_perm.mod ${OUTDIR}/b5_unknown_perm.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "garbage token from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_garbage.interfaces ${FIXTURES}/interfaces/bad_garbage.if" + rlRun "expand_module_te ${OUTDIR}/bad_garbage.interfaces ${FIXTURES}/modules/te_garbage.te ${OUTDIR}/b5_garbage.tmp" + rlRun "test -s ${OUTDIR}/b5_garbage.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_garbage.mod ${OUTDIR}/b5_garbage.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "invalid module line from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_module_line.interfaces ${FIXTURES}/interfaces/bad_module_line.if" + rlRun "expand_module_te ${OUTDIR}/bad_module_line.interfaces ${FIXTURES}/modules/te_bad_module_line.te ${OUTDIR}/b5_module_line.tmp" + rlRun "test -s ${OUTDIR}/b5_module_line.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_bad_mod.mod ${OUTDIR}/b5_module_line.tmp" 1-255 + rlPhaseEnd + + # --- .fc -> M4 -> .mod.fc --- + rlPhaseStartTest "control good .fc through M4" + rlRun "expand_fc ${FIXTURES}/file_contexts/good.fc ${OUTDIR}/b3_good.mod.fc" + rlRun "test -s ${OUTDIR}/b3_good.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "invalid context survives M4" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_context.fc ${OUTDIR}/b3_bad_context.mod.fc" + rlRun "test -s ${OUTDIR}/b3_bad_context.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "wrong field count in .fc" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_fields.fc ${OUTDIR}/b3_bad_fields.mod.fc" + rlRun "test -s ${OUTDIR}/b3_bad_fields.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "empty .fc file" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${OUTDIR}/empty.fc ${OUTDIR}/b3_empty_fc.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "path-only line without context in .fc" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_no_context.fc ${OUTDIR}/b3_no_context.mod.fc" + rlRun "test -s ${OUTDIR}/b3_no_context.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "invalid regex metacharacters in .fc path" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_regex.fc ${OUTDIR}/b3_bad_regex.mod.fc" + rlRun "test -s ${OUTDIR}/b3_bad_regex.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "missing .fc path" + rlRun "expand_fc ${OUTDIR}/does_not_exist.fc ${OUTDIR}/b3_missing.mod.fc" 1-255 + rlPhaseEnd + + rlPhaseStartTest "directory instead of .fc file" + rlRun "expand_fc ${BASEDIR} ${OUTDIR}/b3_directory.mod.fc" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken symlink for .fc" + rlRun "expand_fc ${OUTDIR}/broken_symlink.fc ${OUTDIR}/b3_symlink.mod.fc" 1-255 + rlPhaseEnd + + rlPhaseStartTest "unreadable .fc file" + if [ "$(id -u)" -eq 0 ]; then + rlLog "SKIP: root can read mode 000 files; unreadable check is non-root only" + else + rlRun "cp ${FIXTURES}/file_contexts/good.fc ${OUTDIR}/unreadable.fc" + rlRun "chmod 000 ${OUTDIR}/unreadable.fc" + rlRun "expand_fc ${OUTDIR}/unreadable.fc ${OUTDIR}/unreadable_fc.mod.fc" 1-255 + fi + rlPhaseEnd + + rlPhaseStartTest "broken M4 syntax in .fc" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_m4_syntax.fc ${OUTDIR}/b3_bad_m4.mod.fc" 1-255 + rlPhaseEnd + + # --- M4-expanded .mod.fc through semodule_package (E2E; labeling deferred) --- + rlPhaseStartTest "bad M4-expanded .mod.fc packaged with good .mod" + rlLog "DOCUMENT: M4 to package E2E; labeling validation deferred to sefcontext_compile" + rlRun "mkdir -p ${OUTDIR}/b6_e2e_build" + rlRun "expand_module_te ${GOOD_IF} ${FIXTURES}/modules/te_good.te ${OUTDIR}/b6_e2e.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/b6_e2e_build/te_good.mod ${OUTDIR}/b6_e2e.tmp" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_context.fc ${OUTDIR}/b6_e2e.mod.fc" + rlRun "${SEMODULE_PACKAGE} -o ${OUTDIR}/b6_e2e.pp -m ${OUTDIR}/b6_e2e_build/te_good.mod -f ${OUTDIR}/b6_e2e.mod.fc" + rlRun "test -s ${OUTDIR}/b6_e2e.pp" + rlPhaseEnd + + rlPhaseStartCleanup + if [ -n "${OUTDIR:-}" ] && [ -d "${OUTDIR}" ]; then + rlRun "rm -rf ${OUTDIR}" + fi + if [ -n "${CLONED_POLICY_DIR:-}" ] && [ -d "${CLONED_POLICY_DIR}" ]; then + rlRun "rm -rf ${CLONED_POLICY_DIR}" + fi + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/selinux-policy/nasd-and-similar/Makefile b/selinux-policy/nasd-and-similar/Makefile new file mode 100644 index 0000000..3d9f93c --- /dev/null +++ b/selinux-policy/nasd-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/nasd-and-similar +# Description: SELinux interferes with the nasd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/nasd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the nasd service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: nas" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nas /usr/sbin/service perl-Perl4-CoreLibs" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/nasd-and-similar/PURPOSE b/selinux-policy/nasd-and-similar/PURPOSE new file mode 100644 index 0000000..3315a94 --- /dev/null +++ b/selinux-policy/nasd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/nasd-and-similar +Author: Milos Malik + +SELinux interferes with the nasd service and related programs. + diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf new file mode 100644 index 0000000..7ba0e30 --- /dev/null +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -0,0 +1,39 @@ +summary: SELinux interferes with the nasd service and related programs +description: |+ + SELinux interferes with the nasd service and related programs. + +contact: Milos Malik +component: + - nas +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - nas + - perl-Perl4-CoreLibs + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the nas package is not available there + - enabled: false + when: distro >= centos-stream-9 + because: the nas package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/nasd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar +extra-nitrate: TC#0614607 +id: ad784a9d-5cf4-4aac-b583-68458860acd9 +tag: + - failinfedora + - NoRHIVOS diff --git a/selinux-policy/nasd-and-similar/runtest.sh b/selinux-policy/nasd-and-similar/runtest.sh new file mode 100755 index 0000000..fe86100 --- /dev/null +++ b/selinux-policy/nasd-and-similar/runtest.sh @@ -0,0 +1,107 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/nasd-and-similar +# Description: SELinux interferes with the nasd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="N0t-1mp0rt4nT" +FILE_PATH="/usr/bin/nasd" +FILE_CONTEXT="soundd_exec_t" +SERVICE_PACKAGE="nas" +SERVICE_NAME="nasd" +PROCESS_NAME="nasd" +PROCESS_CONTEXT="soundd_t" + +rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlFileBackup /etc/sysconfig/nasd + sed -i 's/^NASD_OPTIONS.*$/NASD_OPTIONS="-aa -pn"/' /etc/sysconfig/nasd + rlRun "uname -r" + rlRun "dnf -y install kernel-modules-`uname -r`" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux type is not defined yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "modprobe snd_pcm_oss" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "ls -lZ /dev/dsp*" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/nfsdcld-and-similar/Makefile b/selinux-policy/nfsdcld-and-similar/Makefile index 0de572a..cece726 100644 --- a/selinux-policy/nfsdcld-and-similar/Makefile +++ b/selinux-policy/nfsdcld-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nfs-utils" >> $(METADATA) + @echo "Requires: audit /usr/sbin/service libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nfs-utils" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -63,6 +63,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1834234" >> $(METADATA) # Fedora 32 + @echo "Bug: 2026588" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/selinux-policy/nfsdcld-and-similar/main.fmf b/selinux-policy/nfsdcld-and-similar/main.fmf index 5dbc685..c371bdb 100644 --- a/selinux-policy/nfsdcld-and-similar/main.fmf +++ b/selinux-policy/nfsdcld-and-similar/main.fmf @@ -1,5 +1,44 @@ -path: /selinux-policy/nfsdcld-and-similar -tier: 2 -adjust: -- enabled: false - when: distro < rhel-8 +summary: SELinux interferes with the nfsdcld service and related programs +description: |+ + SELinux interferes with the nfsdcld service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - /usr/sbin/service + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - nfs-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - failinfedora + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834234 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2026588 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0608104 +extra-summary: /CoreOS/selinux-policy/Regression/nfsdcld-and-similar +extra-task: /CoreOS/selinux-policy/Regression/nfsdcld-and-similar +id: c92c4cfe-bb32-411b-a623-fe5c7feee13b diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh index 0fd7a54..b6e8ad4 100755 --- a/selinux-policy/nfsdcld-and-similar/runtest.sh +++ b/selinux-policy/nfsdcld-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -41,7 +40,7 @@ PROCESS_CONTEXT="rpcd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -56,7 +55,7 @@ rlJournalStart sleep 2 rlPhaseEnd - rlPhaseStartTest "bz#1834234" + rlPhaseStartTest "bz#1834234 + bz#2026588" rlSEMatchPathCon "/usr/sbin/nfsdcld" "rpcd_exec_t" rlSESearchRule "allow init_t rpcd_exec_t : file { getattr open read execute } [ ]" rlSESearchRule "type_transition init_t rpcd_exec_t : process rpcd_t" @@ -64,15 +63,17 @@ rlJournalStart rlSESearchRule "allow rpcd_t nfsd_fs_t : file { getattr open read } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/notself-other-keywords/main.fmf b/selinux-policy/notself-other-keywords/main.fmf new file mode 100644 index 0000000..c64df80 --- /dev/null +++ b/selinux-policy/notself-other-keywords/main.fmf @@ -0,0 +1,33 @@ +summary: Basic test of the notself/other keywords +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +recommend: + - libsepol + - libsemanage + - libselinux + - policycoreutils + - selinux-policy + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 + because: notself/other keywords are not recognized/implemented there +extra-nitrate: TC#0617216 +id: 88fc548f-c1fa-48dc-a5ca-58478774911f diff --git a/selinux-policy/notself-other-keywords/notself-module.cil b/selinux-policy/notself-other-keywords/notself-module.cil new file mode 100644 index 0000000..ae361a7 --- /dev/null +++ b/selinux-policy/notself-other-keywords/notself-module.cil @@ -0,0 +1,3 @@ +(type a_t) +(allow a_t notself ( process ( signal ))) + diff --git a/selinux-policy/notself-other-keywords/other-module.cil b/selinux-policy/notself-other-keywords/other-module.cil new file mode 100644 index 0000000..90e0570 --- /dev/null +++ b/selinux-policy/notself-other-keywords/other-module.cil @@ -0,0 +1,9 @@ +(typeattribute parts) +(type a_t) +(type b_t) +(type c_t) +(typeattributeset parts ( a_t )) +(typeattributeset parts ( b_t )) +(typeattributeset parts ( c_t )) +(allow parts other ( process ( signal ))) + diff --git a/selinux-policy/notself-other-keywords/runtest.sh b/selinux-policy/notself-other-keywords/runtest.sh new file mode 100755 index 0000000..48c5442 --- /dev/null +++ b/selinux-policy/notself-other-keywords/runtest.sh @@ -0,0 +1,71 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + CUR_VERSION=`rpm -q --qf "%{version}" policycoreutils | head -n 1` + if rlTestVersion ${CUR_VERSION} '<' 3.6 ; then + rlLog "The installed SELinux userspace does NOT support the notself/other keywords." + rlLog "The automated test is NOT relevant for this environment." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlAssertRpm libsepol + rlAssertRpm libsemanage + rlAssertRpm libselinux + rlAssertRpm policycoreutils + rlAssertRpm selinux-policy + + rlRun "setenforce 1" + rlRun "sestatus" + rlPhaseEnd + + rlPhaseStartTest "rules defined via the 'notself' keyword" + rlRun "semodule -lfull | grep notself-module" 1 + rlRun "seinfo -t | grep -vi Types: | wc -l" + # FIXME: seinfo output contains 1 empty line + NO_TYPES_BEFORE=`seinfo -t | grep -vi Types: | wc -l` + rlRun "sesearch -A | wc -l" + NO_ALLOWS_BEFORE=`sesearch -A | wc -l` + rlRun "semodule -i notself-module.cil" + rlRun "semodule -lfull | grep notself-module" + rlRun "seinfo -t | grep -vi Types: | wc -l" + # FIXME: seinfo output contains 1 empty line + NO_TYPES_AFTER=`seinfo -t | grep -vi Types: | wc -l` + rlRun "sesearch -A | wc -l" + NO_ALLOWS_AFTER=`sesearch -A | wc -l` + rlLog "${NO_ALLOWS_BEFORE} + ${NO_TYPES_BEFORE} - 1 = ${NO_ALLOWS_AFTER}" + # FIXME: -1 is used because seinfo output contains 1 empty line + rlAssertEquals "the number of allow rules grows because of the 'notself' usage" $(( NO_ALLOWS_BEFORE + NO_TYPES_BEFORE - 1 )) $NO_ALLOWS_AFTER + rlRun "sesearch -A | grep notself" 1 + rlRun "semodule -r notself-module" + rlPhaseEnd + + rlPhaseStartTest "rules defined via the 'other' keyword" + rlRun "semodule -lfull | grep other-module" 1 + rlRun "seinfo -t a_t -x | grep -i 'types: *0'" + rlRun "sesearch -s a_t -A" 1 + rlRun "semodule -i other-module.cil" + rlRun "semodule -lfull | grep other-module" + rlRun "seinfo -t a_t -x | grep -C 1 -i 'types: *1'" + rlRun "sesearch -A | grep other" 1 + rlLog "the 'other' keyword should NOT generate any allow rules where scontext = tcontext" + rlRun "sesearch -s a_t -t a_t -A | grep allow" 1 + rlRun "sesearch -s b_t -t b_t -A | grep allow" 1 + rlRun "sesearch -s c_t -t c_t -A | grep allow" 1 + rlLog "the 'other' keyword should generate allow rules where scontext != tcontext" + rlRun "sesearch -s a_t -t b_t -A | grep allow" + rlRun "sesearch -s a_t -t c_t -A | grep allow" + rlRun "sesearch -s b_t -t a_t -A | grep allow" + rlRun "sesearch -s b_t -t c_t -A | grep allow" + rlRun "sesearch -s c_t -t a_t -A | grep allow" + rlRun "sesearch -s c_t -t b_t -A | grep allow" + rlRun "semodule -r other-module" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + diff --git a/selinux-policy/ntpsec-and-similar/Makefile b/selinux-policy/ntpsec-and-similar/Makefile new file mode 100644 index 0000000..bd21b6d --- /dev/null +++ b/selinux-policy/ntpsec-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/ntpsec-and-similar +# Description: SELinux interferes with the ntpsec ntpd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/ntpsec-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the ntpsec ntpd service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console ntpsec /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL10" >> $(METADATA) + @echo "Bug: 2246805" >> $(METADATA) # Fedora 38 + @echo "Bug: RHEL-15085" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/ntpsec-and-similar/PURPOSE b/selinux-policy/ntpsec-and-similar/PURPOSE new file mode 100644 index 0000000..d39d82d --- /dev/null +++ b/selinux-policy/ntpsec-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/ntpsec-and-similar +Author: Milos Malik + +SELinux interferes with the ntpsec ntpd service and related program + diff --git a/selinux-policy/ntpsec-and-similar/main.fmf b/selinux-policy/ntpsec-and-similar/main.fmf new file mode 100644 index 0000000..8fe3341 --- /dev/null +++ b/selinux-policy/ntpsec-and-similar/main.fmf @@ -0,0 +1,47 @@ +summary: SELinux interferes with the ntpsec ntpd service and related programs +description: |+ + SELinux interferes with the ntpsec ntpd service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - ntpsec + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - epel + - rhel9-epel + - targeted + - NoRHIVOS +tier: '3' +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246805 + - verifies: https://issues.redhat.com/browse/RHEL-15085 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-10, centos-stream-10 + because: the ntpsec package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/ntpsec-and-similar +extra-task: /CoreOS/selinux-policy/Regression/ntpsec-and-similar +extra-nitrate: TC#0615926 +id: 258f0e8c-141f-473c-b418-d19049c464b2 diff --git a/selinux-policy/ntpsec-and-similar/runtest.sh b/selinux-policy/ntpsec-and-similar/runtest.sh new file mode 100755 index 0000000..30ad45c --- /dev/null +++ b/selinux-policy/ntpsec-and-similar/runtest.sh @@ -0,0 +1,91 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/ntpsec-and-similar +# Description: SELinux interferes with the ntpsec ntpd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/ntpd" +FILE_CONTEXT="ntpd_exec_t" +SERVICE_PACKAGE="ntpsec" +SERVICE_NAME="ntpd" +PROCESS_NAME="ntpd" +PROCESS_CONTEXT="ntpd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/ntp.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL "<9.4" ; then + rlPhaseStartTest "bz#2246805 + RHEL-15085" + rlSEMatchPathCon "/usr/sbin/ntpd" "ntpd_exec_t" + rlSESearchRule "allow ntpd_t ntske_port_t : tcp_socket { name_connect } [ ]" + rlSEMatchPortCon tcp 4460 ntske_port_t + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "echo -en '\nserver nts.netnod.se:4460 nts iburst\n' >> /etc/ntp.conf" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/numad-and-similar/Makefile b/selinux-policy/numad-and-similar/Makefile new file mode 100644 index 0000000..10f6781 --- /dev/null +++ b/selinux-policy/numad-and-similar/Makefile @@ -0,0 +1,86 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/numad-and-similar +# Description: SELinux interferes with numad and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/numad-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with numad and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: numad" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: expect" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: initscripts" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: numad" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: procps" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Architectures: aarch64 ppc64le x86_64" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 807157" >> $(METADATA) # RHEL-6 + @echo "Bug: 857086" >> $(METADATA) # RHEL-7 + @echo "Bug: 1074449" >> $(METADATA) # RHEL-7 + @echo "Bug: 1118515" >> $(METADATA) # RHEL-7 + @echo "Bug: 2026968" >> $(METADATA) # Fedora 35 + @echo "Bug: RHEL-2415" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/numad-and-similar/PURPOSE b/selinux-policy/numad-and-similar/PURPOSE new file mode 100644 index 0000000..e3fd202 --- /dev/null +++ b/selinux-policy/numad-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/numad-and-similar +Author: Milos Malik + +SELinux interferes with numad and related programs. + diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf new file mode 100644 index 0000000..8a0faa1 --- /dev/null +++ b/selinux-policy/numad-and-similar/main.fmf @@ -0,0 +1,55 @@ +summary: SELinux interferes with numad and related programs +description: |+ + SELinux interferes with numad and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - expect + - grep + - /usr/sbin/service + - libselinux + - libselinux-utils + - numad + - policycoreutils + - procps + - selinux-policy + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - TipWaived7 + - targeted + - NoRHIVOS +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=807157 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=857086 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1074449 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1118515 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2026968 + - verifies: https://issues.redhat.com/browse/RHEL-2415 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false + - enabled: false + when: arch != x86_64 and arch != aarch64 and arch != ppc64le + continue: false +extra-nitrate: TC#0202428 +extra-summary: /CoreOS/selinux-policy/Regression/numad-and-similar +extra-task: /CoreOS/selinux-policy/Regression/numad-and-similar +id: f97f6046-ee73-48ec-b3fc-7aa08648890c diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh new file mode 100755 index 0000000..52cbe64 --- /dev/null +++ b/selinux-policy/numad-and-similar/runtest.sh @@ -0,0 +1,132 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/numad-and-similar +# Description: SELinux interferes with numad and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_NAME="numad" +PROCESS_NAME="numad" +PROCESS_CONTEXT="numad_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm numad + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined "numad_t numad_exec_t" ; then + rlPhaseStartTest "bz#807157" + rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" + rlSESearchRule "allow initrc_t numad_t : process { transition }" + rlPhaseEnd + fi + + if rlSEDefined "numad_exec_t cgroup_t numad_t" ; then + rlPhaseStartTest "bz#857086" + rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" + if rlIsRHEL 6 ; then + MOUNT_POINT="/cgroup/cpuset" + rlSEMatchPathCon "${MOUNT_POINT}" "cgroup_t" + else + MOUNT_POINT="/sys/fs/cgroup/cpuset" + if [ -d ${MOUNT_POINT} ] ; then + rlRun "ls -dZ ${MOUNT_POINT} | grep :cgroup_t" + else + rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t" + fi + fi + rlSESearchRule "allow numad_t cgroup_t : dir { getattr search }" + rlSESearchRule "allow numad_t numad_t : msg { send receive }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1074449" + rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" + rlSESearchRule "allow numad_t sysfs_t : file { write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1118515" + rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" + rlSEMatchPathCon "/var/log/numad.log" "numad_var_log_t" + rlSEMatchPathCon "/var/run/numad.pid" "numad_var_run_t" + rlSESearchRule "allow virtd_t numad_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition virtd_t numad_exec_t : process numad_t" + rlSESearchRule "allow virtd_t numad_t : process { transition }" + rlSESearchRule "allow numad_t numad_var_log_t : file { open }" + rlSESearchRule "allow numad_t numad_t : msg { send receive }" + rlSESearchRule "allow numad_t numad_t : msgq { associate unix_read unix_write read write }" + rlSESearchRule "allow numad_t numad_var_run_t : file { getattr open read }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#2026968 + RHEL-2415" + rlSESearchRule "allow numad_t numad_t : capability { ipc_owner } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "mkdir -p ${MOUNT_POINT}" + if ! mount | grep -q "cgroup.*cpuset" ; then + rlRun "mount cgroup -t cgroup -o cpuset ${MOUNT_POINT}" 0,32 + fi + rlRun "semodule -l | grep numad" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "numad -S 0" + rlRun "numad -S 1" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlFileRestore + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/nvme-stas-and-similar/Makefile b/selinux-policy/nvme-stas-and-similar/Makefile new file mode 100644 index 0000000..fadaa75 --- /dev/null +++ b/selinux-policy/nvme-stas-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +# Description: SELinux interferes with stacd and stafd services +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/nvme-stas-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with stacd and stafd services" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: nvme-stas" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: avahi audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service nvme-stas" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2111414" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-1557" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/nvme-stas-and-similar/PURPOSE b/selinux-policy/nvme-stas-and-similar/PURPOSE new file mode 100644 index 0000000..0f6ef81 --- /dev/null +++ b/selinux-policy/nvme-stas-and-similar/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +Author: Milos Malik + +SELinux interferes with stacd and stafd services. +SELinux also affects the stacctl and stafctl programs. + diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf new file mode 100644 index 0000000..277ee8e --- /dev/null +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -0,0 +1,49 @@ +summary: SELinux interferes with stacd and stafd services +description: |+ + SELinux interferes with stacd and stafd services + +contact: Milos Malik +component: + - nvme-stas + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - avahi + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - nvme-stas +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - failinfedora + - NoRHIVOS + - epel + - rhel10-epel +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2111414 + - verifies: https://issues.redhat.com/browse/RHEL-1557 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the nvme-stas package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +extra-task: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +extra-nitrate: TC#0614621 +id: 6a439688-11aa-4fbe-be69-666d5245e4e0 diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh new file mode 100755 index 0000000..ba83928 --- /dev/null +++ b/selinux-policy/nvme-stas-and-similar/runtest.sh @@ -0,0 +1,131 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +# Description: SELinux interferes with stacd and stafd services +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_CONTEXT="nvme_stas_exec_t" +SERVICE_PACKAGE="nvme-stas" +PROCESS_CONTEXT="nvme_stas_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStart avahi-daemon + rlServiceStop stacd stafd + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined "${FILE_CONTEXT} ${PROCESS_CONTEXT}" ; then + rlPhaseStartTest "bz#2111414 + RHEL-1557" + rlSEMatchPathCon "/usr/sbin/stacd" "${FILE_CONTEXT}" + rlSEMatchPathCon "/usr/sbin/stafd" "${FILE_CONTEXT}" + rlSEMatchPathCon "/dev/nvme-fabrics" "fixed_disk_device_t" + rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t" + rlSEMatchPathCon "/run/stacd" "nvme_stas_var_run_t" + rlSEMatchPathCon "/run/stacd/last-known-config.pickle" "nvme_stas_var_run_t" + rlSEMatchPathCon "/run/stafd" "nvme_stas_var_run_t" + rlSEMatchPathCon "/run/stafd/last-known-config.pickle" "nvme_stas_var_run_t" + rlSEMatchPathCon "/run/udev/" "udev_var_run_t" + rlSEMatchPathCon "/run/udev/rules.d/" "udev_var_run_t" + rlSEMatchPathCon "/run/udev/rules.d/70-nvmf-autoconnect.rules" "udev_var_run_t" + rlSEMatchPathCon "/var/cache/stacd" "nvme_stas_cache_t" + rlSEMatchPathCon "/var/cache/stafd" "nvme_stas_cache_t" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlRun "semodule -lfull | grep stas" + rlSESearchRule "allow avahi_t nvme_stas_t : dbus { send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t avahi_t : dbus { send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t fixed_disk_device_t : chr_file { getattr } [ ]" + rlSESearchRule "allow nvme_stas_t nvme_stas_t : dbus { send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t syslogd_var_run_t : sock_file { write } [ ]" + rlSESearchRule "allow nvme_stas_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t udev_var_run_t : dir { add_name remove_name write } [ ]" + rlSESearchRule "allow nvme_stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]" + rlSESearchRule "allow nvme_stas_t nvme_stas_var_run_t : file { getattr ioctl open read write } [ ]" + rlSESearchRule "allow unconfined_t nvme_stas_t : dbus { send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t unconfined_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + for CUR_FILE in /usr/lib/systemd/system/stacd.service \ + /usr/lib/systemd/system/stafd.service ; do + if grep -q '^ExecStart=.*python' ${CUR_FILE} ; then + rlRun "cp -f ${CUR_FILE} /etc/systemd/system/" + COPIED_FILE=`echo ${CUR_FILE} | sed 's|/usr/lib|/etc|'` + rlRun "sed -i 's|^ExecStart=.*python.* /|ExecStart=/|' ${COPIED_FILE}" + rlRun "systemctl daemon-reload" + rlRun "grep '^ExecStart=' ${COPIED_FILE}" + fi + done + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "mkdir -p /etc/nvme" + rlRun "touch /etc/nvme/hostid" + rlRun "touch /etc/nvme/hostnqn" + rlSEService - stafd stafd ${PROCESS_CONTEXT} "start status" 1 + rlRun "stafctl status" + rlRun "stafctl ls" + rlSEService - stacd stacd ${PROCESS_CONTEXT} "start status" 1 + rlRun "stacctl status" + rlRun "stacctl ls" + rlRun "stasadm -v" + rlRun "stasadm hostid" + rlRun "stasadm hostnqn" + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - stacd stacd ${PROCESS_CONTEXT} "restart status stop status" 1 + rlSEService - stafd stafd ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlRun "rm -f /etc/systemd/system/stacd.service" + rlRun "rm -f /etc/systemd/system/stafd.service" + rlRun "systemctl daemon-reload" + rlServiceRestore stacd stafd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/opensmtpd-and-similar/Makefile b/selinux-policy/opensmtpd-and-similar/Makefile new file mode 100644 index 0000000..1e21b4b --- /dev/null +++ b/selinux-policy/opensmtpd-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +# Description: SELinux interferes with the opensmtpd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/opensmtpd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the opensmtpd service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service /usr/bin/mailx" >> $(METADATA) # EPEL + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2208696" >> $(METADATA) # Fedora 38 + @echo "Bug: 2246115" >> $(METADATA) # Fedora rawhide + @echo "Bug: RHEL-15175" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/opensmtpd-and-similar/PURPOSE b/selinux-policy/opensmtpd-and-similar/PURPOSE new file mode 100644 index 0000000..7f8a9ff --- /dev/null +++ b/selinux-policy/opensmtpd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +Author: Milos Malik + +SELinux interferes with the opensmtpd service and related programs + diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf new file mode 100644 index 0000000..ba8c289 --- /dev/null +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -0,0 +1,49 @@ +summary: SELinux interferes with the opensmtpd service and related programs +description: |+ + SELinux interferes with the opensmtpd service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - opensmtpd + - /usr/sbin/service + - /usr/bin/mailx +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - epel + - rhel8-epel + - rhel9-epel + - rhel10-epel + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246115 + - verifies: https://issues.redhat.com/browse/RHEL-15175 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the opensmtpd package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +extra-nitrate: TC#0615352 +id: cb0ae69e-3193-450f-901f-4159048d1180 diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh new file mode 100755 index 0000000..c728060 --- /dev/null +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -0,0 +1,116 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +# Description: SELinux interferes with the opensmtpd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/smtpd" +FILE_CONTEXT="sendmail_exec_t" +SERVICE_PACKAGE="opensmtpd" +SERVICE_NAME="opensmtpd" +PROCESS_NAME="smtpd" +PROCESS_CONTEXT="sendmail_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi + + if [ -e /etc/pki/tls/cert.pem ] ; then + CERTIFICATE_MISSING="false" + else + CERTIFICATE_MISSING="true" + fi + rlServiceStop ${SERVICE_NAME} postfix sendmail + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + if ! rlIsRHEL "<9.4" ; then + rlPhaseStartTest "bz#2208696" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/smtpd.sock" "sendmail_var_run_t" + rlSESearchRule "allow sendmail_t sendmail_t : capability { sys_chroot fowner } [ ]" + rlSESearchRule "type_transition sendmail_t var_run_t : sock_file sendmail_var_run_t" + rlSESearchRule "allow sendmail_t sendmail_var_run_t : sock_file { create setattr unlink write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2246115" + rlSEMatchPathCon "/run/smtpd.sock" "sendmail_var_run_t" + rlSESearchRule "allow sendmail_t sendmail_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "RHEL-15175" + # actions on the /var/run/smtpd.pid file + rlSESearchRule "allow sendmail_t sendmail_var_run_t : file { create getattr open unlink write } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! ls -Z ${FILE_PATH} | grep -q ${FILE_CONTEXT} ; then + # for environments where the service is not yet confined + PROCESS_CONTEXT="unconfined_service_t" + fi + if ${CERTIFICATE_MISSING} ; then + rlRun "touch /etc/pki/tls/cert.pem" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "sestatus | mailx -s test-email root@localhost" + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlRun "smtpctl show status" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + if ${CERTIFICATE_MISSING} ; then + rlRun "rm -f /etc/pki/tls/cert.pem" + fi + rlServiceRestore ${SERVICE_NAME} postfix sendmail + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/pam_console-and-related/main.fmf b/selinux-policy/pam_console-and-related/main.fmf index 96a80b5..986021c 100644 --- a/selinux-policy/pam_console-and-related/main.fmf +++ b/selinux-policy/pam_console-and-related/main.fmf @@ -1,2 +1,55 @@ -path: /selinux-policy/pam_console-and-related -tier: 2 +summary: Does SELinux cooperate with pam_console_apply and pam_console.so? +description: |+ + Does SELinux cooperate with pam_console_apply and pam_console.so? + Confined and unconfined users are tested using SSH. + + This TC uses following parameters which can be overriden: + * ALLOWED_USERS - which SELinux users should be tested? + * DENIED_USERS - which SELinux users should NOT be tested? + +contact: aborah@redhat.com +component: + - pam + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - pam + - psmisc + - binutils + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - failinfedora + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=204986 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=251104 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1817690 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 or distro > fedora-38 + continue: false +extra-nitrate: TC#0606229 +extra-summary: /CoreOS/selinux-policy/Regression/pam_console-and-related +extra-task: /CoreOS/selinux-policy/Regression/pam_console-and-related +id: 622adb1b-d20a-4418-8646-3aaecd35a1e2 diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh index 297d590..068581b 100755 --- a/selinux-policy/pam_console-and-related/runtest.sh +++ b/selinux-policy/pam_console-and-related/runtest.sh @@ -27,11 +27,9 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" SERVICE_PACKAGE="pam" if rlIsRHEL 7 ; then DENIED_USERS=${DENIED_USERS:-"staff_u"} @@ -43,13 +41,14 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -99,15 +98,18 @@ rlJournalStart rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd + if [ -f /usr/sbin/pam_console_apply ] ; then rlPhaseStartTest "real scenario -- runcon under root" rlRun "runcon system_u:system_r:initrc_t:s0 /bin/bash -c '/usr/sbin/pam_console_apply -r'" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 rlSECheckAVC rlFileRestore + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/pam_limits-and-related/Makefile b/selinux-policy/pam_limits-and-related/Makefile new file mode 100644 index 0000000..2fb85ca --- /dev/null +++ b/selinux-policy/pam_limits-and-related/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/pam_limits-and-related +# Description: Does SELinux cooperate with pam_limits.so? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/pam_limits-and-related +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does SELinux cooperate with pam_limits.so?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: pam" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients pam shadow-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1958819" >> $(METADATA) # Fedora 34 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/pam_limits-and-related/PURPOSE b/selinux-policy/pam_limits-and-related/PURPOSE new file mode 100644 index 0000000..9b9e9c4 --- /dev/null +++ b/selinux-policy/pam_limits-and-related/PURPOSE @@ -0,0 +1,10 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/pam_limits-and-related +Author: Milos Malik + +Does SELinux cooperate with pam_limits.so? +Confined and unconfined users are tested using SSH. + +This TC uses following parameters which can be overriden: + * ALLOWED_USERS - which SELinux users should be tested? + * DENIED_USERS - which SELinux users should NOT be tested? + diff --git a/selinux-policy/pam_limits-and-related/main.fmf b/selinux-policy/pam_limits-and-related/main.fmf new file mode 100644 index 0000000..cce5bcb --- /dev/null +++ b/selinux-policy/pam_limits-and-related/main.fmf @@ -0,0 +1,52 @@ +summary: Does SELinux cooperate with pam_limits.so? +description: |+ + Does SELinux cooperate with pam_limits.so? + Confined and unconfined users are tested using SSH. + + This TC uses following parameters which can be overriden: + * ALLOWED_USERS - which SELinux users should be tested? + * DENIED_USERS - which SELinux users should NOT be tested? + +contact: Milos Malik +component: + - pam + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - pam + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - failinfedora + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1958819 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2039453 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0612789 +extra-summary: /CoreOS/selinux-policy/Regression/pam_limits-and-related +extra-task: /CoreOS/selinux-policy/Regression/pam_limits-and-related +id: 4702e6e7-8340-475d-9b97-af2779bf2a8a diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh new file mode 100755 index 0000000..e788de1 --- /dev/null +++ b/selinux-policy/pam_limits-and-related/runtest.sh @@ -0,0 +1,91 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/pam_limits-and-related +# Description: Does SELinux cooperate with pam_limits.so? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="pam" +DENIED_USERS=${DENIED_USERS:-""} +ALLOWED_USERS=${ALLOWED_USERS:-"guest_u xguest_u user_u staff_u sysadm_u unconfined_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlFileBackup /etc/shadow + rlFileBackup /etc/security/limits.conf + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + rlPhaseStartTest "bz#1958819" + rlSESearchRule "allow init_t guest_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t staff_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t sysadm_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t unconfined_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t user_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t xguest_t : process2 { nnp_transition } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- confined users" + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "echo \"${USER_NAME} - nonewprivs 1\" >> /etc/security/limits.conf" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost id" + rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 + done + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC --ignore 'type=AVC.*connectto.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*:xguest_t:.*:systemd_machined_t:' + + rlFileRestore + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/pam_limits-and-related/ssh.exp b/selinux-policy/pam_limits-and-related/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/pam_limits-and-related/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/pam_timestamp-and-related/main.fmf b/selinux-policy/pam_timestamp-and-related/main.fmf index a83b2cb..5e7a835 100644 --- a/selinux-policy/pam_timestamp-and-related/main.fmf +++ b/selinux-policy/pam_timestamp-and-related/main.fmf @@ -1,2 +1,62 @@ -path: /selinux-policy/pam_timestamp-and-related -tier: 2 +summary: Does SELinux cooperate with pam_timestamp_check and pam_timestamp.so? +description: |+ + Does SELinux cooperate with pam_timestamp_check and pam_timestamp.so? + Confined and unconfined users are tested using SSH. + + This TC uses following parameters which can be overriden: + * ALLOWED_USERS - which SELinux users should be tested? + * DENIED_USERS - which SELinux users should NOT be tested? + * TIMESTAMP_DIR - in which directory is the _pam_timestamp_key file stored? + +contact: aborah@redhat.com +component: + - pam + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - pam + - psmisc + - binutils + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass + - TIPpass_Security + - f32friendly + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1791957 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - environment: + TIMESTAMP_DIR: /run/sudo + when: distro == rhel-7 + continue: false + - enabled: false + when: distro ~<= rhel-8.2 + continue: false +extra-nitrate: TC#0606210 +extra-summary: /CoreOS/selinux-policy/Regression/pam_timestamp-and-related +extra-task: /CoreOS/selinux-policy/Regression/pam_timestamp-and-related +id: 8d9cd03c-0cce-4527-89ec-dab84f651e26 diff --git a/selinux-policy/pam_timestamp-and-related/runtest.sh b/selinux-policy/pam_timestamp-and-related/runtest.sh index d808a62..1d1c61b 100755 --- a/selinux-policy/pam_timestamp-and-related/runtest.sh +++ b/selinux-policy/pam_timestamp-and-related/runtest.sh @@ -27,11 +27,9 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" SERVICE_PACKAGE="pam" DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} @@ -39,7 +37,7 @@ TIMESTAMP_DIR=${TIMESTAMP_DIR:-"/run/pam_timestamp"} rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -47,6 +45,7 @@ rlJournalStart rlFileBackup /etc/shadow rlFileBackup ${TIMESTAMP_DIR}/_pam_timestamp_key + rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -99,7 +98,9 @@ rlJournalStart sleep 2 rlSECheckAVC rlRun "rm -f ${TIMESTAMP_DIR}/_pam_timestamp_key" + rlFileRestore + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/pcm-sensor-server-and-similar/Makefile b/selinux-policy/pcm-sensor-server-and-similar/Makefile new file mode 100644 index 0000000..b37360f --- /dev/null +++ b/selinux-policy/pcm-sensor-server-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +# Description: SELinux interferes with pcm-sensor-server and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with pcm-sensor-server and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: pcm" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console pcm /usr/sbin/service virt-what" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Bug: RHEL-52838" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-80452" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/pcm-sensor-server-and-similar/PURPOSE b/selinux-policy/pcm-sensor-server-and-similar/PURPOSE new file mode 100644 index 0000000..521f682 --- /dev/null +++ b/selinux-policy/pcm-sensor-server-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +Author: Milos Malik + +SELinux interferes with pcm-sensor-server and related programs. + diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf new file mode 100644 index 0000000..1e1f63a --- /dev/null +++ b/selinux-policy/pcm-sensor-server-and-similar/main.fmf @@ -0,0 +1,51 @@ +summary: SELinux interferes with pcm-sensor-server and related programs +description: |+ + SELinux interferes with pcm-sensor-server and related programs. + +contact: Milos Malik +component: + - pcm + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - pcm + - /usr/sbin/service + - virt-what +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - targeted + - failinfedora + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-52838 + - verifies: https://issues.redhat.com/browse/RHEL-80452 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + because: the pcm-sensor-server service is not available there + - enabled: false + when: arch == aarch64, ppc64le, s390x + because: the pcm package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +extra-task: /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +extra-nitrate: TC#0617904 +id: a9229ccd-ac0e-4a00-9cc2-733ddb5de881 diff --git a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh new file mode 100755 index 0000000..e54cd3b --- /dev/null +++ b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh @@ -0,0 +1,101 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +# Description: SELinux interferes pcm-sensor-server and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/pcm-sensor-server" +SERVICE_NAME="pcm-sensor-server" +PROCESS_NAME="pcm-sensor-server" +if seinfo -t | grep -q pcm ; then + FILE_CONTEXT="pcmsensor_exec_t" + PROCESS_CONTEXT="pcmsensor_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + if rlIsRHEL 7 8 9 || rlIsCentOS 7 8 9 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined "pcmsensor_t" ; then + rlPhaseStartTest "RHEL-80452" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSESearchRule "allow pcmsensor_t pcmsensor_t : capability2 { perfmon } [ ]" + rlSESearchRule "allow pcmsensor_t pcmsensor_t : perf_event { cpu kernel open read } [ ]" + rlSESearchRule "allow pcmsensor_t pcmsensor_t : tcp_socket { accept bind create listen } [ ]" + rlSESearchRule "allow pcmsensor_t node_t : tcp_socket { node_bind } [ ]" + rlPhaseEnd + fi + + rm -f output.txt + virt-what >& output.txt + if [ -s output.txt ] ; then + echo "Running on a virtual machine -- ${SERVICE_NAME} does not like that" + else + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "pcm-iio 1.0 -i=1" + rlRun "pcm-memory 1.0 -i=1" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "pcm-latency -i=1" + rlRun "pcm-lspci" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/pcp-daemons-and-similar/Makefile b/selinux-policy/pcp-daemons-and-similar/Makefile index 7367625..a7216d7 100644 --- a/selinux-policy/pcp-daemons-and-similar/Makefile +++ b/selinux-policy/pcp-daemons-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 90m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: pcp" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console glib2 pcp pcp-manager pcp-pmda-dm pcp-webapi" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console glib2 pcp pcp-manager pcp-pmda-dm pcp-webapi" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/pcp-daemons-and-similar/main.fmf b/selinux-policy/pcp-daemons-and-similar/main.fmf index d9d0f61..7e65b9b 100644 --- a/selinux-policy/pcp-daemons-and-similar/main.fmf +++ b/selinux-policy/pcp-daemons-and-similar/main.fmf @@ -1,5 +1,72 @@ -path: /selinux-policy/pcp-daemons-and-similar -summary: SELinux issues related to pcp deamons and related programs -description: | - Test coverage for SELinux AVC issues against pcp and related programs. +summary: the services were running as initrc_t, now they are confined by SELinux +description: |+ + SELinux interferes with various PCP services and related programs. +contact: jkurik@redhat.com +component: + - selinux-policy + - pcp +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/service + - setools-console + - glib2 + - pcp + - pcp-manager + - pcp-pmda-dm + - pcp-webapi +environment: + AVC_ERROR: +no_avc_check +duration: 90m +enabled: true +tag: + - NoRHEL4 + - TIPpass + - TIPpass_Security + - TipWaived7 + - f32friendly + - failinfedora + - targeted + - NoRHIVOS + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1028598 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1061159 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064233 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1072785 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1089912 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1130606 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1130934 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1167825 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1196926 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1203153 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1206525 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1211520 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1213709 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1213740 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1252341 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1261811 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271998 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1286234 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309883 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1379371 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1770123 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1886369 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309454 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0075517 +extra-summary: /CoreOS/selinux-policy/Regression/pcp-daemons-and-similar +extra-task: /CoreOS/selinux-policy/Regression/pcp-daemons-and-similar +id: e59269a3-9556-4441-b60b-2339499689b7 diff --git a/selinux-policy/pcp-daemons-and-similar/runtest.sh b/selinux-policy/pcp-daemons-and-similar/runtest.sh index 0b8321c..69dd098 100755 --- a/selinux-policy/pcp-daemons-and-similar/runtest.sh +++ b/selinux-policy/pcp-daemons-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -71,7 +70,7 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -107,7 +106,7 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" done rlSEMatchPathCon "/var/run/pcp" "pcp_var_run_t" - rlSEMatchPathCon "/var/run/pmcd.socket" "pcp_var_run_t" + rlSEMatchPathCon "/var/run/pcp/pmcd.socket" "pcp_var_run_t" rlSEMatchPathCon "/dev/log" "devlog_t" rlSEMatchPathCon "/dev/mapper/control" "lvm_control_t" rlSEMatchPortCon tcp 4330 dey_sapi_port_t @@ -217,7 +216,7 @@ rlJournalStart rlPhaseStartTest "bz#1286234" rlSEMatchPathCon "/usr/bin/pmlogger" "pcp_pmlogger_exec_t" rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/pmlogger.primary.socket" "pcp_var_run_t" + rlSEMatchPathCon "/var/run/pcp/pmlogger.primary.socket" "pcp_var_run_t" rlSESearchRule "allow pcp_pmlogger_t var_run_t : dir { write add_name } [ ]" rlSESearchRule "type_transition pcp_pmlogger_t var_run_t : lnk_file pcp_var_run_t [ ]" rlSESearchRule "allow pcp_pmlogger_t pcp_var_run_t : lnk_file { create } [ ]" @@ -394,12 +393,20 @@ rlJournalStart rlRun "semodule -l | grep pcp" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" for SERVICE_NAME in pmcd pmie pmlogger pmproxy ; do - rlRun "chkconfig ${SERVICE_NAME} on" + if rlIsFedora '>=33' || rlIsRHEL ">=8.1" ; then + rlRun "systemctl enable ${SERVICE_NAME}" + else + rlRun "chkconfig ${SERVICE_NAME} on" + fi done for TRIPLET in ${TRIPLETSLIST} ; do - if ! rlSEDefined "${SEDEFINED}" ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="initrc_t" + if rlIsFedora '<33' || rlIsRHEL "<8" ; then + if ! rlSEDefined "${SEDEFINED}" ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` + fi else PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` fi @@ -411,11 +418,15 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status" 1 done for TRIPLET in ${TRIPLETSLIST} ; do - if ! rlSEDefined "${SEDEFINED}" ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="initrc_t" + if rlIsFedora '<33' || rlIsRHEL "<8" ; then + if ! rlSEDefined "${SEDEFINED}" ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` + fi else - PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` + PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` fi PROCESS_NAME=`echo ${TRIPLET} | cut -d : -f 4` SERVICE_NAME=${PROCESS_NAME} @@ -425,7 +436,11 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop" 1 done for SERVICE_NAME in pmcd pmie pmlogger pmproxy ; do - rlRun "chkconfig ${SERVICE_NAME} off" + if rlIsFedora '>=33' || rlIsRHEL ">=8.1" ; then + rlRun "systemctl disable ${SERVICE_NAME}" + else + rlRun "chkconfig ${SERVICE_NAME} off" + fi done rlPhaseEnd diff --git a/selinux-policy/perf_event-and-related/Makefile b/selinux-policy/perf_event-and-related/Makefile index 4aaea9a..5b736d9 100644 --- a/selinux-policy/perf_event-and-related/Makefile +++ b/selinux-policy/perf_event-and-related/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf expect openssh-clients initscripts" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf expect openssh-clients /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1901957" >> $(METADATA) # Fedora 34 @echo "Bug: 1901958" >> $(METADATA) # RHEL-8 + @echo "Bug: 2229936" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf index bc46d09..dbeb291 100644 --- a/selinux-policy/perf_event-and-related/main.fmf +++ b/selinux-policy/perf_event-and-related/main.fmf @@ -1,3 +1,49 @@ -path: /selinux-policy/perf_event-and-related -tier: 2 +summary: Is the perf_event class and its permissions defined? +description: |+ + Description: Is the perf_event class and its permissions defined? Does SELinux allow various perf_event aware programs to work? +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - perf + - expect + - openssh-clients + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - failinfedora + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901957 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901958 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2019929 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070982 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2229936 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0609306 +extra-summary: /CoreOS/selinux-policy/Regression/perf_event-and-related +extra-task: /CoreOS/selinux-policy/Regression/perf_event-and-related +id: 3efbd0b9-bc20-4b7a-a253-3bec809d323a diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh index a971635..5b50dec 100755 --- a/selinux-policy/perf_event-and-related/runtest.sh +++ b/selinux-policy/perf_event-and-related/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -36,7 +35,7 @@ rlJournalStart rlLog "If this test fails, please contact mmalik on IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm perf @@ -65,6 +64,12 @@ rlJournalStart rlSESearchRule "allow sysadm_t sysadm_t : perf_event { open cpu kernel read write } [ ]" rlPhaseEnd + if ! rlIsRHEL "<9.3" && ! rlIsCentOS 8 ; then + rlPhaseStartTest "bz#2229936" + rlSESearchRule "allow sysadm_t kernel_t : bpf { prog_run } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- perf tool under root" rlRun "perf record -o /dev/null echo test" rlRun "seinfo -c perf_event -x" @@ -72,11 +77,8 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined root sysadm_u" - rlRun "grep -i permit /etc/ssh/sshd_config" - rlFileBackup /etc/ssh/sshd_config - rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" - rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - rlRun "service sshd restart" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" USER_NAME="toor" USER_SECRET="S3kr3t${RANDOM}" diff --git a/selinux-policy/ping-and-similar/main.fmf b/selinux-policy/ping-and-similar/main.fmf index 8d535ce..7f8098f 100644 --- a/selinux-policy/ping-and-similar/main.fmf +++ b/selinux-policy/ping-and-similar/main.fmf @@ -1,2 +1,50 @@ -path: /selinux-policy/ping-and-similar -tier: 2 +summary: the service was running as initrc_t or init_t, now it is confined by SELinux +description: |+ + SELinux interferes with ping and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - iputils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass + - TIPpass_Security + - TierCandidatesPASS + - targeted + - NoRHIVOS +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1552128 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1596065 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1803759 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1810403 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1848929 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070870 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0564077 +extra-summary: /CoreOS/selinux-policy/Regression/ping-and-similar +extra-task: /CoreOS/selinux-policy/Regression/ping-and-similar +id: 993738bc-3b9a-4f3d-9617-fb07484db1cb diff --git a/selinux-policy/ping-and-similar/runtest.sh b/selinux-policy/ping-and-similar/runtest.sh index 83a004f..3037afd 100755 --- a/selinux-policy/ping-and-similar/runtest.sh +++ b/selinux-policy/ping-and-similar/runtest.sh @@ -27,11 +27,9 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" FILE_PATH="/bin/ping" FILE_CONTEXT="ping_exec_t" SERVICE_PACKAGE="iputils" @@ -40,13 +38,14 @@ PROCESS_CONTEXT="ping_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -116,6 +115,7 @@ rlJournalStart rlSECheckAVC rlFileRestore + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/policy-rpm-macros/main.fmf b/selinux-policy/policy-rpm-macros/main.fmf index 498e8f4..261c287 100644 --- a/selinux-policy/policy-rpm-macros/main.fmf +++ b/selinux-policy/policy-rpm-macros/main.fmf @@ -1,2 +1,42 @@ -path: /selinux-policy/policy-rpm-macros +summary: Are necessary RPM macros defined for various policy actions? +description: |+ + Are necessary RPM macros defined for various policy actions? Are they defined correctly? + + More information at: + * https://plautrba.fedorapeople.org/blok/Fedora-SELinux-module-packaging.html + * https://github.com/fedora-selinux/selinux-policy-macros/blob/master/README.adoc + +contact: Milos Malik +component: + - selinux-policy +recommend: + - git + - selinux-policy + - /usr/sbin/semanage +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - f32friendly + - targeted + - NoRHIVOS tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1380854 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1415694 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1518609 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1488402 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1633198 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1631814 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1465824 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0546229 +extra-summary: /CoreOS/selinux-policy/Sanity/policy-rpm-macros +extra-task: /CoreOS/selinux-policy/Sanity/policy-rpm-macros +id: c88dfda5-0d87-4538-94d3-45691e3bda33 diff --git a/selinux-policy/policy-rpm-macros/runtest.sh b/selinux-policy/policy-rpm-macros/runtest.sh index b203b16..2460ddb 100755 --- a/selinux-policy/policy-rpm-macros/runtest.sh +++ b/selinux-policy/policy-rpm-macros/runtest.sh @@ -27,11 +27,11 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" MACRO_FILE="/usr/lib/rpm/macros.d/macros.selinux-policy" +export MACRO_FILE rlJournalStart rlPhaseStartSetup @@ -48,20 +48,12 @@ rlJournalStart rlPhaseStartTest "bz#1415694" rlRun "grep selinuxenabled ${MACRO_FILE}" - rlRun "grep selinuxenabled ${MACRO_FILE} | grep _sbindir" rlRun "grep selinuxenabled ${MACRO_FILE} | grep /usr/sbin/" 1 rlPhaseEnd - rlPhaseStartTest "download and prepare the upstream test" - rlRun "git clone https://github.com/fedora-selinux/selinux-policy-macros.git" - rlRun "rm -f selinux-policy-macros/macros.selinux-policy" - rlRun "cp /usr/lib/rpm/macros.d/macros.selinux-policy selinux-policy-macros/" - rlPhaseEnd - - pushd selinux-policy-macros - # running an upstream test written by Petr Lautrbach, thanks - ./runtest.sh - popd + # originally test from https://github.com/fedora-selinux/selinux-policy-macros + # now shipped with this test + ./selinux-policy-macros.runtest.sh rlPhaseStartCleanup rlRun "rm -rf selinux-policy-macros" diff --git a/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh b/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh new file mode 100755 index 0000000..7ae2d68 --- /dev/null +++ b/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh @@ -0,0 +1,262 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of ipp +# Description: Tests for IPP scriptlets +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (C) 2017 Red Hat, Inc. All rights reserved. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include the BeakerLib environment +. /usr/share/beakerlib/beakerlib.sh + +# Set SELinux store +if rlIsRHEL "<=7" || rlIsCentOS "<=7"; then + SELINUXSTOREPATH=/etc/selinux +else + SELINUXSTOREPATH=/var/lib/selinux +fi + +# Set the full test name +TEST="IPP" + +# Package being tested +PACKAGE="IPP" + +MACRO_FILE=${MACRO_FILE:-/usr/lib/rpm/macros.d/macros.selinux-policy} + +set_booleans() { + rlRun "rpm --eval '%selinux_set_booleans -s targeted $*' > run_selinux_set_booleans.sh" 0 + rlRun "bash run_selinux_set_booleans.sh" +} + +unset_booleans() { + rlRun "rpm --eval '%selinux_unset_booleans -s targeted $*' > run_selinux_unset_booleans.sh" 0 + rlRun "bash run_selinux_unset_booleans.sh" +} + + +rlJournalStart + rlPhaseStartSetup "Setup" + rlRun "rlFileBackup --clean ~/.rpmmacros" 0,1 "Backing up ~/.rpmmacros" + rlRun "sed 's|SELINUXSTOREPATH|$SELINUXSTOREPATH|' ${MACRO_FILE} >> ~/.rpmmacros" 0 "Updating ~/.rpmmacros" + rlRun "rlFileBackup --clean ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0,1 "Backing up ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0,1 "Updating ~/.rpmmacros" + rlRun 'TmpDir=$(mktemp -d)' 0 + pushd $TmpDir + rlRun "semanage boolean -E > boolean.import" 0 "Backup local boolean modifications" + rlRun "semanage boolean -D" 0 "Drop local boolean modifications" + rlPhaseEnd + + rlPhaseStartTest "Test install on a clean system" + set_booleans secure_mode=1 secure_mode_insmod=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertNotGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall on a clean system" + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + rlPhaseEnd + + rlPhaseStartTest "Test install on a system with secure_mode is already on" + rlRun "semanage boolean -m --on secure_mode" 0 "Setting secure_mode=on" + + set_booleans secure_mode=1 secure_mode_insmod=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall on a system where secure_mode was on before install" + + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + + rlPhaseEnd + + rlPhaseStartTest "Test install on a system with secure_mode was changed to off" + rlRun "semanage boolean -m --off secure_mode" 0 "Setting secure_mode=on" + + set_booleans secure_mode=1 secure_mode_insmod=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall on a system where secure_mode was on before install" + + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local" + rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + + rlPhaseEnd + +# ============ Install twice, remove once ====================== + + rlPhaseStartTest "Test install twice on a clean system" + set_booleans secure_mode=1 secure_mode_insmod=1 + set_booleans secure_mode=1 ssh_sysadm_login=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) ssh_sysadm_login' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep '\(-1\|--on\) ssh_sysadm_login' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall once after install twice" + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) ssh_sysadm_login' "boolean.local" + rlAssertGrep 'secure_mode$' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertGrep 'ssh_sysadm_login' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -m --off ssh_sysadm_login" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0 "cleanup" + rlPhaseEnd + + rlPhaseStartTest "Test install twice on a system with secure_mode is already on" + rlRun "semanage boolean -m --on secure_mode" 0 "Setting secure_mode=on" + + set_booleans secure_mode=1 secure_mode_insmod=1 + set_booleans secure_mode=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall once after install twice on a system where secure_mode was on before install" + + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local" + rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0 "cleanup" + + rlPhaseEnd + + rlPhaseStartTest "Test install twice on a system with secure_mode was changed to off" + rlRun "semanage boolean -m --off secure_mode" 0 "Setting secure_mode=on" + + set_booleans secure_mode=1 secure_mode_insmod=1 + set_booleans secure_mode=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall once after install twice on a system where secure_mode was off before install" + + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local" + rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + rlPhaseEnd + + rlPhaseStartCleanup "Cleanup" + rlRun "semanage boolean -D" 0 "Clean all boolean changes" + rlRun "semanage import < boolean.import" 0 "Import local boolean modifications back" + popd + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlRun "rlFileRestore" + rlPhaseEnd + +rlJournalEnd + +# Print the test report +rlJournalPrintText diff --git a/selinux-policy/policykit-general/Makefile b/selinux-policy/policykit-general/Makefile new file mode 100644 index 0000000..0309190 --- /dev/null +++ b/selinux-policy/policykit-general/Makefile @@ -0,0 +1,77 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/policykit-general +# Description: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd) +# Author: Michal Trunecka +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2013 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/policykit-general +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Michal Trunecka " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd)" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: polkit" >> $(METADATA) + @echo "Requires: audit selinux-policy polkit glib2 libselinux libselinux-utils policycoreutils setools-console psmisc shadow-utils expect openssh-clients" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 960669" >> $(METADATA) # RHEL-7 + @echo "Bug: 962791" >> $(METADATA) # RHEL-7 + @echo "Bug: 965143" >> $(METADATA) # RHEL-7 + @echo "Bug: 1003799" >> $(METADATA) # RHEL-6 + @echo "Bug: 1301561" >> $(METADATA) # RHEL-6 + @echo "Bug: 1364513" >> $(METADATA) # RHEL-7 + @echo "Bug: 1574389" >> $(METADATA) # RHEL-7 + @echo "Bug: 1583082" >> $(METADATA) # RHEL-7 + @echo "Bug: 1727902" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/policykit-general/PURPOSE b/selinux-policy/policykit-general/PURPOSE new file mode 100644 index 0000000..98cfd05 --- /dev/null +++ b/selinux-policy/policykit-general/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/policykit-general +Author: Michal Trunecka + +SELinux interferes with polkitd and related programs. + diff --git a/selinux-policy/policykit-general/main.fmf b/selinux-policy/policykit-general/main.fmf new file mode 100644 index 0000000..897de7c --- /dev/null +++ b/selinux-policy/policykit-general/main.fmf @@ -0,0 +1,61 @@ +summary: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd) +description: |+ + SELinux interferes with polkitd and related programs. + +contact: Milos Malik +component: + - polkit + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - selinux-policy + - polkit + - glib2 + - libselinux + - libselinux-utils + - policycoreutils + - setools-console + - psmisc + - shadow-utils + - expect + - openssh-clients +environment: + AVC_ERROR: +no_avc_check +duration: 20m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - TipWaived7 + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=960669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=962791 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=965143 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1003799 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1301561 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1364513 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574389 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1583082 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1727902 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0267065 +extra-summary: /CoreOS/selinux-policy/Regression/policykit-general +extra-task: /CoreOS/selinux-policy/Regression/policykit-general +id: f021b6cd-fc34-4335-b7e0-ed0254ed333e diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh new file mode 100755 index 0000000..79fa26e --- /dev/null +++ b/selinux-policy/policykit-general/runtest.sh @@ -0,0 +1,182 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/policykit-general +# Description: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd) +# Author: Michal Trunecka +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2013 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_NAME="polkit" +SERVICE_PACKAGE="polkit" +PROCESS_NAME="polkitd" +PROCESS_CONTEXT="policykit_t" +if rlIsRHEL 6 7 ; then + ALLOWED_USERS="staff_u user_u xguest_u sysadm_u unconfined_u" +else + ALLOWED_USERS="staff_u user_u guest_u xguest_u sysadm_u unconfined_u" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#960669 + bz#962791 + bz#965143" + if rlIsRHEL 6 ; then + rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" + else + rlSEMatchPathCon "/usr/lib/polkit-1/polkitd" "policykit_exec_t" + rlSESearchRule "allow policykit_t cgroup_t : dir { open read getattr lock search ioctl }" + fi + rlSESearchRule "allow initrc_t policykit_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition initrc_t policykit_exec_t : process policykit_t" + rlSESearchRule "allow initrc_t policykit_t : process { transition }" + rlSESearchRule "allow system_dbusd_t policykit_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition system_dbusd_t policykit_exec_t : process policykit_t" + rlSESearchRule "allow system_dbusd_t policykit_t : process { transition }" + rlPhaseEnd + + rlPhaseStartTest "bz#1003799" + if rlIsRHEL 6 ; then + rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" + else + rlSEMatchPathCon "/usr/lib/polkit-1/polkitd" "policykit_exec_t" + fi + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSESearchRule "allow policykit_t sssd_var_lib_t : dir { getattr open search }" + rlSESearchRule "allow policykit_t sssd_public_t : dir { getattr open search }" + rlSESearchRule "allow policykit_t sssd_public_t : file { getattr open read }" + rlSESearchRule "allow policykit_t sssd_var_lib_t : sock_file { getattr open write }" + rlSESearchRule "allow policykit_t sssd_t : unix_stream_socket { connectto }" + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#1301561" + rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" + rlSESearchRule "allow policykit_t fs_t : filesystem { getattr }" + rlPhaseEnd + fi + + DESTINATION="org.freedesktop.PolicyKit1" + if busctl | grep -iq ${DESTINATION} ; then + rlPhaseStartTest "real scenario -- DBus service" + rlRun "killall polkitd" 0,1 + sleep 1 + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1364513" + rlSESearchRule "allow dhcpc_t policykit_t : dbus { send_msg }" + rlSESearchRule "allow policykit_t dhcpc_t : dbus { send_msg }" + rlPhaseEnd + + rlPhaseStartTest "bz#1574389 + bz#1583082" + rlSEMatchPathCon "/usr/bin/pkla-check-authorization" "policykit_auth_exec_t" + rlSESearchRule "allow policykit_t policykit_auth_exec_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1727902" + rlSEMatchPathCon "/run/dbus" "system_dbusd_var_run_t" + rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t" + rlSESearchRule "allow guest_t system_dbusd_var_run_t : dir { search } [ ]" + rlSESearchRule "allow guest_t system_dbusd_var_run_t : sock_file { write } [ ]" + rlSESearchRule "allow guest_t system_dbusd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow guest_t policykit_t : dbus { send_msg } [ ]" + rlSESearchRule "allow policykit_t guest_t : dbus { send_msg } [ ]" + rlSESearchRule "allow guest_t system_dbusd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow system_dbusd_t guest_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- confined users" + CREATED_USERS="" + rlRun "setsebool ssh_sysadm_login on" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -Rv /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost pkaction" + sleep 2 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/policykit-general/ssh.exp b/selinux-policy/policykit-general/ssh.exp new file mode 100755 index 0000000..1244013 --- /dev/null +++ b/selinux-policy/policykit-general/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command ; sleep 5" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/power-profiles-daemon-and-similar/Makefile b/selinux-policy/power-profiles-daemon-and-similar/Makefile new file mode 100644 index 0000000..430f31e --- /dev/null +++ b/selinux-policy/power-profiles-daemon-and-similar/Makefile @@ -0,0 +1,72 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +# Description: SELinux interferes with power-profiles-daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with power-profiles-daemon and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: power-profiles-daemon" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console power-profiles-daemon python3-gobject-base /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-61117" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-62356" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-100718" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-105423" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/power-profiles-daemon-and-similar/PURPOSE b/selinux-policy/power-profiles-daemon-and-similar/PURPOSE new file mode 100644 index 0000000..e6ef280 --- /dev/null +++ b/selinux-policy/power-profiles-daemon-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +Author: Milos Malik + +SELinux interferes with power-profiles-daemon and related programs. + diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf new file mode 100644 index 0000000..e028f53 --- /dev/null +++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf @@ -0,0 +1,47 @@ +summary: SELinux interferes with power-profiles-daemon and related programs +description: |+ + SELinux interferes with power-profiles-daemon and related programs. + +contact: Milos Malik +component: + - selinux-policy + - power-profiles-daemon +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - python3-gobject-base + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-61117 + - verifies: https://issues.redhat.com/browse/RHEL-62356 + - verifies: https://issues.redhat.com/browse/RHEL-100718 + - verifies: https://issues.redhat.com/browse/RHEL-105423 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-10, centos-stream-10 + because: the power-profiles-daemon package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +extra-task: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +extra-nitrate: TC#0617900 +id: 8cbc1f54-edde-4301-a19e-3a4cfe29920d diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh new file mode 100755 index 0000000..692df51 --- /dev/null +++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh @@ -0,0 +1,132 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +# Description: SELinux interferes with power-profiles-daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/power-profiles-daemon" +SERVICE_PACKAGE="power-profiles-daemon" +SERVICE_NAME="power-profiles-daemon" +PROCESS_NAME="power-profiles-daemon" +if seinfo -t | grep -q powerprofile ; then + PROCESS_CONTEXT="powerprofiles_t" + FILE_CONTEXT="powerprofiles_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + if rpm -q tuned-ppd ; then + rlRun "yum -y remove tuned-ppd" + fi + rlRun "yum -y install ${SERVICE_PACKAGE}" + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ( rlIsRHEL 9 && rlIsRHEL ">9.5" ) || rlIsCentOS 9 ; then + rlPhaseStartTest "RHEL-61117" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSESearchRule "allow powerprofiles_t powerprofiles_t : capability2 { bpf } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL '<9.7'; then + rlPhaseStartTest "RHEL-100718" + if [ -d /sys/devices/system/cpu/cpufreq ] ; then + for CUR_FILE in `find /sys/devices/system/cpu/cpufreq -type f -name energy_performance_preference` ; do + CUR_TYPE=`secon --type --file ${CUR_FILE}` + rlSESearchRule "allow powerprofiles_t $CUR_TYPE : file { write } [ ]" + done + fi + rlSESearchRule "allow powerprofiles_t fs_t : filesystem { getattr } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "RHEL-105423" + if [ -d /sys/firmware/acpi ] ; then + rlRun "ls -dZ /sys/firmware/acpi | grep :sysfs_t" + rlRun "ls -lZ /sys/firmware/acpi" + fi + rlSESearchRule "allow powerprofiles_t sysfs_t : dir { watch } [ ]" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "powerprofilesctl list" + rlRun "powerprofilesctl list-holds" + rlRun "powerprofilesctl version" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + if ! rlIsRHEL '<9.7' ; then + ORIG_PROFILE=`powerprofilesctl get` + if echo ${ORIG_PROFILE} | grep -q balanced ; then + rlRun "powerprofilesctl set power-saver" 0,1 + else + rlRun "powerprofilesctl set balanced" 0,1 + fi + sleep 2 + rlRun "powerprofilesctl get" + rlRun "powerprofilesctl set ${ORIG_PROFILE}" + sleep 2 + else + rlRun "powerprofilesctl get" + fi + rlRun "powerprofilesctl launch echo" 0,1 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/qat-service-and-similar/main.fmf b/selinux-policy/qat-service-and-similar/main.fmf new file mode 100644 index 0000000..0accdbb --- /dev/null +++ b/selinux-policy/qat-service-and-similar/main.fmf @@ -0,0 +1,49 @@ +summary: SELinux interferes with qatlib and related programs +description: |+ + SELinux interferes with qatlib and related programs. + +contact: Milos Malik +component: + - qatlib + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - qatlib + - qatlib-service + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-211077 + - verifies: https://issues.redhat.com/browse/RHEL-211089 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the qatlib package is not available there + - enabled: false + when: arch == aarch64, ppc64le, s390x + because: the qatlib package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/qat-service-and-similar +extra-task: /CoreOS/selinux-policy/Regression/qat-service-and-similar + diff --git a/selinux-policy/qat-service-and-similar/runtest.sh b/selinux-policy/qat-service-and-similar/runtest.sh new file mode 100755 index 0000000..f52788b --- /dev/null +++ b/selinux-policy/qat-service-and-similar/runtest.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/qat-service-and-similar +# Description: SELinux interferes qatlib and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, see +# . +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/qat_init.sh" +SERVICE_NAME="qat" +PROCESS_NAME="qat_init.sh" +if seinfo -t | grep -q qatlib ; then + FILE_CONTEXT="qatlib_exec_t" + PROCESS_CONTEXT="qatlib_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "RHEL-211077" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSEMatchPathCon "/dev/hugepages" "hugetlbfs_t" + rlSESearchRule "allow qatlib_t hugetlbfs_t : dir { getattr } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-211089" + rlSEMatchPathCon "/dev/hugepages/qat" "hugetlbfs_t" + rlSESearchRule "allow qatlib_t hugetlbfs_t : dir { search create add_name write setattr } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status" 1 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/restorecond-fcontext-equivalences/main.fmf b/selinux-policy/restorecond-fcontext-equivalences/main.fmf new file mode 100644 index 0000000..a568133 --- /dev/null +++ b/selinux-policy/restorecond-fcontext-equivalences/main.fmf @@ -0,0 +1,32 @@ +summary: the restorecond service honors fcontext equivalences +description: | + The restorecond service mislabels files when fcontext equivalences + (shipped by the selinux-policy component) are not configured properly. +test: ./test.sh +framework: beakerlib +contact: Milos Malik +component: + - selinux-policy +recommend: + - selinux-policy + - policycoreutils + - policycoreutils-restorecond + - /usr/sbin/service +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS + - avoidImageMode +link: + - verifies: https://issues.redhat.com/browse/RHEL-5032 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0615936 +id: 14b57b44-c644-48fb-a3a1-b4c57da675a6 diff --git a/selinux-policy/restorecond-fcontext-equivalences/test.sh b/selinux-policy/restorecond-fcontext-equivalences/test.sh new file mode 100755 index 0000000..c49bdd4 --- /dev/null +++ b/selinux-policy/restorecond-fcontext-equivalences/test.sh @@ -0,0 +1,31 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm selinux-policy + rlAssertRpm policycoreutils-restorecond + rlServiceStop restorecond + rlFileBackup /etc/selinux/restorecond.conf + # add locations which are in fact symlinks + rlRun "echo -en '\n/bin/*\n/sbin/*\n/lib/*\n/lib64/*\n' >> /etc/selinux/restorecond.conf" + rlPhaseEnd + + if ! rlIsRHEL "<9.4" ; then + rlPhaseStartTest "RHEL-5032" + rlRun "service restorecond start" + rlRun "service restorecond status" + rlRun -s "restorecon -Rv /usr/bin /usr/sbin /usr/lib /usr/lib64" + rlRun "grep -i 'relabeled.*from.*to' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun "service restorecond stop" + rlPhaseEnd + fi + + rlPhaseStartCleanup + rlFileRestore + rlServiceRestore restorecond + rlPhaseEnd +rlJournalEnd + diff --git a/selinux-policy/rhsmcertd-and-similar/main.fmf b/selinux-policy/rhsmcertd-and-similar/main.fmf new file mode 100644 index 0000000..283c71f --- /dev/null +++ b/selinux-policy/rhsmcertd-and-similar/main.fmf @@ -0,0 +1,28 @@ +summary: Test that rhsmcertd have access to gconf_home_t site-packages +description: |+ + rhsmcertd is denied read access to /root/.local/lib/pythonX.Y/site-packages/ + which has gconf_home_t context. This occurs when user runs 'pip install --user' from root. + +contact: Veronika Syncakova +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - selinux-policy + - python3 + - python3-pip +duration: 15m +enabled: true +tag: + - NoRHEL7 + - NoRHEL8 +environment: + AVC_ERROR: +no_avc_check +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-106483 +adjust+: + - enabled: false + when: distro < rhel-9 + continue: false diff --git a/selinux-policy/rhsmcertd-and-similar/runtest.sh b/selinux-policy/rhsmcertd-and-similar/runtest.sh new file mode 100755 index 0000000..82942d5 --- /dev/null +++ b/selinux-policy/rhsmcertd-and-similar/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0 + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + + rlSESetTimestamp + + # Install required packages + rlRun "dnf install -y python3-pip" 0 + rlFileBackup --clean /root/.local + rlPhaseEnd + + rlPhaseStartTest "RHEL-106483" + # Create /root/.local/lib/pythonX.Y/site-packages/ with gconf_home_t context + rlRun "pip3 install --user abcd" 0 "pip install creates site-packages" + SITE_PACKAGES=$(find /root/.local/lib -type d -name "site-packages" 2>/dev/null | head -1) + rlAssertExists "${SITE_PACKAGES}" + + # Set SELinux to permissive to log AVCs without blocking + rlRun "setenforce 0" 0 "Set SELinux to permissive mode" + rlRun "runcon -t rhsmcertd_t -r system_r -u system_u -- /usr/bin/python3 -c 'import sys'" 0 + rlPhaseEnd + + rlPhaseStartCleanup + # Restore backed up files (removes /root/.local if it didn't exist before) + rlFileRestore + rlSECheckAVC --ignore 'type=AVC .* entrypoint .*runcon .*:rhsmcertd_t:' + # Restore SELinux to enforcing mode + rlRun "setenforce 1" 0 "Restore SELinux to enforcing mode" + + rlPhaseEnd + +rlJournalEnd diff --git a/selinux-policy/rngd-and-similar/Makefile b/selinux-policy/rngd-and-similar/Makefile new file mode 100644 index 0000000..e4d0031 --- /dev/null +++ b/selinux-policy/rngd-and-similar/Makefile @@ -0,0 +1,93 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/rngd-and-similar +# Description: SELinux interferes with rngd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/rngd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with rngd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: rng-tools" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console rng-tools /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 869810" >> $(METADATA) # Fedora 18 + @echo "Bug: 869813" >> $(METADATA) # Fedora 18 + @echo "Bug: 1451735" >> $(METADATA) # RHEL-7 + @echo "Bug: 1452629" >> $(METADATA) # RHEL-7 + @echo "Bug: 1496260" >> $(METADATA) # RHEL-7 + @echo "Bug: 1609466" >> $(METADATA) # RHEL-7 + @echo "Bug: 1611413" >> $(METADATA) # RHEL-7 + @echo "Bug: 1612456" >> $(METADATA) # RHEL-7 + @echo "Bug: 1653872" >> $(METADATA) # RHEL-8 + @echo "Bug: 1655079" >> $(METADATA) # RHEL-8 + @echo "Bug: 1656054" >> $(METADATA) # RHEL-8 + @echo "Bug: 1657250" >> $(METADATA) # RHEL-8 + @echo "Bug: 1658234" >> $(METADATA) # RHEL-8 + @echo "Bug: 1698575" >> $(METADATA) # RHEL-8 + @echo "Bug: 1699278" >> $(METADATA) # RHEL-8 + @echo "Bug: 1700222" >> $(METADATA) # RHEL-8 + @echo "Bug: 1787663" >> $(METADATA) # Fedora 32 + @echo "Bug: 1789902" >> $(METADATA) # Fedora 32 + @echo "Bug: 1787661" >> $(METADATA) # Fedora 32 + @echo "Bug: 1928572" >> $(METADATA) # Fedora 33 + @echo "Bug: 1929360" >> $(METADATA) # Fedora 33 + @echo "Bug: 1929366" >> $(METADATA) # Fedora 33 + @echo "Bug: 2058914" >> $(METADATA) # Fedora 36 + @echo "Bug: 2076641" >> $(METADATA) # RHEL-8 + @echo "Bug: 2076642" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/rngd-and-similar/PURPOSE b/selinux-policy/rngd-and-similar/PURPOSE new file mode 100644 index 0000000..8c46dd0 --- /dev/null +++ b/selinux-policy/rngd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/rngd-and-similar +Author: Milos Malik + +SELinux interferes with rngd and related programs. + diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf new file mode 100644 index 0000000..3afd2ad --- /dev/null +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -0,0 +1,77 @@ +summary: SELinux interferes with rngd and related programs +description: |+ + SELinux interferes with rngd and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - rng-tools + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass + - TIPpass_Security + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=869810 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=869813 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1451735 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1452629 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1496260 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1609466 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1611413 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1612456 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1653872 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1655079 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1656054 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1657250 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1658234 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1698575 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699278 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700222 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1787663 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1789902 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1787661 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928572 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929360 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929366 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1931450 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2058914 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076641 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076642 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - enabled: false + when: arch == aarch64, s390x + continue: false +extra-nitrate: TC#0300433 +extra-summary: /CoreOS/selinux-policy/Regression/rngd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rngd-and-similar +id: 604042eb-81de-4ede-808c-8e6cc38cdd15 diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh new file mode 100755 index 0000000..1987510 --- /dev/null +++ b/selinux-policy/rngd-and-similar/runtest.sh @@ -0,0 +1,198 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/rngd-and-similar +# Description: SELinux interferes with rngd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/sbin/rngd" +FILE_CONTEXT="rngd_exec_t" +SERVICE_PACKAGE="rng-tools" +SERVICE_NAME="rngd" +PROCESS_NAME="rngd" +PROCESS_CONTEXT="rngd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlFileBackup /etc/sysconfig/rngd + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" + rlPhaseEnd + + rlPhaseStartTest "bz#869810 + bz#869813" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlRun "ls -Z /proc | grep :proc_t" + rlRun "ls -Z /proc/sys | grep :sysctl_t" + rlRun "ls -Z /proc/sys/kernel | grep :sysctl_kernel_t" + rlRun "ls -Z /proc/sys/kernel/random | grep :sysctl_kernel_t" + rlRun "ls -Z /proc/sys/kernel/random/poolsize | grep :sysctl_kernel_t" + rlSESearchRule "allow rngd_t proc_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t sysctl_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t sysctl_kernel_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t sysctl_kernel_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1451735 + bz#1452629" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSESearchRule "allow rngd_t sysfs_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t sysfs_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1496260" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSEMatchPathCon "/dev/ttyUSB0" "usbtty_device_t" + rlSESearchRule "allow rngd_t usbtty_device_t : chr_file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1609466 + bz#1611413 + bz#1612456" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSEMatchPathCon "/etc/pki" "cert_t" + rlSEMatchPathCon "/etc/pki/tls" "cert_t" + rlSEMatchPathCon "/etc/pki/tls/legacy-settings" "cert_t" + rlSESearchRule "allow rngd_t cert_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t cert_t : file { getattr open read }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1653872 + bz#1655079 + bz#1657250 + bz#1658234" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSESearchRule "allow rngd_t rngd_t : process { setsched } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1656054" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlRun "ls -Z /proc/cpuinfo | grep :proc_t" + rlSESearchRule "allow rngd_t proc_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1698575 + bz#1699278 + bz#1700222" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlRun "ls -Z /proc/sys/kernel/random/write_wakeup_threshold | grep :sysctl_kernel_t" + rlSESearchRule "allow rngd_t sysctl_kernel_t : file { write } [ ]" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#1787661 + bz#1787663 + bz#1789902" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + rlSESearchRule "allow rngd_t passwd_file_t : file { getattr open read } [ ]" + rlSESearchRule "allow rngd_t sssd_public_t : dir { search } [ ]" + rlSESearchRule "allow rngd_t sssd_public_t : file { getattr open read map } [ ]" + rlSESearchRule "allow rngd_t sssd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow rngd_t sssd_var_lib_t : dir { search } [ ]" + rlSESearchRule "allow rngd_t sssd_var_lib_t : sock_file { getattr open write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1928572 + bz#1929360 + bz#1929366" + rlSEMatchPathCon "/sys" "sysfs_t" + rlSESearchRule "allow rngd_t sysfs_t : filesystem { getattr } [ ]" + rlPhaseEnd + fi + + DROP_PRIV=false + if rngd --help | grep -qi 'drop.*priv' ; then + DROP_PRIV=true + rlPhaseStartTest "bz#2076641 + bz#2076642" + rlSESearchRule "allow rngd_t rngd_t : capability { setgid setuid } [ ]" + rlSESearchRule "allow rngd_t rngd_t : process { setcap } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlRun "modprobe tpm-rng" 0,1 + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "setsebool daemons_use_tty on" + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rngd -l'" 0-255 + rlRun "setsebool daemons_use_tty off" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + if ${DROP_PRIV} ; then + rlLog "modifying the /etc/sysconfig/rngd file" + if ! grep -q '^RNGD_ARGS.*daemon:daemon' /etc/sysconfig/rngd ; then + sed -i 's/^\(RNGD_ARGS=.*\)"$/\1 -D daemon:daemon"/' /etc/sysconfig/rngd + fi + if ! grep -q '^RNGD_ARGS.*jitter' /etc/sysconfig/rngd ; then + sed -i 's/^\(RNGD_ARGS=.*\)"$/\1 -x jitter"/' /etc/sysconfig/rngd + fi + fi + rlRun "grep ^RNGD_ARGS= /etc/sysconfig/rngd" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/rpc.idmapd-and-similar/Makefile b/selinux-policy/rpc.idmapd-and-similar/Makefile new file mode 100644 index 0000000..4ed9dbb --- /dev/null +++ b/selinux-policy/rpc.idmapd-and-similar/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +# Description: SELinux interferes with rpc.idmapd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with rpc.idmapd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service nfs-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/rpc.idmapd-and-similar/PURPOSE b/selinux-policy/rpc.idmapd-and-similar/PURPOSE new file mode 100644 index 0000000..f64abec --- /dev/null +++ b/selinux-policy/rpc.idmapd-and-similar/PURPOSE @@ -0,0 +1,4 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +Description: SELinux interferes with rpc.idmapd and related programs +Author: Milos Malik + diff --git a/selinux-policy/rpc.idmapd-and-similar/main.fmf b/selinux-policy/rpc.idmapd-and-similar/main.fmf new file mode 100644 index 0000000..8a84ff9 --- /dev/null +++ b/selinux-policy/rpc.idmapd-and-similar/main.fmf @@ -0,0 +1,42 @@ +summary: SELinux interferes with rpc.idmapd and related programs +description: |+ + SELinux interferes with rpc.idmapd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - nfs-utils + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - failinfedora + - NoRHIVOS +tier: 3 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +extra-nitrate: TC#0614824 +id: d96b0115-5a88-4aaf-b26b-1572a9c816b6 diff --git a/selinux-policy/rpc.idmapd-and-similar/runtest.sh b/selinux-policy/rpc.idmapd-and-similar/runtest.sh new file mode 100755 index 0000000..10fed7c --- /dev/null +++ b/selinux-policy/rpc.idmapd-and-similar/runtest.sh @@ -0,0 +1,95 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +# Description: SELinux interferes with rpc.idmapd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/rpc.idmapd" +FILE_CONTEXT="rpcd_exec_t" +SERVICE_PACKAGE="nfs-utils" +SERVICE_NAME="nfs-idmapd" +PROCESS_NAME="rpc.idmapd" +PROCESS_CONTEXT="rpcd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/rpm-cant-read-rpmmacros/main.fmf b/selinux-policy/rpm-cant-read-rpmmacros/main.fmf new file mode 100644 index 0000000..db0b6eb --- /dev/null +++ b/selinux-policy/rpm-cant-read-rpmmacros/main.fmf @@ -0,0 +1,42 @@ +summary: setroubleshootd process should not cause an AVC when trying to read /root/.rpmmacros +description: |+ + setroubleshootd process should not cause an AVC when trying to read /root/.rpmmacros + +contact: Veronika Syncakova +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy + - setroubleshoot-server +recommend: + - audit + - libselinux + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +tier: 2 +link: + - verifies: https://issues.redhat.com/browse/RHEL-147470 + - verifies: https://issues.redhat.com/browse/RHEL-142548 +adjust+: + - enabled: false + when: distro < rhel-9.9 + continue: false + because: RHEL-147470 is fixed in RHEL-9.9 and RHEL-142548 in RHEL-10.3 diff --git a/selinux-policy/rpm-cant-read-rpmmacros/runtest.sh b/selinux-policy/rpm-cant-read-rpmmacros/runtest.sh new file mode 100755 index 0000000..2f75068 --- /dev/null +++ b/selinux-policy/rpm-cant-read-rpmmacros/runtest.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of selinux-policy/rpm-cant-read-rpmmacros +# Description: setroubleshootd process should not cause an AVC when trying to read /root/.rpmmacros +# Author: Veronika Syncakova +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="setroubleshoot-server" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm ${PACKAGE} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + rlRun "rlFileBackup --clean /root/.rpmmacros" + rlPhaseEnd + + rlPhaseStartTest "RHEL-142548 + RHEL-147470" + # check that sedispatch is running and therefore setroubleshoot-server is installed + rlRun "ps -efZ | grep sedispatch" + rlSESearchRule "dontaudit setroubleshootd_t admin_home_t : file { read } [ ]" + rlRun "touch /root/.rpmmacros" + # trigger selinux denial + rlRun "passwd --help >& /root/output.txt" + sleep 5 + rlPhaseEnd + + rlPhaseStartCleanup + rlSECheckAVC --ignore 'type=AVC .* denied { write } .*:passwd_t.* ' \ + --ignore '.*passwd.*' + rlRun "rlFileRestore" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd \ No newline at end of file diff --git a/selinux-policy/rpm-suppress-stderr/main.fmf b/selinux-policy/rpm-suppress-stderr/main.fmf new file mode 100644 index 0000000..baa0bfd --- /dev/null +++ b/selinux-policy/rpm-suppress-stderr/main.fmf @@ -0,0 +1,21 @@ +summary: Does rpm install generate any output on stderr? +component: + - selinux-policy +require: + - fuse + - fuse-overlayfs + - dnf +test: ./test.sh +framework: beakerlib +duration: 10m +enabled: true +tag: + - NoRHIVOS + - avoidImageMode +link: + - https://issues.redhat.com/browse/RHEL-59192 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false +extra-nitrate: TC#0617968 diff --git a/selinux-policy/rpm-suppress-stderr/test.sh b/selinux-policy/rpm-suppress-stderr/test.sh new file mode 100755 index 0000000..17a537f --- /dev/null +++ b/selinux-policy/rpm-suppress-stderr/test.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*- +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +INSTALL_OPTION="" +DOWNLOAD_OPTION="" +if dnf --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if rlIsCentOS 9 ; then + INSTALL_OPTION="${INSTALL_OPTION} --releasever 9" +elif rlIsFedora ; then + RELEASEVER=`grep VERSION_ID /etc/os-release | cut -d = -f 2` + INSTALL_OPTION="${INSTALL_OPTION} --releasever ${RELEASEVER}" +fi +DOWNLOAD_OPTION=${INSTALL_OPTION} +# dnf sometimes fails to detect the release version on CentOS 9 +if dnf install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if dnf install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlAssertRpm fuse + rlAssertRpm fuse-overlayfs + rlPhaseEnd + + rlPhaseStartTest + rlRun "mkdir $tmp/lower $tmp/upper $tmp/work $tmp/merged" + rlRun "dnf -y install --installroot=$tmp/lower diffutils libfdisk libselinux-utils libutempter policycoreutils util-linux rpm ${INSTALL_OPTION}" + rlRun "mkdir download" + rlRun "cd download" + rlRun "dnf download rpm-plugin-selinux selinux-policy selinux-policy-targeted ${DOWNLOAD_OPTION}" + rlRun "mv -v *rpm $tmp/lower" + rlRun "cd .." + rlRun "fuse-overlayfs -o lowerdir=$tmp/lower/ -o upperdir=$tmp/upper/ -o workdir=$tmp/work/ $tmp/merged/" + RPMS=$(ls $tmp/merged/ | grep .rpm | xargs) + rlRun "chroot $tmp/merged/ /usr/bin/rpm -i $RPMS 2> error.log" + # warnings can be ignored/removed + rlRun "sed -i 's/^warning.*$//' error.log" + # whitespaces can be ignored/removed + rlRun "sed -i 's/^[[:space:]]*$//' error.log" + rlRun "sed -i '/^$/d' error.log" + rlAssert0 "error.log should be empty" `stat -c "%s" error.log` + rlRun "cat error.log" + rlRun "fusermount -u $tmp/merged/" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd diff --git a/selinux-policy/rpmdb-and-similar/Makefile b/selinux-policy/rpmdb-and-similar/Makefile index f7d2876..89d9191 100644 --- a/selinux-policy/rpmdb-and-similar/Makefile +++ b/selinux-policy/rpmdb-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts sssd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service sssd" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -62,13 +62,10 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 1898298" >> $(METADATA) # Fedora 33 + @echo "Bug: 1461313" >> $(METADATA) # Fedora 32 @echo "Bug: 1899548" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900383" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900386" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900388" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900390" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900391" >> $(METADATA) # Fedora 33 + @echo "Bug: 2023163" >> $(METADATA) # Fedora 35 + @echo "Bug: 2164752" >> $(METADATA) # Fedora 37 rhts-lint $(METADATA) diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index 9090977..5bb99a6 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -1,3 +1,48 @@ -path: /selinux-policy/rpmdb-and-similar -tier: 2 +summary: SELinux interferes with rpmdb program, rpmdb-rebuild service and related + programs +description: |+ + SELinux interferes with rpmdb program, rpmdb-rebuild service and related programs. +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - sssd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1461313 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899548 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2023163 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2164752 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + continue: false +extra-nitrate: TC#0609732 +extra-summary: /CoreOS/selinux-policy/Regression/rpmdb-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rpmdb-and-similar +id: 7444ab1f-9138-4ac1-b92c-825adc7a5436 diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index b4187f8..e0c0b55 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -27,21 +27,25 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" SERVICE_PACKAGE="rpm" SERVICE_NAME="rpmdb-rebuild" PROCESS_NAME="rpmdb" PROCESS_CONTEXT="rpmdb_t" rlJournalStart + if rlIsRHEL '<9' || rlIsCentOS '<9' ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlLog "If this test fails, please contact mmalik or IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -57,38 +61,22 @@ rlJournalStart sleep 2 rlPhaseEnd - rlPhaseStartTest "bz#1898298" - rlSEMatchPathCon "/usr/bin/rpmdb" "rpmdb_exec_t" - rlSEMatchPathCon "/etc/resolv.conf" "net_conf_t" - rlSESearchRule "allow rpmdb_t net_conf_t : lnk_file { getattr read } [ ]" - rlPhaseEnd - rlPhaseStartTest "bz#1899548" - # also covers duplicates: 1900383, 1900386, 1900388, 1900389, 1900390, 1900391 rlSEMatchPathCon "/usr/bin/rpmdb" "rpmdb_exec_t" - rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" - rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t" rlSESearchRule "allow rpmdb_t user_devpts_t : chr_file { read write } [ ]" - rlSESearchRule "dontaudit rpmdb_t sssd_public_t : file { getattr open map } [ ]" - rlSESearchRule "dontaudit rpmdb_t sssd_var_lib_t : sock_file { write } [ ]" - rlSESearchRule "dontaudit rpmdb_t sssd_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "dontaudit rpmdb_t system_dbusd_var_run_t : sock_file { write } [ ]" - rlSESearchRule "dontaudit rpmdb_t system_dbusd_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "dontaudit rpmdb_t system_dbusd_t : dbus { send_msg } [ ]" - rlSESearchRule "dontaudit system_dbusd_t rpmdb_t : dbus { send_msg } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "touch /var/lib/rpm/.rebuilddb" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlRun "touch /var/lib/rpm/.rebuilddb" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartTest "rpmdb executed by root/unconfined_t" - rlRun "semodule -DB" rlRun "restorecon -Rv /var/lib/rpm" rlRun "ls -Z `which rpmdb`" rlRun "rpmdb --help" @@ -101,9 +89,29 @@ rlJournalStart rlRun "ls -dZ /var/lib/rpm | grep :rpm_var_lib_t" rlRun "ls -Z /var/lib/rpm" rm -f ${OUTPUT_FILE} - rlRun "semodule -B" rlPhaseEnd + if [ -f /usr/lib/systemd/system/rpmdb-migrate.service ] ; then + rlPhaseStartTest "bz#2164752" + rlSEMatchPathCon "/usr/bin/rpm" "rpm_exec_t" + rlSEMatchPathCon "/usr/lib/rpm/rpmdb_migrate" "rpmdb_exec_t" + rlSEMatchPathCon "/var/lib/rpm" "rpm_var_lib_t" + rlSEMatchPathCon "/var/lib/rpm/.migratedb" "rpm_var_lib_t" + rlSESearchRule "allow rpmdb_t shell_exec_t : file { map execute } [ ]" + rlSESearchRule "allow rpmdb_t rpm_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "allow rpmdb_t bin_t : file { getattr open read execute execute_no_trans } [ ]" + rlSESearchRule "allow rpmdb_t rpm_var_lib_t : lnk_file { getattr read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- rpmdb-migrate service" + rlRun "touch /var/lib/rpm/.migratedb" + rlSEService - rpmdb-migrate - rpmdb_t "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "touch /var/lib/rpm/.migratedb" + rlSEService - rpmdb-migrate - rpmdb_t "restart status stop status" 1 + rlPhaseEnd + fi + rlPhaseStartCleanup sleep 2 rlSECheckAVC diff --git a/selinux-policy/rrdcached-service-and-related/main.fmf b/selinux-policy/rrdcached-service-and-related/main.fmf index 9d47d7a..d310cd8 100644 --- a/selinux-policy/rrdcached-service-and-related/main.fmf +++ b/selinux-policy/rrdcached-service-and-related/main.fmf @@ -1,2 +1,45 @@ -path: /selinux-policy/rrdcached-service-and-related -tier: 2 +summary: Basic test for rrdcached service +description: '' +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - initscripts + - libselinux-utils + - policycoreutils + - rrdtool + - selinux-policy + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoFedora30 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - TIPpass_Security + - f32friendly + - f33friendly + - targeted + - NoRHIVOS +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1726255 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0604406 +extra-summary: /CoreOS/selinux-policy/Regression/rrdcached-service-and-related +extra-task: /CoreOS/selinux-policy/Regression/rrdcached-service-and-related +id: da5dd8fd-2a99-4a50-97bc-2c3b3ac16747 diff --git a/selinux-policy/rrdcached-service-and-related/runtest.sh b/selinux-policy/rrdcached-service-and-related/runtest.sh index 56b1a25..aa774dd 100755 --- a/selinux-policy/rrdcached-service-and-related/runtest.sh +++ b/selinux-policy/rrdcached-service-and-related/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -45,7 +44,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlAssertRpm $PACKAGE rlAssertRpm $SERVICE_PACKAGE rlSESetEnforce @@ -85,11 +84,13 @@ rlJournalStart rlSESearchRule "typeattribute ${PROCESS_CONTEXT} syslog_client_type" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 2 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2 rlPhaseEnd + fi # TODO: add test scenario for rrdcached.socket diff --git a/selinux-policy/rsyslog-and-similar/main.fmf b/selinux-policy/rsyslog-and-similar/main.fmf index 5e28009..34fd90d 100644 --- a/selinux-policy/rsyslog-and-similar/main.fmf +++ b/selinux-policy/rsyslog-and-similar/main.fmf @@ -1,8 +1,47 @@ -path: /selinux-policy/rsyslog-and-similar -summary: Test rsyslog service and verify AVC denials -description: | - Test coverage for rsyslog service with different configurations and - verify related SELinux AVC issues. -adjust: -- enabled: false - when: distro < rhel-8 +summary: SELinux AVCs with rsyslog in various configurations +description: |+ + SELinux interferes with rsyslogd and related programs. + +contact: Milos Malik +component: + - rsyslog + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - /usr/sbin/service + - libselinux + - libselinux-utils + - logwatch + - policycoreutils + - policycoreutils-devel + - rsyslog + - rsyslog-gnutls + - selinux-policy + - selinux-policy-targeted + - setools-console + - shadow-utils + - /usr/sbin/semanage +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - targeted + - NoRHIVOS + - avoidImageMode +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823672 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0609007 +extra-summary: /CoreOS/selinux-policy/Regression/rsyslog-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rsyslog-and-similar +id: 42688797-d2d6-4acc-acd2-dc54f18150c4 diff --git a/selinux-policy/rsyslog-and-similar/runtest.sh b/selinux-policy/rsyslog-and-similar/runtest.sh index 24f0b0e..ee1b641 100755 --- a/selinux-policy/rsyslog-and-similar/runtest.sh +++ b/selinux-policy/rsyslog-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" @@ -65,7 +64,7 @@ EOF rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -87,7 +86,7 @@ rlJournalStart rlRun "update_rsys" rlRun "systemctl restart rsyslog" sleep 3 - rlRun "ausearch -m AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC --start $tst_Time --input-logs" 1 rlRun "cp -rv /etc/rsyslog.conf-orig /etc/rsyslog.conf" rlRun "systemctl restart rsyslog" rlPhaseEnd @@ -105,7 +104,7 @@ rlJournalStart rlRun "echo ' ' >> /etc/rsyslog.conf" rlRun "systemctl restart rsyslog" sleep 3 - rlRun "ausearch -m AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC --start $tst_Time --input-logs" 1 rlRun 'semanage fcontext -d -t public_content_rw_t "/my/custom(/.*)?"' rlRun "semodule -r rsyslog_imfile_policy" rlRun "cp -rv /etc/rsyslog.conf-orig /etc/rsyslog.conf" diff --git a/selinux-policy/rtkit-daemon-and-similar/Makefile b/selinux-policy/rtkit-daemon-and-similar/Makefile index 4e5588f..35430d8 100644 --- a/selinux-policy/rtkit-daemon-and-similar/Makefile +++ b/selinux-policy/rtkit-daemon-and-similar/Makefile @@ -1,7 +1,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Makefile of /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar -# Description: the service was running as initrc_t, now it is confined by SELinux +# Description: SELinux interferes with rtkit daemon and related programs # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/selinux-policy/rtkit-daemon-and-similar/main.fmf b/selinux-policy/rtkit-daemon-and-similar/main.fmf index 358e482..161244b 100644 --- a/selinux-policy/rtkit-daemon-and-similar/main.fmf +++ b/selinux-policy/rtkit-daemon-and-similar/main.fmf @@ -1,4 +1,58 @@ -path: /selinux-policy/rtkit-daemon-and-similar -summary: SELinux interferes with rtkit daemon and related programs -description: | - Test coverage for SELinux AVC issues against rtkit daemon and related programs. +summary: SELinux interferes with rtkit-daemon and related programs +description: |+ + SELinux interferes with rtkit daemon and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - /usr/sbin/service + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - glib2 + - setools-console + - rtkit +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_FIPS + - TIPpass_Security + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1626982 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1703241 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1720546 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1750024 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1752583 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754408 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1755572 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1756755 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1758097 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1760214 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1873658 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1910507 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0300678 +extra-summary: /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar +id: 9c4bfed2-36f7-4f37-ac14-629721ab5934 diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh index b6e88e8..855902c 100755 --- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh +++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh @@ -3,7 +3,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # runtest.sh of /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar -# Description: the service was running as initrc_t, now it is confined by SELinux +# Description: SELinux interferes with rtkit daemon and related programs # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -41,7 +40,7 @@ PROCESS_CONTEXT="rtkit_daemon_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -77,9 +76,9 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 ; then + DESTINATION="org.freedesktop.RealtimeKit1" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- DBus service" - DESTINATION="org.freedesktop.RealtimeKit1" rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" @@ -98,7 +97,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 6 ; then + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -109,7 +108,7 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd fi diff --git a/selinux-policy/samba-bgqd-and-similar/Makefile b/selinux-policy/samba-bgqd-and-similar/Makefile new file mode 100644 index 0000000..e53e298 --- /dev/null +++ b/selinux-policy/samba-bgqd-and-similar/Makefile @@ -0,0 +1,74 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +# Description: SELinux interferes with samba-bgqd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with samba-bgqd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba samba-client samba-common-tools cups /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-53124" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-64908" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69512" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69517" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-72860" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-72861" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-93731" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/samba-bgqd-and-similar/PURPOSE b/selinux-policy/samba-bgqd-and-similar/PURPOSE new file mode 100644 index 0000000..eda41a5 --- /dev/null +++ b/selinux-policy/samba-bgqd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +Author: Milos Malik + +SELinux interferes with samba-bgqd and related programs. + diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf new file mode 100644 index 0000000..956c2eb --- /dev/null +++ b/selinux-policy/samba-bgqd-and-similar/main.fmf @@ -0,0 +1,53 @@ +summary: SELinux interferes with samba-bgqd and related programs +description: |+ + SELinux interferes with samba-bgqd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - samba + - samba-client + - samba-common-tools + - cups + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-53124 + - verifies: https://issues.redhat.com/browse/RHEL-64908 + - verifies: https://issues.redhat.com/browse/RHEL-69512 + - verifies: https://issues.redhat.com/browse/RHEL-69517 + - verifies: https://issues.redhat.com/browse/RHEL-72860 + - verifies: https://issues.redhat.com/browse/RHEL-72861 + - verifies: https://issues.redhat.com/browse/RHEL-93731 + - verifies: https://issues.redhat.com/browse/RHEL-95985 +adjust+: + - enabled: false + when: distro < rhel-9 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +extra-nitrate: TC#0617974 +id: 1da15d16-92c5-405e-bc80-ed0ab0ea65a8 diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh new file mode 100755 index 0000000..71bae99 --- /dev/null +++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh @@ -0,0 +1,130 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +# Description: SELinux interferes with samba-bgqd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="samba" +FILE_PATH="/usr/libexec/samba/samba-bgqd" +PROCESS_NAME="samba-bgqd" +SERVICE_NAME="samba-bgqd" +if seinfo -t | grep -q samba_bgqd ; then + PROCESS_CONTEXT="samba_bgqd_t" + FILE_CONTEXT="samba_bgqd_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + rlAssertRpm cups + + rlFileBackup /etc/shadow + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if seinfo -t | grep -q samba_bgqd ; then + rlPhaseStartTest "RHEL-53124 + RHEL-64908" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSEMatchPathCon "/run/samba-bgqd.pid" "samba_bgqd_var_run_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSESearchRule "allow winbind_rpcd_t samba_bgqd_var_run_t : file { open write lock } [ ]" + rlSESearchRule "allow winbind_rpcd_t samba_bgqd_t : unix_dgram_socket { sendto } [ ]" + rlSESearchRule "allow winbind_rpcd_t samba_bgqd_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "allow samba_bgqd_t sssd_public_t : dir { search } [ ]" + rlSESearchRule "allow samba_bgqd_t sssd_var_lib_t : dir { search } [ ]" + rlSESearchRule "allow samba_bgqd_t winbind_rpcd_t : fifo_file { write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-69512 + RHEL-69517" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSEMatchPathCon "/etc/cups" "cupsd_etc_t" + rlSEMatchPathCon "/run/cups" "cupsd_var_run_t" + rlSESearchRule "allow samba_bgqd_t cupsd_etc_t : dir { search } [ ]" + rlSESearchRule "allow samba_bgqd_t cupsd_var_run_t : dir { search } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-72860 + RHEL-72861" + rlSEMatchPathCon "/run/cups/cups.sock" "cupsd_var_run_t" + rlSESearchRule "allow samba_bgqd_t cupsd_var_run_t : sock_file { read write } [ ]" + rlSESearchRule "allow samba_bgqd_t cupsd_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + + if ! rlIsRHEL "<9.8" && ! ( rlIsRHEL 10 && rlIsRHEL "<10.2" ); then + rlPhaseStartTest "RHEL-93731 + RHEL-95985" + rlSEMatchPathCon "/var/lib/samba/private/msg.sock/668534" "samba_var_t" + rlSESearchRule "allow samba_bgqd_t smbd_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + fi + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "service cups start" + USER_NAME="smbuser${RANDOM}" + USER_SECRET="S3kr3T${RANDOM}" + rlRun "useradd ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "echo -en '${USER_SECRET}\n${USER_SECRET}\n' | smbpasswd -s -a ${USER_NAME}" + rlRun "systemctl start samba-bgqd" + rlRun "systemctl start smb" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + sleep 2 + rlRun "rpcclient ncacn_np:localhost -c 'enumprinters' -U${USER_NAME}%${USER_SECRET}" + sleep 2 + rlRun "systemctl stop smb" + rlRun "systemctl stop samba-bgqd" + rlRun "smbpasswd -x ${USER_NAME}" + rlRun "userdel -rf ${USER_NAME}" + rlRun "service cups stop" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile new file mode 100644 index 0000000..e483fa0 --- /dev/null +++ b/selinux-policy/smbcontrol-and-similar/Makefile @@ -0,0 +1,77 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +# Description: SELinux interferes with smbcontrol and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/smbcontrol-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with smbcontrol and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba-common samba-common-tools" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 1326371" >> $(METADATA) # RHEL-7 + @echo "Bug: 1326621" >> $(METADATA) # RHEL-6 + @echo "Bug: 1574518" >> $(METADATA) # RHEL-8 + @echo "Bug: 1574521" >> $(METADATA) # RHEL-7 + @echo "Bug: 2025931" >> $(METADATA) # Fedora 35 + @echo "Bug: 2027740" >> $(METADATA) # RHEL-8 + @echo "Bug: 2027751" >> $(METADATA) # RHEL-9 + @echo "Bug: 2033873" >> $(METADATA) # RHEL-8 + @echo "Bug: 2038157" >> $(METADATA) # RHEL-9 + @echo "Bug: 2038963" >> $(METADATA) # Fedora 35 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/smbcontrol-and-similar/PURPOSE b/selinux-policy/smbcontrol-and-similar/PURPOSE new file mode 100644 index 0000000..fe8b846 --- /dev/null +++ b/selinux-policy/smbcontrol-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +Author: Milos Malik + +SELinux interferes with smbcontrol and related programs. + diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf new file mode 100644 index 0000000..b7eae14 --- /dev/null +++ b/selinux-policy/smbcontrol-and-similar/main.fmf @@ -0,0 +1,54 @@ +summary: SELinux interferes with smbcontrol and related programs +description: |+ + SELinux interferes with smbcontrol and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - samba-common + - samba-common-tools +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1326371 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1326621 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574518 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574521 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2025931 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027740 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027751 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2033873 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2038157 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2038963 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0522115 +extra-summary: /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +extra-task: /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +id: c0f43867-cee7-47ae-869f-9247d2ba9dfb diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh new file mode 100755 index 0000000..9e8a384 --- /dev/null +++ b/selinux-policy/smbcontrol-and-similar/runtest.sh @@ -0,0 +1,120 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +# Description: SELinux interferes with smbcontrol and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/smbcontrol" +FILE_CONTEXT="smbcontrol_exec_t" +if rlIsRHEL 6 ; then + SERVICE_PACKAGE="samba-common" +else + SERVICE_PACKAGE="samba-common-tools" +fi +PROCESS_NAME="smbcontrol" +PROCESS_CONTEXT="smbcontrol_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1326371 + bz#1326621" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + SOURCE_TYPE="unconfined_t" + BOOLEANS="[ ]" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow smbcontrol_t samba_var_t : dir { ioctl read write getattr lock add_name remove_name search open }" + rlSESearchRule "allow smbcontrol_t samba_var_t : file { ioctl read write create getattr setattr lock append unlink link rename open }" + rlSESearchRule "allow smbcontrol_t samba_var_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open }" + rlSESearchRule "allow smbd_t smbcontrol_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow smbcontrol_t smbd_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow nmbd_t smbcontrol_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow smbcontrol_t nmbd_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow winbind_t smbcontrol_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow smbcontrol_t winbind_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow smbcontrol_t smbcontrol_t : unix_dgram_socket { create ioctl read getattr lock write setattr append bind connect getopt setopt shutdown }" + rlSESearchRule "allow smbcontrol_t smbcontrol_t : process { signal signull }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1574518 + bz#1574521" + rlSEMatchPathCon "/usr/bin/smbcontrol" "smbcontrol_exec_t" + rlSEMatchPathCon "/var/lib/samba/lock" "samba_var_t" + # following rule assumes that samba_var_lock_t type is not defined + rlSESearchRule "allow smbcontrol_t samba_var_t : dir { create add_name write }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#2025931 + bz#2027740 + bz#2027751" + rlSESearchRule "allow smbcontrol_t smbcontrol_t : netlink_route_socket { create bind getattr nlmsg_read} [ ]" + rlSESearchRule "allow smbcontrol_t smbcontrol_t : udp_socket { create ioctl } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2033873 + bz#2038157 + bz#2038963" + rlRun "ls -Z /proc/net/unix | grep :proc_net_t" + rlSESearchRule "allow smbcontrol_t proc_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + if ! rlIsRHEL 5 6 ; then + rlRun "ls -Z /var/lib/samba/lock" + fi + rlRun "smbcontrol nmbd ping" 0,1 + rlRun "smbcontrol smbd ping" 0,1 + rlRun "smbcontrol winbindd ping" 0,1 + if ! rlIsRHEL 5 6 ; then + rlRun "ls -Z /var/lib/samba/lock" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/snapd-and-similar/Makefile b/selinux-policy/snapd-and-similar/Makefile new file mode 100644 index 0000000..e44655c --- /dev/null +++ b/selinux-policy/snapd-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/snapd-and-similar +# Description: SELinux interferes with the snapd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/snapd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the snapd service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console snapd snapd-selinux /usr/sbin/service spamassassin" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2207725" >> $(METADATA) # Fedora 38 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/snapd-and-similar/PURPOSE b/selinux-policy/snapd-and-similar/PURPOSE new file mode 100644 index 0000000..6788078 --- /dev/null +++ b/selinux-policy/snapd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/snapd-and-similar +Author: Milos Malik + +SELinux interferes with the snapd service and related programs + diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf new file mode 100644 index 0000000..db9a930 --- /dev/null +++ b/selinux-policy/snapd-and-similar/main.fmf @@ -0,0 +1,51 @@ +summary: SELinux interferes with the snapd service and related programs +description: |+ + SELinux interferes with the snapd service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - snapd + - snapd-selinux + - /usr/sbin/service + - spamassassin +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - failinfedora + - targeted + - epel + - rhel8-epel + - rhel9-epel + - rhel10-epel + - rhel9_broken + - rhel10_broken + - NoRHIVOS + - avoidImageMode +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2207725 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + because: the snapd package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/snapd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/snapd-and-similar +extra-nitrate: TC#0615881 +id: 7483a2b6-5a30-4538-b728-85e75d0542ef diff --git a/selinux-policy/snapd-and-similar/runtest.sh b/selinux-policy/snapd-and-similar/runtest.sh new file mode 100755 index 0000000..8fbc405 --- /dev/null +++ b/selinux-policy/snapd-and-similar/runtest.sh @@ -0,0 +1,96 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/snapd-and-similar +# Description: SELinux interferes with the snapd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/snapd/snapd" +FILE_CONTEXT="snappy_exec_t" +SERVICE_PACKAGE="snapd" +SERVICE_NAME="snapd" +PROCESS_NAME="snapd" +PROCESS_CONTEXT="snappy_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi + rlAssertRpm spamassassin + + # rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2207725" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/lib/snapd" "snappy_var_lib_t" + rlSESearchRule "allow init_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlSESearchRule "allow spamd_t snappy_var_lib_t : dir { search } [ ]" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "ls -alRZ /var/lib/snapd" + rlRun "semodule -lfull | grep snap" + rlRun "service spamassassin start" + rlRun "service spamassassin status" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "service spamassassin stop" + rlRun "service spamassassin status" 3 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + # rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/sslh-and-similar/Makefile b/selinux-policy/sslh-and-similar/Makefile new file mode 100644 index 0000000..7740655 --- /dev/null +++ b/selinux-policy/sslh-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/sslh-and-similar +# Description: SELinux interferes with sslh and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/sslh-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with sslh and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console sslh /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + @echo "Bug: 1534624" >> $(METADATA) # Fedora 27 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/sslh-and-similar/PURPOSE b/selinux-policy/sslh-and-similar/PURPOSE new file mode 100644 index 0000000..774a1be --- /dev/null +++ b/selinux-policy/sslh-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/sslh-and-similar +Author: Milos Malik + +SELinux interferes with sslh and related programs. + diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf new file mode 100644 index 0000000..fae3684 --- /dev/null +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -0,0 +1,54 @@ +summary: SELinux interferes with sslh and related programs +description: |+ + SELinux interferes with sslh and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - sslh + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted + - failinfedora + - epel + - rhel8-epel + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1534624 +adjust+: + - enabled: false + when: distro >= rhel-9 + because: the sslh package is not available there + - enabled: false + when: distro >= centos-stream-9 + because: the sslh package is not available there + - enabled: false + when: arch == i386, ppc, s390, s390x + because: the sslh package is not available for all architectures +extra-nitrate: TC#0563428 +extra-summary: /CoreOS/selinux-policy/Regression/sslh-and-similar +extra-task: /CoreOS/selinux-policy/Regression/sslh-and-similar +id: da6c2b1a-6db2-4c2b-b258-311438d26aef diff --git a/selinux-policy/sslh-and-similar/runtest.sh b/selinux-policy/sslh-and-similar/runtest.sh new file mode 100755 index 0000000..90a231a --- /dev/null +++ b/selinux-policy/sslh-and-similar/runtest.sh @@ -0,0 +1,114 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/sslh-and-similar +# Description: SELinux interferes with sslh and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/sslh" +FILE_CONTEXT="sslh_exec_t" +SERVICE_PACKAGE="sslh" +SERVICE_NAME="sslh" +PROCESS_NAME="sslh" +PROCESS_CONTEXT="sslh_t" + +rlJournalStart + if rlIsRHEL && ! rlIsRHEL 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlFileBackup /etc/sslh.cfg + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "bz#1534624" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow sslh_t sssd_var_lib_t : dir { search }" + rlSESearchRule "allow sslh_t sssd_public_t : file { getattr open read map }" + rlSESearchRule "allow sslh_t sssd_var_lib_t : sock_file { write }" + rlSESearchRule "allow sslh_t sssd_t : unix_stream_socket { connectto }" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlRun "sed -i 's/thelonious/localhost/' /etc/sslh.cfg" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # RHEL-4, RHEL-5, RHEL-6 are excluded + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile new file mode 100644 index 0000000..ac07019 --- /dev/null +++ b/selinux-policy/stalld-and-similar/Makefile @@ -0,0 +1,75 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/stalld-and-similar +# Description: SELinux interferes with stalld and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/stalld-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with stalld and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: stalld" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console stalld /usr/sbin/service binutils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2042614" >> $(METADATA) # RHEL-9 + @echo "Bug: 2092864" >> $(METADATA) # RHEL-9 + @echo "Bug: 2096776" >> $(METADATA) # RHEL-9 + @echo "Bug: 2102224" >> $(METADATA) # RHEL-9 + @echo "Bug: 2105038" >> $(METADATA) # RHEL-9 + @echo "Bug: 2140673" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-50356" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/stalld-and-similar/PURPOSE b/selinux-policy/stalld-and-similar/PURPOSE new file mode 100644 index 0000000..5d0d6a3 --- /dev/null +++ b/selinux-policy/stalld-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/stalld-and-similar +Author: Milos Malik + +SELinux interferes with stalld and related programs. + diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf new file mode 100644 index 0000000..bb3e31f --- /dev/null +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -0,0 +1,51 @@ +summary: SELinux interferes with stalld and related programs +description: |+ + SELinux interferes with stalld and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - stalld + - /usr/sbin/service + - binutils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS +tier: 2 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096776 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2102224 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2105038 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2140673 + - verifies: https://issues.redhat.com/browse/RHEL-50356 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + continue: false +extra-nitrate: TC#0613202 +extra-summary: /CoreOS/selinux-policy/Regression/stalld-and-similar +extra-task: /CoreOS/selinux-policy/Regression/stalld-and-similar +id: 19ce8a2d-bea8-45d8-a9d1-f46612e94f34 diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh new file mode 100755 index 0000000..eebb2dd --- /dev/null +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -0,0 +1,150 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/stalld-and-similar +# Description: SELinux interferes with stalld and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/stalld" +FILE_CONTEXT="stalld_exec_t" +SERVICE_PACKAGE="stalld" +SERVICE_NAME="stalld" +PROCESS_NAME="stalld" +PROCESS_CONTEXT="stalld_t" + +rlJournalStart + if ! rpm -q ${SERVICE_PACKAGE} >& /dev/null ; then + rlLog "Required packages are not available/installed." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/sysconfig/stalld + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2042614" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlRun "ls -Z /proc/sys/kernel/sched_rt_runtime_us | grep :sysctl_kernel_t:" + rlRun "ls -Z /sys/kernel/debug/sched/debug | grep :debugfs_t:" + rlRun "ls -Z /sys/kernel/debug/sched/features | grep :debugfs_t:" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow ${PROCESS_CONTEXT} sysctl_kernel_t : file { getattr open read } [ fips_mode ]" + rlSESearchRule "allow ${PROCESS_CONTEXT} debugfs_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2092864" + rlSESearchRule "allow stalld_t stalld_t : capability { sys_nice } [ ]" + rlSESearchRule "allow stalld_t stalld_t : process { setsched } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2096776" + rlSESearchRule "allow stalld_t kernel_t : process { getsched } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2102224" + rlSESearchRule "allow stalld_t kernel_t : process { setsched } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2105038" + rlRun "sesearch -s stalld_t -t domain -c process -p getsched -A -ds -dt | grep allow" + rlRun "sesearch -s stalld_t -t domain -c process -p setsched -A -ds -dt | grep allow" + rlPhaseEnd + + rlPhaseStartTest "bz#2140673" + rlRun "ls -Z /sys/kernel/security/lockdown | grep :security_t" + rlSESearchRule "allow stalld_t security_t : file { getattr open read } [ ]" + rlPhaseEnd + + if strings `which stalld` | grep -q queue_track ; then + # if the program recognizes the queue_track option then test it and use it + rlPhaseStartTest "RHEL-50356" + rlSEMatchPathCon "/sys/fs/bpf" "bpf_t" + rlSESearchRule "allow stalld_t stalld_t : capability { sys_resource } [ ]" + rlSESearchRule "allow stalld_t stalld_t : process { setrlimit } [ ]" + rlSESearchRule "allow stalld_t bpf_t : dir { getattr open read } [ ]" + rlSESearchRule "allow stalld_t stalld_t : capability2 { bpf perfmon } [ ]" + rlSESearchRule "allow stalld_t stalld_t : bpf { prog_run prog_load map_read map_write map_create } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- RHEL-50356" + rlRun "grep ^AGGR= /etc/sysconfig/stalld" + rlRun "sed -i 's/^AGGR=.*$/AGGR=\"--backend queue_track\"/' /etc/sysconfig/stalld" + rlRun "grep ^AGGR= /etc/sysconfig/stalld" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status stop status" 5 + rlRun "sed -i 's/^AGGR=.*$/AGGR=/' /etc/sysconfig/stalld" + rlRun "grep ^AGGR= /etc/sysconfig/stalld" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_syslog/' /etc/sysconfig/stalld" + rlRun "journalctl -u ${SERVICE_NAME} > before.txt" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_kmsg/' /etc/sysconfig/stalld" + rlRun "journalctl -u ${SERVICE_NAME} > after.txt" + rlRun "setsebool domain_can_write_kmsg on" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlRun "setsebool domain_can_write_kmsg off" + rlRun "diff before.txt after.txt | grep -i -e 'operation not permitted' -e 'permission denied'" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rm -f before.txt after.txt + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/sudo-and-dnf/Makefile b/selinux-policy/sudo-and-dnf/Makefile new file mode 100644 index 0000000..8fd75e9 --- /dev/null +++ b/selinux-policy/sudo-and-dnf/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/sudo-and-dnf +# Description: SELinux interferes with the dnf command executed via sudo +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/sudo-and-dnf +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the dnf command executed via sudo" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients shadow-utils sudo dnf /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2233065" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-9947" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/sudo-and-dnf/PURPOSE b/selinux-policy/sudo-and-dnf/PURPOSE new file mode 100644 index 0000000..a3b1b5c --- /dev/null +++ b/selinux-policy/sudo-and-dnf/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/sudo-and-dnf +Author: Milos Malik + +SELinux interferes with the dnf command executed via sudo + diff --git a/selinux-policy/sudo-and-dnf/main.fmf b/selinux-policy/sudo-and-dnf/main.fmf new file mode 100644 index 0000000..53ec209 --- /dev/null +++ b/selinux-policy/sudo-and-dnf/main.fmf @@ -0,0 +1,49 @@ +summary: SELinux interferes with the dnf command executed via sudo +description: |+ + SELinux interferes with the dnf command executed via sudo. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - shadow-utils + - sudo + - dnf + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2233065 + - verifies: https://issues.redhat.com/browse/RHEL-1679 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/sudo-and-dnf +extra-task: /CoreOS/selinux-policy/Regression/sudo-and-dnf +extra-nitrate: TC#0615928 +id: 5d15cec5-e128-4e5c-9f60-80e852df3936 diff --git a/selinux-policy/sudo-and-dnf/runtest.sh b/selinux-policy/sudo-and-dnf/runtest.sh new file mode 100755 index 0000000..4bcb027 --- /dev/null +++ b/selinux-policy/sudo-and-dnf/runtest.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/sudo-and-dnf +# Description: SELinux interferes with the dnf command executed via sudo +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -q --whatprovides dnf" + rlAssertRpm sudo + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#2233065 + RHEL-9947" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" + USER_NAME="sysadm${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z sysadm_u ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "echo \"${USER_NAME} ALL=(ALL) NOPASSWD: ALL\" > /etc/sudoers.d/dnf-test" + rlRun "ls -dlZ /var/lib/rpm" + + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost sudo dnf clean all" + rlRun "grep -i 'rpmdb open failed' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost sudo dnf update -y" + rlRun "grep -i 'rpmdb open failed' $rlRun_LOG" 1 + rm -f $rlRun_LOG + + rlRun "rm -f /etc/sudoers.d/dnf-test" + rlRun "userdel -rfZ ${USER_NAME}" + rlRun "setsebool ssh_sysadm_login off" + rlFileRestore + rlRun "service sshd restart" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/sudo-and-dnf/ssh.exp b/selinux-policy/sudo-and-dnf/ssh.exp new file mode 100755 index 0000000..096b9b8 --- /dev/null +++ b/selinux-policy/sudo-and-dnf/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "id -Z ; $command" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/sulogin-and-similar/main.fmf b/selinux-policy/sulogin-and-similar/main.fmf new file mode 100644 index 0000000..4412192 --- /dev/null +++ b/selinux-policy/sulogin-and-similar/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with sulogin and related programs +test: ./runtest.sh +framework: beakerlib +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - binutils + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2265391 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/sulogin-and-similar +extra-task: /CoreOS/selinux-policy/Regression/sulogin-and-similar +extra-nitrate: TC#0617279 +id: 3128d079-084d-4c82-a01e-e2a8457a67d0 diff --git a/selinux-policy/sulogin-and-similar/runtest.sh b/selinux-policy/sulogin-and-similar/runtest.sh new file mode 100755 index 0000000..2a52952 --- /dev/null +++ b/selinux-policy/sulogin-and-similar/runtest.sh @@ -0,0 +1,44 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm selinux-policy + rlAssertRpm selinux-policy-targeted + rlAssertRpm systemd + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 8 9 && ! rlIsCentOS 8 9 ; then + rlPhaseStartTest "bz#2265391" + rlSEMatchPathCon "/usr/sbin/sulogin" "sulogin_exec_t" + rlSESearchRule "dontaudit sulogin_t sulogin_t : capability2 { checkpoint_restore } [ ]" + rlSESearchRule "allow sulogin_t tty_device_t : chr_file { relabelfrom relabelto } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/rescue.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "grep ExecStart= /usr/lib/systemd/system/rescue.service" + rlRun "strings /usr/lib/systemd/systemd-sulogin-shell | grep bin/sulogin" + rlRun "service rescue start" + sleep 2 + rlRun "service rescue status" + rlRun "service rescue stop" + sleep 2 + rlRun "service rescue status" 3 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalEnd + diff --git a/selinux-policy/swap-file-and-systemd-access/Makefile b/selinux-policy/swap-file-and-systemd-access/Makefile index dc3fe58..8ec066f 100644 --- a/selinux-policy/swap-file-and-systemd-access/Makefile +++ b/selinux-policy/swap-file-and-systemd-access/Makefile @@ -67,6 +67,10 @@ $(METADATA): Makefile @echo "Bug: 1798872" >> $(METADATA) # RHEL 8 @echo "Bug: 1845594" >> $(METADATA) # Fedora 32 @echo "Bug: 1850177" >> $(METADATA) # RHEL 8 + @echo "Bug: 1912385" >> $(METADATA) # Fedora 32 + @echo "Bug: 1926536" >> $(METADATA) # RHEL 9 + @echo "Bug: 1928539" >> $(METADATA) # Fedora 32 + @echo "Bug: 1968610" >> $(METADATA) # RHEL 8 rhts-lint $(METADATA) diff --git a/selinux-policy/swap-file-and-systemd-access/PURPOSE b/selinux-policy/swap-file-and-systemd-access/PURPOSE index e92b3f3..83177ef 100644 --- a/selinux-policy/swap-file-and-systemd-access/PURPOSE +++ b/selinux-policy/swap-file-and-systemd-access/PURPOSE @@ -1,5 +1,5 @@ PURPOSE of /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access Author: Milos Malik -SELinux interferes with systemd when accessing a swap file. +SELinux interferes with systemd when accessing swap files or swap partitions. diff --git a/selinux-policy/swap-file-and-systemd-access/main.fmf b/selinux-policy/swap-file-and-systemd-access/main.fmf index b2d17da..bf8ed59 100644 --- a/selinux-policy/swap-file-and-systemd-access/main.fmf +++ b/selinux-policy/swap-file-and-systemd-access/main.fmf @@ -1,2 +1,53 @@ -path: /selinux-policy/swap-file-and-systemd-access -tier: 2 +summary: SELinux interferes with systemd when accessing a swap file +description: |+ + SELinux interferes with systemd when accessing swap files or swap partitions. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux-utils + - policycoreutils + - selinux-policy + - setools-console + - systemd + - util-linux + - binutils +environment: + AVC_ERROR: +no_avc_check + REAL_SCENARIOS: 'false' +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1367279 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1797543 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1798872 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1845594 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1850177 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1912385 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1926536 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928539 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1968610 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1890884 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0605834 +extra-summary: /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access +extra-task: /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access +id: 00f29f1a-3bbb-4775-84b9-c7d524ea1b6b diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh index 6ce368d..3c04729 100755 --- a/selinux-policy/swap-file-and-systemd-access/runtest.sh +++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh @@ -26,11 +26,14 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -REAL_SCENARIOS=${REAL_SCENARIOS:-true} +# The real scenario phase is not executed by default, because some +# machines do not survive the start of systemd-hybrid-sleep or +# systemd-hibernate services, even though their configuration contains +# PrivateDevices=yes. Override is possible by setting REAL_SCENARIOS=true. +REAL_SCENARIOS=${REAL_SCENARIOS:-false} rlJournalStart if ! seinfo -t | grep -q systemd_sleep ; then @@ -38,7 +41,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -79,6 +82,17 @@ rlJournalStart rlPhaseEnd fi + rlPhaseStartTest "bz#1912385 + bz#1926536 + bz#1928539" + rlSESearchRule "allow systemd_sleep_t fixed_disk_device_t : blk_file { getattr } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1968610" + rlSEMatchPathCon "/sys/power" "sysfs_t" + rlSEMatchPathCon "/sys/power/state" "sysfs_t" + rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { add_name write } [ ]" + rlSESearchRule "allow systemd_sleep_t sysfs_t : file { create } [ ]" + rlPhaseEnd + if ${REAL_SCENARIOS} ; then rlPhaseStartTest "real scenario" rlRun "rm -f /swapfile" diff --git a/selinux-policy/switcheroo-control-and-similar/Makefile b/selinux-policy/switcheroo-control-and-similar/Makefile new file mode 100644 index 0000000..1174fbd --- /dev/null +++ b/selinux-policy/switcheroo-control-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +# Description: SELinux interferes with switcheroo-control and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with switcheroo-control and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: switcheroo-control" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console switcheroo-control python3-gobject-base /usr/sbin/service gdm" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-24268" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-93335" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-93535" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/switcheroo-control-and-similar/PURPOSE b/selinux-policy/switcheroo-control-and-similar/PURPOSE new file mode 100644 index 0000000..4738c63 --- /dev/null +++ b/selinux-policy/switcheroo-control-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +Author: Milos Malik + +SELinux interferes with switcheroo-control and related programs. + diff --git a/selinux-policy/switcheroo-control-and-similar/main.fmf b/selinux-policy/switcheroo-control-and-similar/main.fmf new file mode 100644 index 0000000..6db9ecc --- /dev/null +++ b/selinux-policy/switcheroo-control-and-similar/main.fmf @@ -0,0 +1,49 @@ +summary: SELinux interferes with switcheroo-control and related programs +description: |+ + SELinux interferes with switcheroo-control and related programs + +contact: Milos Malik +component: + - selinux-policy + - switcheroo-control +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - switcheroo-control + - python3-gobject-base + - /usr/sbin/service + - gdm +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-24268 + - verifies: https://issues.redhat.com/browse/RHEL-93335 + - verifies: https://issues.redhat.com/browse/RHEL-93535 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the switcheroo-control package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +extra-task: /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +extra-nitrate: TC#0617899 +id: b03995ad-99dc-46ae-a584-d860d8777b74 diff --git a/selinux-policy/switcheroo-control-and-similar/runtest.sh b/selinux-policy/switcheroo-control-and-similar/runtest.sh new file mode 100755 index 0000000..3d972e1 --- /dev/null +++ b/selinux-policy/switcheroo-control-and-similar/runtest.sh @@ -0,0 +1,113 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +# Description: SELinux interferes with switcheroo-control and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/switcheroo-control" +SERVICE_PACKAGE="switcheroo-control" +SERVICE_NAME="switcheroo-control" +PROCESS_NAME="switcheroo-control" +if seinfo -t | grep -q switcheroo ; then + PROCESS_CONTEXT="switcheroo_control_t" + FILE_CONTEXT="switcheroo_control_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlServiceStart gdm + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if seinfo -t | grep -q switcheroo ; then + rlPhaseStartTest "RHEL-24268" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSEMatchPathCon "/run/udev/" "udev_var_run_t" + rlSEMatchPathCon "/run/dbus/" "system_dbusd_var_run_t" + rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t" + rlSESearchRule "allow switcheroo_control_t udev_var_run_t : dir { search } [ ]" + rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : netlink_kobject_uevent_socket { create setopt bind getattr } [ ]" + rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : capability2 { bpf } [ ]" + rlSESearchRule "allow switcheroo_control_t sysfs_t : dir { read } [ ]" + rlSESearchRule "allow switcheroo_control_t sysfs_t : lnk_file { getattr read } [ ]" + rlSESearchRule "allow switcheroo_control_t sysfs_t : file { getattr open read } [ ]" + rlSESearchRule "allow switcheroo_control_t system_dbusd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : sock_file { write } [ ]" + rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : dir { search } [ ]" + rlSESearchRule "allow switcheroo_control_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]" + rlSESearchRule "allow system_dbusd_t switcheroo_control_t : dbus { send_msg } [ ]" + rlSESearchRule "allow unconfined_t switcheroo_control_t : dbus { send_msg } [ ]" + rlSESearchRule "allow switcheroo_control_t unconfined_t : dbus { send_msg } [ ]" + rlPhaseEnd + + if ! rlIsRHEL "<9.7" && ! ( rlIsRHEL 10 && rlIsRHEL "<10.1" ); then + rlPhaseStartTest "RHEL-93335 + RHEL-93535" + rlSESearchRule "allow xdm_t switcheroo_control_t : dbus { send_msg } [ ]" + rlSESearchRule "allow switcheroo_control_t xdm_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "switcherooctl version" + rlRun "switcherooctl list" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlRun "touch ./empty-file" + rlRun "switcherooctl launch ./empty-file" 0,1 + rlRun "rm -f ./empty-file" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/synce4l-and-similar/Makefile b/selinux-policy/synce4l-and-similar/Makefile new file mode 100644 index 0000000..a84a939 --- /dev/null +++ b/selinux-policy/synce4l-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/synce4l-and-similar +# Description: SELinux interferes with synce4l service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/synce4l-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with synce4l service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service synce4l" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2158402" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/synce4l-and-similar/PURPOSE b/selinux-policy/synce4l-and-similar/PURPOSE new file mode 100644 index 0000000..ac65ec7 --- /dev/null +++ b/selinux-policy/synce4l-and-similar/PURPOSE @@ -0,0 +1,4 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/synce4l-and-similar +Description: SELinux interferes with synce4l service and related programs +Author: Milos Malik + diff --git a/selinux-policy/synce4l-and-similar/main.fmf b/selinux-policy/synce4l-and-similar/main.fmf new file mode 100644 index 0000000..e8a6dda --- /dev/null +++ b/selinux-policy/synce4l-and-similar/main.fmf @@ -0,0 +1,43 @@ +summary: SELinux interferes with synce4l service and related programs +description: |+ + SELinux interferes with synce4l service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - synce4l +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +tier: 3 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2158402 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the synce4l package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/synce4l-and-similar +extra-task: /CoreOS/selinux-policy/Regression/synce4l-and-similar +extra-nitrate: TC#0614832 +id: f8bc6347-fce8-458d-b0e3-376cf0c718da diff --git a/selinux-policy/synce4l-and-similar/runtest.sh b/selinux-policy/synce4l-and-similar/runtest.sh new file mode 100755 index 0000000..fefa8f7 --- /dev/null +++ b/selinux-policy/synce4l-and-similar/runtest.sh @@ -0,0 +1,91 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/synce4l-and-similar +# Description: SELinux interferes with synce4l service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/synce4l" +FILE_CONTEXT="bin_t" +SERVICE_PACKAGE="synce4l" +SERVICE_NAME="synce4l" +PROCESS_NAME="synce4l" +PROCESS_CONTEXT="unconfined_service_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/synce4l.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2158402" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + BOOLEANS="[ ]" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if grep -q _cmd /etc/synce4l.conf ; then + rlRun "sed -i 's/^\(.*_cmd\) .*$/\1 echo 0/' /etc/synce4l.conf" + rlRun "grep _cmd /etc/synce4l.conf" + fi + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-bootchart-and-similar/main.fmf b/selinux-policy/systemd-bootchart-and-similar/main.fmf index 4b59e45..ca2e193 100644 --- a/selinux-policy/systemd-bootchart-and-similar/main.fmf +++ b/selinux-policy/systemd-bootchart-and-similar/main.fmf @@ -1,2 +1,42 @@ -path: /selinux-policy/systemd-bootchart-and-similar -tier: 2 +summary: SELinux interferes with systemd-bootchart and related programs +description: |+ + SELinux interferes with systemd-bootchart and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - initscripts + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd-bootchart +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: false +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1757050 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838163 +adjust+: + - enabled: true + when: distro == fedora + because: the systemd-bootchart package is not available elsewhere +extra-nitrate: TC#0608092 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar +id: 63b5a536-231a-44f8-931a-24d737c86359 diff --git a/selinux-policy/systemd-bootchart-and-similar/runtest.sh b/selinux-policy/systemd-bootchart-and-similar/runtest.sh index 8577ea3..c650b15 100755 --- a/selinux-policy/systemd-bootchart-and-similar/runtest.sh +++ b/selinux-policy/systemd-bootchart-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -51,7 +50,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -76,15 +75,17 @@ rlJournalStart rlSESearchRule "allow syslogd_t systemd_bootchart_tmpfs_t : file { getattr read write map } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-creds/Makefile b/selinux-policy/systemd-creds/Makefile new file mode 100644 index 0000000..83eda9d --- /dev/null +++ b/selinux-policy/systemd-creds/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-creds +# Description: SELinux interferes with services which use credentials +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-creds +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE dmesg.service + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with services which use credentials" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2096857" >> $(METADATA) # Fedora 36 + @echo "Bug: 2097681" >> $(METADATA) # Fedora 36 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-creds/PURPOSE b/selinux-policy/systemd-creds/PURPOSE new file mode 100644 index 0000000..ca6475f --- /dev/null +++ b/selinux-policy/systemd-creds/PURPOSE @@ -0,0 +1,9 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-creds +Author: Milos Malik + +SELinux interferes with services which use credentials: + * LoadCredential= + * LoadCredentialEncrypted= + +More about this systemd feature can be found at https://systemd.io/CREDENTIALS/ + diff --git a/selinux-policy/systemd-creds/dmesg.service b/selinux-policy/systemd-creds/dmesg.service new file mode 100644 index 0000000..661f441 --- /dev/null +++ b/selinux-policy/systemd-creds/dmesg.service @@ -0,0 +1,4 @@ +[Service] +ExecStart=/usr/bin/dmesg +LoadCredentialEncrypted=bar:/bar + diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf new file mode 100644 index 0000000..79d9e67 --- /dev/null +++ b/selinux-policy/systemd-creds/main.fmf @@ -0,0 +1,40 @@ +summary: SELinux interferes with services which use credentials +description: |+ + SELinux interferes with services which use credentials + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - targeted + - NoRHIVOS + - avoidImageMode +tier: 2 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the systemd-creds program is not available there +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096857 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2097681 +extra-nitrate: TC#0613921 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-creds +extra-task: /CoreOS/selinux-policy/Regression/systemd-creds +id: 01fe9246-a9bf-4424-8c76-db4f214ca5a7 diff --git a/selinux-policy/systemd-creds/runtest.sh b/selinux-policy/systemd-creds/runtest.sh new file mode 100755 index 0000000..6b66567 --- /dev/null +++ b/selinux-policy/systemd-creds/runtest.sh @@ -0,0 +1,82 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-creds +# Description: SELinux interferes with services which use credentials +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlRun "cp dmesg.service /etc/systemd/system/" + rlRun "systemctl daemon-reload" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2096857 + bz#2097681" + rlSEMatchPathCon "/usr/bin/systemd-creds" "bin_t" + rlSEMatchPathCon "/dev/shm" "tmpfs_t" + rlSESearchRule "allow init_t tmpfs_t : file { read write open setattr rename create } [ ]" + rlPhaseEnd + + rlPhaseStartTest "a systemd service loading credentials" + rlRun "setsebool daemons_use_tty on" + rlRun "echo hello > /foo" + rlRun "ls -alZ /foo" + rlRun "systemd-creds encrypt /foo /bar" + rlRun "ls -alZ /bar" + rlRun "systemctl start dmesg.service" 0-255 + rlRun "systemctl status dmesg.service" 0-255 + rlRun "systemctl stop dmesg.service" 0-255 + rlRun "systemctl status dmesg.service" 0-255 + rlRun "rm -f /foo /bar" + rlRun "systemd-run -P --wait -p LoadCredential=abc:/etc/hosts systemd-creds cat abc" + rlRun "setsebool daemons_use_tty off" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlRun "rm -f /etc/systemd/system/dmesg.service" + rlRun "systemctl daemon-reload" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-generators/71-default-off.network b/selinux-policy/systemd-generators/71-default-off.network new file mode 100644 index 0000000..bb9ad91 --- /dev/null +++ b/selinux-policy/systemd-generators/71-default-off.network @@ -0,0 +1,14 @@ +# Automatically generated by systemd-network-generator + +[Match] +Kind=!* +Type=!loopback + +[Link] + +[Network] +DHCP=no +LinkLocalAddressing=no +IPv6AcceptRA=no + +[DHCP] diff --git a/selinux-policy/systemd-generators/71-default.network b/selinux-policy/systemd-generators/71-default.network new file mode 100644 index 0000000..c94c3cb --- /dev/null +++ b/selinux-policy/systemd-generators/71-default.network @@ -0,0 +1,13 @@ +# Automatically generated by systemd-network-generator + +[Match] +Kind=!* +Type=!loopback + +[Link] + +[Network] +DHCP=ipv4 +DNS=8.8.8.8 + +[DHCP] diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile new file mode 100644 index 0000000..f2b644f --- /dev/null +++ b/selinux-policy/systemd-generators/Makefile @@ -0,0 +1,85 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/systemd-generators +# Description: Testing systemd system generators which are SELinux confined +# Author: Zdenek Pytela +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/systemd-generators +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE 71-default.network 71-default-off.network mnt-loop.mount tty.conf + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Zdenek Pytela " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Testing SELinux confined systemd system generators" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: nfs-utils" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: zram-generator" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Environment: SYSTEMD_PAGER=\"\"" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Releases: -RHEL5" >> $(METADATA) + @echo "Releases: -RHEL6" >> $(METADATA) + @echo "Releases: -RHEL7" >> $(METADATA) + @echo "Bug: 2230226" >> $(METADATA) # Fedora 39 + @echo "Bug: RHEL-72549" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-75879" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-98656" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-100415" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-100721" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-111556" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-generators/PURPOSE b/selinux-policy/systemd-generators/PURPOSE new file mode 100644 index 0000000..7300302 --- /dev/null +++ b/selinux-policy/systemd-generators/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/systemd-generators +Author: Zdenek Pytela + +Test systemd system generators which are SELinux confined and show all installed generators. + diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf new file mode 100644 index 0000000..f1e9d66 --- /dev/null +++ b/selinux-policy/systemd-generators/main.fmf @@ -0,0 +1,51 @@ +summary: Systemd system generators +description: |+ + Testing systemd system generators which are SELinux confined + +contact: Zdenek Pytela +component: + - selinux-policy + - systemd +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux-utils + - nfs-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - zram-generator +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TierCandidatesPASS + - f32friendly + - targeted + - NoRHIVOS + - avoidImageMode +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226 + - verifies: https://issues.redhat.com/browse/RHEL-72549 + - verifies: https://issues.redhat.com/browse/RHEL-75879 + - verifies: https://issues.redhat.com/browse/RHEL-98656 + - verifies: https://issues.redhat.com/browse/RHEL-100415 + - verifies: https://issues.redhat.com/browse/RHEL-100721 + - verifies: https://issues.redhat.com/browse/RHEL-111556 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0617500 +id: f92a6183-91e3-407a-9ac7-9b7df460109a diff --git a/selinux-policy/systemd-generators/mnt-loop.mount b/selinux-policy/systemd-generators/mnt-loop.mount new file mode 100644 index 0000000..840dd8c --- /dev/null +++ b/selinux-policy/systemd-generators/mnt-loop.mount @@ -0,0 +1,12 @@ +# Automatically generated by systemd-fstab-generator + +[Unit] +Documentation=man:fstab(5) man:systemd-fstab-generator(8) +SourcePath=/tmp/fstab +Before=local-fs.target +After=blockdev@dev-loop17.target + +[Mount] +What=/dev/loop17 +Where=/mnt/loop +Type=ext4 diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh new file mode 100755 index 0000000..e6a2405 --- /dev/null +++ b/selinux-policy/systemd-generators/runtest.sh @@ -0,0 +1,276 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/systemd-generators +# Description: Testing systemd system generators which are SELinux confined +# Author: Zdenek Pytela +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SD_SYSTEM_GENERATOR_PATH="/usr/lib/systemd/system-generators /usr/local/lib/systemd/system-generators /etc/systemd/system-generators /run/systemd/system-generators" +SD_SYSTEM_GENERATORS="" + +# To make testing easier, systemd implements various tweaks into its services: +# - variables like SYSTEMD_FSTAB or SYSTEMD_PROC_CMDLINE can be used to point to files +# which will be taken into account instead of the original ones +# - SYSTEMD_IN_INITRD=1 forges being executed in initial ramdisk +# - network generator accepts position arguments as proc-command-line entries +# systemd-network-generator [OPTIONS...] [-- KERNEL_CMDLINE] + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + ### Information about the system (release, systemd and policy versions) + rlPhaseStartTest "Display basic system information" + rlRun "cat /etc/system-release" + rlRun "uname -a" + rlRun "rpm -qa \"systemd*\"|sort" + rlRun "rpm -qa \"selinux-*\" \"*-selinux\" | sort" + rlPhaseEnd + + ### Look for executables in the directories for systemd-system-generators + rlPhaseStartTest "Find all generators" + for dir in ${SD_SYSTEM_GENERATOR_PATH}; do + [ -d "${dir}" ] || continue + for file in ${dir}/*; do + FILEPATH=$(realpath "${file}") + [ "$?" = 0 ] || continue + [ -x "$FILEPATH" ] || continue + CONTEXT=$(stat -c"%C" "${FILEPATH}") + [ "$?" = 0 ] || continue + if [[ ${CONTEXT} =~ ":init_exec_t:" ]] || [[ ${CONTEXT} =~ ":lib_t:" ]] || [[ ${CONTEXT} =~ ":usr_t:" ]] || [[ ${CONTEXT} =~ ":systemd_generic_generator_exec_t:" ]] + then + SD_SYSTEM_GENERATORS_NOTCONFINED="${SD_SYSTEM_GENERATORS_NOTCONFINED} $FILEPATH" + else + SD_SYSTEM_GENERATORS="${SD_SYSTEM_GENERATORS} $FILEPATH" + fi + done + done + echo "List of confined generators:" + echo "${SD_SYSTEM_GENERATORS}" + echo "List of non-confined generators:" + echo "${SD_SYSTEM_GENERATORS_NOTCONFINED}" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/systemd-networkd.service ] ; then + + ### network-generator actually is a service, not a generator + # systemd-network-generator.service is a system service that translates ip= and the + # related settings on the kernel command line (see below) into systemd.network(5), + # systemd.netdev(5), and systemd.link(5) configuration files + rlPhaseStartTest "systemd-network-generator" + rlRun "systemd-run -u sdng-manual.service /usr/lib/systemd/systemd-network-generator -- nameserver=8.8.8.8 ip=dhcp" + rlRun "journalctl -u sdng-manual.service" + rlRun "systemctl restart systemd-networkd" + rlRun "systemctl status systemd-networkd" + rlRun "networkctl" + rlRun "diff /run/systemd/network/71-default.network 71-default.network" + rlPhaseEnd + + rlPhaseStartTest "systemd-network-generator: ip=off" + rlRun "systemd-run -u sdng-manual-off.service /usr/lib/systemd/systemd-network-generator -- ip=off" + rlRun "journalctl -u sdng-manual-off.service" + rlRun "systemctl restart systemd-networkd" + rlRun "systemctl status systemd-networkd" + rlRun "networkctl" + rlRun "diff /run/systemd/network/71-default.network 71-default-off.network" + rlPhaseEnd + + fi + + ### fstab-generator + # systemd-fstab-generator is a generator that translates /etc/fstab (see fstab(5) + # for details) into native systemd units early at boot and when configuration of + # the system manager is reloaded. This will instantiate mount and swap + # units as necessary. + + # fstab-generator 1 - use /etc/fstab + rlPhaseStartTest "systemd-fstab-generator /etc" + rlFileBackup "/etc/fstab" + rlRun "mkdir -p /newproc" + rlRun "echo \"/proc /newproc none bind 0 0\" >> /etc/fstab" + rlRun "SYSTEMD_LOG_LEVEL=debug systemd-run -u sdfg-manual.service /usr/lib/systemd/system-generators/systemd-fstab-generator /run/systemd/generator" + rlRun "journalctl -u sdfg-manual.service" + rlRun "systemctl daemon-reload" + rlRun "systemctl start newproc.mount" + rlRun "systemctl status newproc.mount" + rlRun "ls -lZd /newproc/1" + rlRun "systemctl stop newproc.mount" + rlPhaseEnd + + # fstab-generator 2 - use a local fstab-like file + rlPhaseStartTest "systemd-fstab-generator /tmp" + rlRun "> /tmp/fstab" + rlRun "echo \"/dev/loop17 /mnt/loop ext4 defaults 0 0\" >> /tmp/fstab" + rlRun "mkdir -p /mnt/loop" + rlRun "chcon --reference /etc/fstab /tmp/fstab" + rlRun "dd if=/dev/zero of=/tmp/loopfile bs=16M count=1" + rlRun "chcon -t user_tmp_t /tmp/loopfile" + rlRun "losetup /dev/loop17 /tmp/loopfile" + rlRun "losetup -j /tmp/loopfile" + rlRun "mkfs.ext4 /dev/loop17" + rlRun "systemd-run -E SYSTEMD_FSTAB=/tmp/fstab -u sdfg-tmpfstab.service /usr/lib/systemd/system-generators/systemd-fstab-generator /run/systemd/generator" + rlRun "diff /run/systemd/generator/mnt-loop.mount mnt-loop.mount" + rlRun "ls -lZa /mnt/loop" + rlPhaseEnd + + # fstab-generator 3: nfs + + ### gpt-generator + #rlPhaseStartTest "systemd-gpt-generator" + #rlPhaseEnd + + ### nfs-generator + # 7a76dc1c4eba7a6cd3b59cdd40b6b4bd90312e07 needs to be reverted + #rlPhaseStartTest "systemd-nfs-generator" + #rlPhaseEnd + + ### systemd-rc-local-generator + # systemd-rc-local-generator is a generator that checks whether /etc/rc.d/rc.local + # exists and is executable, and if it is, pulls the rc-local.service unit into the + # boot process. + # the service unit file already exists: /usr/lib/systemd/system/rc-local.service + # the generator just creates + # /run/systemd/generator/multi-user.target.wants/rc-local.service symlink + rlPhaseStartTest "systemd-rc-local-generator" + if [ -x /usr/lib/systemd/system-generators/systemd-rc-local-generator ]; then + cat > /etc/rc.d/rc.local << EOF +#!/bin/bash +echo "This is a script to check rc-local generator." +EOF + rlRun "chmod +x /etc/rc.d/rc.local" + rlRun "restorecon -v /etc/rc.d/rc.local" + rlRun "systemd-run -u sdrg-manual.service /usr/lib/systemd/system-generators/systemd-rc-local-generator /run/systemd/generator" + rlRun "journalctl -u sdrg-manual.service" + rlRun "systemctl daemon-reload" + rlRun "systemctl start rc-local.service" + rlRun "systemctl status rc-local.service" + rlRun "systemctl stop rc-local.service" + fi + rlPhaseEnd + + ### sysv-generator + # systemd-sysv-generator is a generator that creates wrapper .service units + # for SysV init[1] scripts in /etc/init.d/* at boot and when configuration + # of the system manager is reloaded. + rlPhaseStartTest "systemd-sysv-generator" + if [ -x /usr/lib/systemd/system-generators/systemd-sysv-generator ]; then + cat > /etc/rc.d/init.d/sysv-generator-test.sh << EOF +#!/bin/bash +echo "This is a script to check sysv generator." +EOF + rlRun "chmod +x /etc/rc.d/init.d/sysv-generator-test.sh" + rlRun "restorecon -Fv /etc/rc.d/init.d/sysv-generator-test.sh" + rlRun "systemd-run -u sdsg-manual.service /usr/lib/systemd/system-generators/systemd-sysv-generator /run/systemd/generator /run/systemd/generator.early /run/systemd/generator.late" + rlRun "journalctl -u sdsg-manual.service" + rlRun "systemctl daemon-reload" + rlRun "systemctl start sysv-generator-test.service" + rlRun "systemctl status sysv-generator-test.service" + rlRun "systemctl stop sysv-generator-test.service" + fi + rlPhaseEnd + + if rlIsCentOS 10 || rlIsRHEL 10 ; then + rlPhaseStartTest "RHEL-72549" + rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-ssh-generator" "systemd_ssh_generator_exec_t" + rlSEMatchPathCon "/dev/vsock" "vsock_device_t" + rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_generator_unit_file_t" + rlSESearchRule "allow init_t systemd_ssh_generator_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition init_t systemd_ssh_generator_exec_t : process systemd_ssh_generator_t" + rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]" + rlSESearchRule "allow systemd_ssh_generator_t systemd_unit_file_t : file { create getattr write open } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-75879" + rlRun "seinfo -a systemd_generator -x" + rlSESearchRule "allow systemd_fstab_generator_t syslogd_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-98656" + rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-cryptsetup-generator" "systemd_cryptsetup_generator_exec_t" + rlSESearchRule "allow systemd_cryptsetup_generator_t systemd_unit_file_t : file { getattr create open write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-100415 + RHEL-100721" + rlSEMatchPathCon "/usr/lib/systemd/system-generators/vsftpd-generator" "systemd_vsftpd_generator_exec_t" + rlSESearchRule "allow systemd_vsftpd_generator_t bin_t : file { execute execute_no_trans map } [ ]" + rlPhaseEnd + fi + + if seinfo -a | grep -q systemd_generator ; then + rlPhaseStartTest "RHEL-111556" + rlSEMatchPathCon "/usr/lib/systemd/system-generators/nfs-server-generator" "systemd_nfs_generator_exec_t" + rlSESearchRule "allow init_t systemd_nfs_generator_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "type_transition init_t systemd_nfs_generator_exec_t : process systemd_nfs_generator_t" + rlSESearchRule "allow init_t systemd_nfs_generator_t : process { transition } [ ]" + rlSESearchRule "allow systemd_nfs_generator_t systemd_nfs_generator_t : udp_socket { getattr create setopt connect } [ ]" + rlPhaseEnd + fi + + ### generators from other packages: install them all? + # dnf install "/usr/lib/systemd/system-generators/*" + # cloud-init-generator nfs-server-generator rpc-pipefs-generator selinux-autorelabel-generator.sh zram-generator + # cloud-init nfs-utils policycoreutils zram-generator + + ### selinux-autorelabel-generator + # This systemd.generator(7) detects if SELinux is running and if the + # user requested an autorelabel, and if so sets the default target to + # selinux-autorelabel.target. + rlPhaseStartTest "selinux-autorelabel-generator" + rlFileBackup "/etc/selinux/config" + rlRun "echo AUTORELABEL=0 >> /etc/selinux/config" + rlRun "touch /.autorelabel" + rlRun "SYSTEMD_LOG_LEVEL=debug systemd-run -u sdsa-manual.service /usr/lib/systemd/system-generators/selinux-autorelabel-generator.sh /run/systemd/generator /run/systemd/generator.early /run/systemd/generator.late" + rlRun "journalctl -u sdsa-manual.service" + rlRun "test \"$(readlink /run/systemd/generator.early/default.target)\" = \"/usr/lib/systemd/system/selinux-autorelabel.target\"" + rlRun "diff /run/systemd/generator.early/selinux-autorelabel.service.d/tty.conf tty.conf" + rlPhaseEnd + + ### cleanup, restoring the previous content + # re-run again all generators as an effect of daemon-reload; + # changes which used special systemd variables will go away + rlPhaseStartCleanup + sleep 2 + rlRun "rmdir /mnt/loop" + rlRun "losetup -d /dev/loop17" + rlRun "rm -f /dev/loop17" + rlRun "rm /tmp/loopfile" + rlFileRestore + # fixme: remove non-natural generators + rlRun "systemctl daemon-reload" + rlSECheckAVC + rlPhaseEnd + rlJournalPrintText +rlJournalEnd diff --git a/selinux-policy/systemd-generators/tty.conf b/selinux-policy/systemd-generators/tty.conf new file mode 100644 index 0000000..f0d8106 --- /dev/null +++ b/selinux-policy/systemd-generators/tty.conf @@ -0,0 +1,2 @@ +[Service] +StandardInput=tty diff --git a/selinux-policy/systemd-homed/Makefile b/selinux-policy/systemd-homed/Makefile index d067913..5b03c59 100644 --- a/selinux-policy/systemd-homed/Makefile +++ b/selinux-policy/systemd-homed/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 1h" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit expect initscripts systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) + @echo "Requires: audit expect /usr/sbin/service systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -64,6 +64,11 @@ $(METADATA): Makefile @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) @echo "Bug: 1809878" >> $(METADATA) # Fedora 32 + @echo "Bug: 2036108" >> $(METADATA) # Fedora 42 + @echo "Bug: 2315087" >> $(METADATA) # Fedora 41 + @echo "Bug: 2316163" >> $(METADATA) # Fedora 41 + @echo "Bug: 2315812" >> $(METADATA) # Fedora 42 + @echo "Bug: 2315587" >> $(METADATA) # Fedora 41 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index 2858935..e726217 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -1,10 +1,40 @@ -path: /selinux-policy/systemd-homed -summary: Test homectl utility and its sub-commands to verify AVC denials -description: | - Test coverage for SELinux AVC issues associated with systemd-homed - service. The homectl program calls the systemd-homed service, which - is not yet confined, but it triggers SELinux denials. This test suite - covers command homectl with its subcommands and checks for avc denials. -adjust: -- enabled: false - when: distro < rhel-9 +summary: Tests for systemd-homed service +contact: Amith Kumar +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - expect + - /usr/sbin/service + - systemd + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 1h +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1809878 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2036108 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315087 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315587 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315812 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2316163 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10 + because: the systemd-homed program is not available there +extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed +extra-task: /CoreOS/selinux-policy/Regression/systemd-homed +extra-nitrate: TC#0614608 +id: 880ecade-0976-4303-a521-aead43e7f8c7 +tag: + - failinfedora + - NoRHIVOS diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index 7c0a45f..0776bb8 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -27,19 +27,22 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE1="selinux-policy" PACKAGE2="systemd" +INSTALL_OPTION="" +if dnf install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi function create_u() { expect -f - <<<' set timeout -1 spawn homectl create test_u --disk-size=500M - expect "*: " + expect "*test_u: " send -- "Red_123hat\r" - expect "*: " + expect "*test_u*: " send -- "Red_123hat\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break @@ -75,10 +78,12 @@ function passwd_u() { expect -f - <<<' set timeout -1 spawn homectl passwd test_u - expect "*: " + expect "*test_u: " send -- "Sim_123pl1\r" - expect "*: " + expect "*test_u*: " send -- "Sim_123pl1\r" + expect "*test_u: " + send -- "Red_123hat\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break exit $value @@ -89,7 +94,7 @@ function auth_u() { expect -f - <<<' set timeout -1 spawn homectl authenticate test_u - expect "*: " + expect "*test_u: " send -- "Sim_123pl1\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break @@ -101,7 +106,7 @@ function resize_u() { expect -f - <<<' set timeout -1 spawn homectl resize test_u 425.0M - expect "*: " + expect "*test_u: " send -- "Sim_123pl1\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break @@ -110,8 +115,14 @@ expect -f - <<<' } rlJournalStart + if ! seinfo -t systemd_homed_t | grep -q systemd_homed_t ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE1} rlAssertRpm ${PACKAGE1}-targeted @@ -120,12 +131,13 @@ rlJournalStart rlSEStatus rlSESetTimestamp sleep 2 + rlRun "systemctl enable systemd-homed" rlPhaseEnd rlPhaseStartTest "homectl create" rlRun "create_u" - rlRun "ausearch -m AVC -m USER_AVC -c systemd-homed -f mail" 1 - rlRun "ausearch -m AVC -m USER_AVC -c systemd-homewor" 1 + rlRun "ausearch -m AVC -m USER_AVC -c systemd-homed -f mail --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC -c systemd-homewor --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl list" @@ -133,7 +145,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl list" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl activate" @@ -141,15 +153,15 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "activate_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl inspect" sleep 20 tst_Time="$(date '+%T')" - rlRun "homectl inspect test_u" + rlRun "homectl inspect test_u --no-pager" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl update" @@ -157,7 +169,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl update test_u --email-address=test_u@redhat.com" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl lock" @@ -165,7 +177,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl lock test_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl unlock" @@ -173,7 +185,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "unlock_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl passwd" @@ -181,7 +193,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "passwd_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl authenticate" @@ -189,7 +201,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "auth_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl deactivate and resize" @@ -199,7 +211,7 @@ rlJournalStart sleep 60 rlRun "resize_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl remove" @@ -207,10 +219,19 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl remove test_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlPhaseEnd + + rlPhaseStartTest "bz#2036108 + bz#2315087" + rlSEMatchPathCon "/usr/lib/systemd/systemd-homed" "systemd_homed_exec_t" + rlSEMatchPathCon "/var/cache/systemd/" "systemd_cache_t" + rlSEMatchPathCon "/var/cache/systemd/home/" "systemd_homed_cache_t" + rlSESearchRule "allow systemd_homed_t systemd_homed_cache_t : dir { read } [ ]" + rlRun "service systemd-homed restart" rlPhaseEnd rlPhaseStartCleanup + rlRun "systemctl disable systemd-homed" sleep 2 rlSECheckAVC rlRun "rm -f /tmp/avcfile" diff --git a/selinux-policy/systemd-importd-and-similar/Makefile b/selinux-policy/systemd-importd-and-similar/Makefile new file mode 100644 index 0000000..dc0acf1 --- /dev/null +++ b/selinux-policy/systemd-importd-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-importd-and-similar +# Description: SELinux interferes with systemd-importd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-importd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-importd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd systemd-container /usr/sbin/service shadow-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-98490" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-importd-and-similar/PURPOSE b/selinux-policy/systemd-importd-and-similar/PURPOSE new file mode 100644 index 0000000..9be09c0 --- /dev/null +++ b/selinux-policy/systemd-importd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-importd-and-similar +Author: Milos Malik + +SELinux interferes with systemd-importd and related programs. + diff --git a/selinux-policy/systemd-importd-and-similar/main.fmf b/selinux-policy/systemd-importd-and-similar/main.fmf new file mode 100644 index 0000000..5754646 --- /dev/null +++ b/selinux-policy/systemd-importd-and-similar/main.fmf @@ -0,0 +1,44 @@ +summary: SELinux interferes with systemd-importd and related programs +description: |+ + SELinux interferes with systemd-importd and related programs. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service + - shadow-utils + - systemd-container +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - failinfedora + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-98490 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + because: the systemd-importd program is not available there +extra-nitrate: TC#0619330 +id: b692e9f4-64d8-4cb3-bba9-f4281d8075a2 diff --git a/selinux-policy/systemd-importd-and-similar/runtest.sh b/selinux-policy/systemd-importd-and-similar/runtest.sh new file mode 100755 index 0000000..c61d8c9 --- /dev/null +++ b/selinux-policy/systemd-importd-and-similar/runtest.sh @@ -0,0 +1,102 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-importd-and-similar +# Description: SELinux interferes with systemd-importd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/lib/systemd/systemd-importd" +FILE_CONTEXT="systemd_importd_exec_t" +SERVICE_PACKAGE="systemd-container" +SERVICE_NAME="systemd-importd" +PROCESS_NAME="systemd-importd" +PROCESS_CONTEXT="systemd_importd_t" + +rlJournalStart + if [ ! -f /usr/lib/systemd/systemd-importd ] ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + fi + + if rlIsRHEL 10 || rlIsCentOS 10 || rlIsFedora ; then + rlPhaseStartTest "RHEL-98490" + rlSEMatchPathCon "/run/systemd/io.systemd.Import" "init_var_run_t" + rlSESearchRule "allow systemd_importd_t init_var_run_t : sock_file { create unlink } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-journal-upload/Makefile b/selinux-policy/systemd-journal-upload/Makefile new file mode 100644 index 0000000..2ede7ea --- /dev/null +++ b/selinux-policy/systemd-journal-upload/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-journal-upload +# Description: SELinux interferes with systemd-journal-upload and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-journal-upload +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x runtest.sh || chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-localed and localectl" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service systemd-journal-remote" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-57774" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-62196" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-journal-upload/main.fmf b/selinux-policy/systemd-journal-upload/main.fmf new file mode 100644 index 0000000..d286ba5 --- /dev/null +++ b/selinux-policy/systemd-journal-upload/main.fmf @@ -0,0 +1,42 @@ +summary: SELinux interferes with systemd-journal-upload and related programs +test: ./runtest.sh +framework: beakerlib +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - systemd-journal-remote +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-57774 + - verifies: https://issues.redhat.com/browse/RHEL-62196 +adjust+: + - enabled: false + when: distro < rhel-9.7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-journal-upload +extra-task: /CoreOS/selinux-policy/Regression/systemd-journal-upload +extra-nitrate: TC#0617895 +id: 70a20eff-d2b4-458c-84e8-8e6f18a71d84 diff --git a/selinux-policy/systemd-journal-upload/runtest.sh b/selinux-policy/systemd-journal-upload/runtest.sh new file mode 100755 index 0000000..fe8367e --- /dev/null +++ b/selinux-policy/systemd-journal-upload/runtest.sh @@ -0,0 +1,58 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd-journal-remote" +SERVICE_NAME="systemd-journal-upload" +PROCESS_NAME="systemd-journal-upload" +PROCESS_CONTEXT="systemd_journal_upload_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "RHEL-57774 + RHEL-62196" + rlSEMatchPathCon "/usr/lib/systemd/systemd-journal-upload" "systemd_journal_upload_exec_t" + if rlSEDefined "systemd_conf_t" ; then + rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "systemd_conf_t" + rlSESearchRule "allow systemd_journal_upload_t systemd_conf_t : dir { read } [ ]" + else + rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "init_var_run_t" + rlSESearchRule "allow systemd_journal_upload_t init_var_run_t : dir { read } [ ]" + fi + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- RHEL-57774" + rlRun "mkdir -pZ /run/systemd/journal-upload.conf.d" + rlRun "echo -e '[Upload]\nURL=http://localhost/\n' > /run/systemd/journal-upload.conf.d/test.conf" + rlRun "restorecon -Rv /run/systemd" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rm -f /run/systemd/journal-upload.conf.d/test.conf + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalEnd + diff --git a/selinux-policy/systemd-localed/Makefile b/selinux-policy/systemd-localed/Makefile new file mode 100644 index 0000000..8727c1e --- /dev/null +++ b/selinux-policy/systemd-localed/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-localed +# Description: SELinux interferes with systemd-localed and localectl +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-localed +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x runtest.sh || chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-localed and localectl" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service systemd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2240159" >> $(METADATA) # Fedora 38 + @echo "Bug: RHEL-16715" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-16716" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-localed/main.fmf b/selinux-policy/systemd-localed/main.fmf new file mode 100644 index 0000000..5b5fa64 --- /dev/null +++ b/selinux-policy/systemd-localed/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with systemd-localed and localectl +test: ./runtest.sh +framework: beakerlib +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - systemd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2240159 + - verifies: https://issues.redhat.com/browse/RHEL-16715 + - verifies: https://issues.redhat.com/browse/RHEL-16716 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0615919 +id: c61c5a74-f9d6-4d1f-b1cc-a7a25b0f3ec7 diff --git a/selinux-policy/systemd-localed/runtest.sh b/selinux-policy/systemd-localed/runtest.sh new file mode 100755 index 0000000..579438d --- /dev/null +++ b/selinux-policy/systemd-localed/runtest.sh @@ -0,0 +1,55 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop systemd-localed + rlFileBackup --clean --missing-ok /etc/X11/xorg.conf.d + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! ( rlIsRHEL 9 && rlIsRHEL "<9.4" ) ; then + rlPhaseStartTest "bz#2240159 + RHEL-16715 + RHEL-16716" + rlSEMatchPathCon "/usr/lib/systemd/systemd-localed" "systemd_localed_exec_t" + rlSEMatchPathCon "/etc/X11/xorg.conf.d" "xserver_etc_t" + rlSESearchRule "allow systemd_localed_t xserver_etc_t : dir { create } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/systemd-localed.service ] ; then + rlPhaseStartTest "real scenario -- bz#2240159" + if [ -d /etc/X11/xorg.conf.d ] ; then + rlRun "rpm -qf /etc/X11/xorg.conf.d" 0,1 + rlRun "rm -rf /etc/X11/xorg.conf.d" + fi + rlRun "service systemd-localed start" + rlRun "service systemd-localed status" + rlRun "localectl set-x11-keymap us" + rlRun "ls -lZ /etc/X11/xorg.conf.d" + rlRun "service systemd-localed stop" + rlRun "service systemd-localed status" 3 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore systemd-localed + rlPhaseEnd +rlJournalEnd + diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile new file mode 100644 index 0000000..f99a7c8 --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/Makefile @@ -0,0 +1,80 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +# Description: SELinux interferes with systemd-machined and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-machined-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.cil + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-machined and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd-container /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1847545" >> $(METADATA) # Fedora 32 + @echo "Bug: 1900869" >> $(METADATA) # Fedora 33 + @echo "Bug: 1900888" >> $(METADATA) # Fedora 35 + @echo "Bug: RHEL-49567" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-74280" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-76352" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-77087" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-78088" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-85379" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-86528" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-105966" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-108849" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-machined-and-similar/PURPOSE b/selinux-policy/systemd-machined-and-similar/PURPOSE new file mode 100644 index 0000000..5f4a9e8 --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +Author: Milos Malik + +SELinux interferes with systemd-machined and related programs. + +Related programs: machinectl. diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf new file mode 100644 index 0000000..b6f7ebe --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -0,0 +1,55 @@ +summary: SELinux interferes with systemd-machined and related programs +description: |+ + SELinux interferes with systemd-machined and related programs. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd-container + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - failinfedora + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1847545 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900869 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900888 + - verifies: https://issues.redhat.com/browse/RHEL-49567 + - verifies: https://issues.redhat.com/browse/RHEL-74280 + - verifies: https://issues.redhat.com/browse/RHEL-76352 + - verifies: https://issues.redhat.com/browse/RHEL-77087 + - verifies: https://issues.redhat.com/browse/RHEL-78088 + - verifies: https://issues.redhat.com/browse/RHEL-85379 + - verifies: https://issues.redhat.com/browse/RHEL-86528 + - verifies: https://issues.redhat.com/browse/RHEL-105966 + - verifies: https://issues.redhat.com/browse/RHEL-108849 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + because: the systemd-machined program is not available there +extra-summary: /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +extra-nitrate: TC#0614355 +id: 3aff16de-7ca9-41eb-9676-9c2236fc92f1 diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh new file mode 100755 index 0000000..4fa2ecf --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -0,0 +1,193 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +# Description: SELinux interferes with systemd-machined and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/lib/systemd/systemd-machined" +FILE_CONTEXT="systemd_machined_exec_t" +SERVICE_PACKAGE="systemd-container" +SERVICE_NAME="systemd-machined" +PROCESS_NAME="systemd-machined" +PROCESS_CONTEXT="systemd_machined_t" +TEST_POLICY_NEEDED=${TEST_POLICY_NEEDED:-false} +INSTALL_OPTION="" +if yum --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if yum install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if yum install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi + +rlJournalStart + if [ ! -f ${FILE_PATH} ] ; then + rlLog "The required program is not installed. Quitting..." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + if rlIsFedora ; then + rlPhaseStartTest "bz#1847545" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1900869 + bz#1900888" + rlSESearchRule "allow system_dbusd_t devpts_t : chr_file { read write } [ ]" + rlSESearchRule "allow systemd_machined_t devpts_t : chr_file { open read write ioctl } [ ]" + rlSESearchRule "allow systemd_machined_t systemd_machined_t : cap_userns { sys_ptrace sys_admin setgid setuid } [ ]" + rlSESearchRule "allow systemd_machined_t tmpfs_t : lnk_file { getattr read } [ ]" + rlSESearchRule "allow systemd_machined_t tmpfs_t : sock_file { write } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : file { getattr open read ioctl } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : lnk_file { getattr read } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "RHEL-49567" + rlSEMatchPathCon "/usr/lib/systemd/systemd-machined" "systemd_machined_exec_t" + if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then + rlSEMatchPathCon "/run/systemd/machine" "systemd_machined_var_run_t" + rlSEMatchPathCon "/run/systemd/machine/io.systemd.Machine" "systemd_machined_var_run_t" + rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : dir { create } [ ]" + rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : sock_file { create unlink } [ ]" + fi + rlRun "machinectl" + rlPhaseEnd + + if rlIsRHEL 10 || rlIsCentOS 10 ; then + rlPhaseStartTest "RHEL-74280" + rlSEMatchPathCon "/dev/vsock" "vsock_device_t" + rlSESearchRule "allow systemd_machined_t vsock_device_t : chr_file { getattr open read ioctl } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL "<9.6" && ! rlIsCentOS 8 ; then + rlPhaseStartTest "RHEL-76352 + RHEL-77087 + RHEL-78088" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : file { getattr open read ioctl } [ ]" + rlSESearchRule "allow systemd_machined_t systemd_machined_t : cap_userns { kill } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL "<9.7" && ! rlIsCentOS 8 ; then + rlPhaseStartTest "RHEL-85379 + RHEL-86528" + rlSESearchRule "allow system_dbusd_t systemd_machined_var_lib_t : dir { read } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- bz#1900869 + bz#1900888" + rlRun "mkdir -pZ /var/lib/machines/test" + rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal ${INSTALL_OPTION}" + rlRun "restorecon -Rv /var/lib/machines" + if ${TEST_POLICY_NEEDED} ; then + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + fi + rlRun "systemctl start systemd-nspawn@test" + rlRun "systemctl status systemd-nspawn@test" + rlRun "ps -efZ | grep -e ${PROCESS_CONTEXT} -e unconfined_service_t" + rlRun "machinectl list" + rlRun "machinectl status test" + rlRun "journalctl -M test --system" + rlRun "journalctl -M test --user" + rlWatchdog "machinectl login test" 20 + rlRun "machinectl list-images" + rlRun "machinectl image-status test" + if rlIsFedora ; then + rlRun "rm -f /tmp/id" + rlRun "machinectl copy-to test /usr/bin/id /tmp/id" + rlRun "machinectl copy-from test /usr/bin/id /tmp/id" + fi + rlRun "machinectl reboot test" + sleep 15 + rlRun "machinectl status test" + rlRun "machinectl kill test" + rlRun "machinectl terminate test" + rlRun "systemctl stop systemd-nspawn@test" + if ${TEST_POLICY_NEEDED} ; then + rlRun "semodule -r testpolicy" + rlRun "semodule -lfull | grep testpolicy" 1 + fi + rlRun "rm -rf /var/lib/machines/test" + rlPhaseEnd + + rlPhaseStartTest "RHEL-105966 + RHEL-108849" + rlRun "mkdir -pZ /var/lib/machines/test" + rlRun "machinectl list-images" + rlRun "machinectl image-status test" + rlRun "rm -rf /var/lib/machines/test" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-machined-and-similar/testpolicy.cil b/selinux-policy/systemd-machined-and-similar/testpolicy.cil new file mode 100644 index 0000000..72b42c7 --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/testpolicy.cil @@ -0,0 +1,14 @@ +( allow systemd_machined_t unconfined_service_t ( dir ( search ))) +( allow systemd_machined_t unconfined_service_t ( file ( getattr open read ioctl ))) +( allow systemd_machined_t unconfined_service_t ( lnk_file ( getattr read ))) +( allow systemd_machined_t systemd_machined_t ( cap_userns ( sys_ptrace sys_admin setgid setuid kill ))) +( allow systemd_machined_t tmpfs_t ( lnk_file ( getattr read ))) +( allow systemd_machined_t devpts_t ( chr_file ( open read write ioctl ))) +( allow systemd_machined_t tmpfs_t ( sock_file ( write ))) +( allow system_dbusd_t devpts_t ( chr_file ( read write ))) +( allow systemd_machined_t unconfined_service_t ( unix_stream_socket ( connectto ))) +( allow systemd_machined_t systemd_unit_file_t ( service ( stop ))) +( allow systemd_machined_t tmp_t ( file ( create getattr open write append ioctl setattr ))) +( allow systemd_machined_t tmpfs_t ( file ( create getattr open write append ioctl setattr ))) +( allow systemd_machined_t systemd_machined_t ( capability ( chown fowner fsetid ))) + diff --git a/selinux-policy/systemd-modules-load-and-similar/Makefile b/selinux-policy/systemd-modules-load-and-similar/Makefile index aeca98e..610e027 100644 --- a/selinux-policy/systemd-modules-load-and-similar/Makefile +++ b/selinux-policy/systemd-modules-load-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console openssh-clients systemd-udev" >> $(METADATA) + @echo "Requires: audit /usr/sbin/service libselinux libselinux-utils policycoreutils rdma-core selinux-policy selinux-policy-targeted setools-console openssh-clients systemd-udev" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -74,7 +74,17 @@ $(METADATA): Makefile @echo "Bug: 1697632" >> $(METADATA) # Fedora 30 @echo "Bug: 1698200" >> $(METADATA) # Fedora 30 @echo "Bug: 1699559" >> $(METADATA) # Fedora 30 + @echo "Bug: 1819161" >> $(METADATA) # Fedora 32 @echo "Bug: 1823246" >> $(METADATA) # RHEL-8 + @echo "Bug: 1824196" >> $(METADATA) # Fedora 32 + @echo "Bug: 1829700" >> $(METADATA) # Fedora 32 + @echo "Bug: 1833502" >> $(METADATA) # Fedora 32 + @echo "Bug: 1838933" >> $(METADATA) # Fedora 32 + @echo "Bug: 1942267" >> $(METADATA) # Fedora 32 + @echo "Bug: 1972372" >> $(METADATA) # RHEL 9 + @echo "Bug: 2088257" >> $(METADATA) # RHEL-9 + @echo "Bug: 2088258" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-54591" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index 4fdb6c5..47cfd95 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -1,2 +1,67 @@ -path: /selinux-policy/systemd-modules-load-and-similar -tier: 2 +summary: SELinux interferes with the systemd-modules-load service and related programs +description: |+ + SELinux interferes with the systemd-modules-load service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - /usr/sbin/service + - libselinux + - libselinux-utils + - policycoreutils + - rdma-core + - selinux-policy + - selinux-policy-targeted + - setools-console + - openssh-clients + - systemd-udev +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - f33friendly + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358526 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358960 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1360157 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1360488 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1437153 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1438253 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1490015 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1493293 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697632 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1698200 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699559 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1819161 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823246 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1824196 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829700 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1833502 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838933 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1942267 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1972372 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1850953 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088257 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088258 + - verifies: https://issues.redhat.com/browse/RHEL-54591 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0607299 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-modules-load-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-modules-load-and-similar +id: d8407e18-66fb-417e-843e-72fb040fb03e diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index b345047..455b6b1 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -42,7 +41,7 @@ KERNEL_MODULE="nf_conntrack_pptp" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -99,17 +98,63 @@ rlJournalStart rlSESearchRule "allow systemd_modules_load_t bin_t : file { execute execute_no_trans map } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#1819161 + bz#1824196 + bz#1829700 + bz#1833502 + bz#1838933 + bz#1972372" + rlSEMatchPathCon "/sys/firmware/efi/efivars" "efivarfs_t" + rlSESearchRule "allow systemd_modules_load_t efivarfs_t : file { getattr open read } [ ]" + rlSESearchRule "allow systemd_resolved_t efivarfs_t : file { getattr open read } [ ]" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" + if ! rlIsRHEL "<9.6" ; then + rlRun "mkdir -p /run/modprobe.d" + rlRun "echo 'blacklist cipher_null' > /run/modprobe.d/test.conf" + rlRun "restorecon -Rv /run/modprobe.d" + fi rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "echo ${KERNEL_MODULE} > /etc/modules-load.d/${KERNEL_MODULE}.conf" rlRun "lsmod" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "lsmod | grep ${KERNEL_MODULE}" - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 rlRun "lsmod" rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf" + rlRun "rm -f /run/modprobe.d/test.conf" rlPhaseEnd + fi + + if modinfo `grep ^ib /etc/rdma/modules/rdma.conf` >& /dev/null ; then + rlPhaseStartTest "bz#1942267" + tst_Time="$(date '+%T')" + # Install kernel-module matching the running kernel version + rlRun "dnf -y install kernel-modules-$(uname -r)" 0,1 + rlRun "systemctl start rdma-load-modules@rdma.service" + rlRun "systemctl status rdma-load-modules@rdma.service" + rlRun "lsmod | grep rdma" + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "systemctl stop rdma-load-modules@rdma.service" + rlPhaseEnd + fi + + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + rlPhaseStartTest "bz#2088257 + bz#2088258" + rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t" + rlSEMatchPathCon "/dev/kmsg" "kmsg_device_t" + rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t" + rlSESearchRule "allow systemd_modules_load_t syslogd_t : unix_dgram_socket { sendto } [ ]" + rlSESearchRule "allow systemd_modules_load_t kmsg_device_t : chr_file { write } [ ]" + rlPhaseEnd + + if ! ( rlIsRHEL 9 && rlIsRHEL "<9.6" ) ; then + rlPhaseStartTest "RHEL-54591" + rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t" + rlSEMatchPathCon "/run/modprobe.d" "modules_conf_t" + rlSEMatchPathCon "/run/modprobe.d/fips.conf" "modules_conf_t" + rlSESearchRule "allow systemd_modules_load_t modules_conf_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-mountfsd-and-similar/Makefile b/selinux-policy/systemd-mountfsd-and-similar/Makefile new file mode 100644 index 0000000..5e6e54e --- /dev/null +++ b/selinux-policy/systemd-mountfsd-and-similar/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +# Description: SELinux interferes with systemd-mountfsd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-mountfsd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd systemd-container /usr/sbin/service nmap-ncat" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9 -RHEL10" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-mountfsd-and-similar/PURPOSE b/selinux-policy/systemd-mountfsd-and-similar/PURPOSE new file mode 100644 index 0000000..347a3c1 --- /dev/null +++ b/selinux-policy/systemd-mountfsd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +Author: Milos Malik + +SELinux interferes with systemd-mountfsd and related programs + diff --git a/selinux-policy/systemd-mountfsd-and-similar/main.fmf b/selinux-policy/systemd-mountfsd-and-similar/main.fmf new file mode 100644 index 0000000..35fd694 --- /dev/null +++ b/selinux-policy/systemd-mountfsd-and-similar/main.fmf @@ -0,0 +1,47 @@ +summary: SELinux interferes with systemd-mountfsd and related programs +description: |+ + SELinux interferes with systemd-mountfsd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - systemd-container + - /usr/sbin/service + - nmap-ncat +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - targeted + - NoRHIVOS +adjust+: + - enabled: false + when: distro <= fedora-40 + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-9, centos-stream-9, rhel-10, centos-stream-10 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +extra-nitrate: TC#0617898 +id: c1075a93-3218-475b-9aa2-ea0d1792d853 diff --git a/selinux-policy/systemd-mountfsd-and-similar/runtest.sh b/selinux-policy/systemd-mountfsd-and-similar/runtest.sh new file mode 100755 index 0000000..0388f63 --- /dev/null +++ b/selinux-policy/systemd-mountfsd-and-similar/runtest.sh @@ -0,0 +1,97 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +# Description: SELinux interferes with systemd-mountfsd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/lib/systemd/systemd-mountfsd" +SERVICE_PACKAGE="systemd" +SERVICE_NAME="systemd-mountfsd" +PROCESS_NAME="systemd-mountfsd" +PROCESS_CONTEXT="systemd_mountfsd_t" +FILE_CONTEXT="systemd_mountfsd_exec_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for OSes where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlPhaseStartTest "real scenario -- socket activation" + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + ( tail -f - | ncat -U /run/systemd/io.systemd.MountFileSystem ) & + PROVOCATEUR_PID=$! + sleep 1 + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill -9 ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 + if pgrep ncat >& /dev/null ; then + rlRun "killall ncat" 0-255 + fi + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-notify-and-similar/Makefile b/selinux-policy/systemd-notify-and-similar/Makefile new file mode 100644 index 0000000..b8c2da8 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +# Description: SELinux interferes with systemd-notify and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-notify-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE local-notifier.service notifier.sh reproducer.service ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh notifier.sh + chcon -t bin_t runtest.sh notifier.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-notify and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit expect libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1903305" >> $(METADATA) # Fedora 33 + @echo "Bug: RHEL-25514" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-25605" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-notify-and-similar/PURPOSE b/selinux-policy/systemd-notify-and-similar/PURPOSE new file mode 100644 index 0000000..b236d83 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +Author: Milos Malik + +SELinux interferes with systemd-notify and related programs. + diff --git a/selinux-policy/systemd-notify-and-similar/local-notifier.service b/selinux-policy/systemd-notify-and-similar/local-notifier.service new file mode 100644 index 0000000..db5a1b4 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/local-notifier.service @@ -0,0 +1,7 @@ +[Unit] +Description=Local notifier service + +[Service] +Type=oneshot +ExecStart=/usr/local/bin/notifier.sh + diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf new file mode 100644 index 0000000..1e90e1c --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -0,0 +1,49 @@ +summary: SELinux interferes with systemd-notify and related programs +description: |+ + SELinux interferes with systemd-notify and related programs + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - expect + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS + - avoidImageMode +tier: 2 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1903305 + - verifies: https://issues.redhat.com/browse/RHEL-25514 + - verifies: https://issues.redhat.com/browse/RHEL-25605 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +extra-nitrate: TC#0613581 +id: df53f93f-8f04-4575-940e-30c243d47d2d diff --git a/selinux-policy/systemd-notify-and-similar/notifier.sh b/selinux-policy/systemd-notify-and-similar/notifier.sh new file mode 100755 index 0000000..e8d7554 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/notifier.sh @@ -0,0 +1,5 @@ +#!/bin/bash +id -Z +NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready +NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready + diff --git a/selinux-policy/systemd-notify-and-similar/reproducer.service b/selinux-policy/systemd-notify-and-similar/reproducer.service new file mode 100644 index 0000000..58ec78c --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/reproducer.service @@ -0,0 +1,5 @@ +[Service] +Type=notify +NotifyAccess=all +ExecStart=/bin/sh -c "sleep 3; systemd-notify --ready; sleep 30" + diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh new file mode 100755 index 0000000..45a16b4 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/runtest.sh @@ -0,0 +1,130 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +# Description: SELinux interferes with systemd-notify and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd" +#ALLOWED_USERS="guest_u xguest_u user_u staff_u sysadm_u unconfined_u" +ALLOWED_USERS="sysadm_u unconfined_u" +SYSTEMD_SYSTEM_SERVICE="/etc/systemd/system/local-notifier.service" +SYSTEMD_USER_SERVICE="/etc/systemd/user/local-notifier.service" +SYSTEMD_PAGER="" + +rlJournalStart + rlLog "If this test fails, please contact mmalik on IRC #selinux" + rlLog "This test should fail if tested bugs are NOT fixed yet" + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1903305" + if rlIsFedora "<35"; then + rlSEMatchPathCon "/usr/bin/systemd-notify" "bin_t" + else # Fedora up to 36 and RHEL + rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" + fi + rlSESearchRule "allow init_t unconfined_t : fifo_file { write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#1903305" + rlRun "NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready" + sleep 1 + rlRun "NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- unconfined or user services use systemd-notify" + rlRun "cp -f notifier.sh /usr/local/bin/" + rlRun "cp -f local-notifier.service /etc/systemd/system/" + rlRun "cp -f local-notifier.service /etc/systemd/user/" + rlRun "restorecon -v /usr/local/bin/notifier.sh ${SYSTEMD_SYSTEM_SERVICE} ${SYSTEMD_USER_SERVICE}" + rlRun "systemctl daemon-reload" + # run the local-notifier service as a system service + rlRun "systemctl start local-notifier" + sleep 2 + rlRun "systemctl status local-notifier" 3 + # run the same service as a user service + rlRun "setsebool ssh_sysadm_login on" + CREATED_USERS="" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -Rv /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user start local-notifier" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user status local-notifier" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl --no-pager --user -u local-notifier" + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + # cleanup + rlRun "rm -f /usr/local/bin/notifier.sh ${SYSTEMD_SYSTEM_SERVICE} ${SYSTEMD_USER_SERVICE}" + rlRun "systemctl daemon-reload" + rlPhaseEnd + + if ! rlIsRHEL "<9.5" ; then + rlPhaseStartTest "RHEL-25514 + RHEL-25605" + rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" + rlSEMatchPathCon "/run/systemd/notify" "init_var_run_t" + rlSESearchRule "allow systemd_notify_t systemd_notify_t : capability { sys_admin } [ ]" + rlSESearchRule "allow systemd_notify_t kernel_t : unix_dgram_socket { sendto } [ ]" + + rlRun "cp -f ./reproducer.service /etc/systemd/system/" + rlRun "systemctl daemon-reload" + rlRun "service reproducer start" + rlRun -s "service reproducer status -l" + rlRun "grep -i 'failed.*notify.*permission.*denied' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun "rm -f /etc/systemd/system/reproducer.service" + rlRun "systemctl daemon-reload" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-notify-and-similar/ssh.exp b/selinux-policy/systemd-notify-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/systemd-nspawn-coredump/main.fmf b/selinux-policy/systemd-nspawn-coredump/main.fmf new file mode 100644 index 0000000..b183587 --- /dev/null +++ b/selinux-policy/systemd-nspawn-coredump/main.fmf @@ -0,0 +1,26 @@ +summary: SELinux interferes with coredump access in systemd-nspawn containers +description: |+ + Test for RHEL-139983 - coredump directory access in systemd-nspawn containers + +contact: Veronika Syncakova +component: + - selinux-policy +require: + - library(selinux-policy/common) + - systemd + - systemd-container +recommend: + - audit + - libselinux + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL8 +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-139983 +adjust+: + - enabled: false + when: distro < rhel-9 diff --git a/selinux-policy/systemd-nspawn-coredump/runtest.sh b/selinux-policy/systemd-nspawn-coredump/runtest.sh new file mode 100755 index 0000000..f59d945 --- /dev/null +++ b/selinux-policy/systemd-nspawn-coredump/runtest.sh @@ -0,0 +1,59 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +INSTALL_OPTION="" +if dnf --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if dnf install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if dnf install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm ${PACKAGE} + rlAssertRpm systemd-container + rlSESetEnforce + rlSESetTimestamp + rlPhaseEnd + + rlPhaseStartTest "RHEL-139983" + rlRun "mkdir -p /var/lib/machines/foo" + rlRun "dnf install -y --installroot /var/lib/machines/foo --nogpgcheck systemd-udev ${INSTALL_OPTION}" + + rlRun "systemd-nspawn -bD /var/lib/machines/foo >/dev/null 2>&1 &" + sleep 2 + rlRun -s "systemd-run -q --wait --pipe -M foo ls -lZ /run/systemd/coredump 2>&1" + rlAssertNotGrep "user_tmp_t" "$rlRun_LOG" -i + # Crash should not cause coredump avc + rlRun "systemd-run -q --wait --pipe -M foo bash -xc 'kill -SEGV \$\$\$\$'" 1-255 + rlRun "machinectl terminate foo" + sleep 2 + rlRun "rm -f /run/systemd/machines/foo" + sleep 2 + + # Same scenario but container started with machinectl + rlRun "machinectl start foo" + sleep 2 + rlRun -s "systemd-run -q --wait --pipe -M foo ls -lZ /run/systemd/coredump 2>&1" + rlAssertNotGrep "tmpfs_t" "$rlRun_LOG" -i + rlRun "systemd-run -q --wait --pipe -M foo bash -xc 'kill -SEGV \$\$\$\$'" 1-255 + rlRun "machinectl terminate foo" + sleep 2 + rlRun "rm -f /run/systemd/machines/foo" + rlRun "rm -rf /var/lib/machines/foo" + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/selinux-policy/systemd-nsresourced-and-similar/Makefile b/selinux-policy/systemd-nsresourced-and-similar/Makefile new file mode 100644 index 0000000..b87f21b --- /dev/null +++ b/selinux-policy/systemd-nsresourced-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +# Description: SELinux interferes with systemd-nsresourced and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-nsresourced and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service nmap-ncat" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9 -RHEL10" >> $(METADATA) + @echo "Bug: 2290477" >> $(METADATA) # Fedora 41 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-nsresourced-and-similar/PURPOSE b/selinux-policy/systemd-nsresourced-and-similar/PURPOSE new file mode 100644 index 0000000..7b0591c --- /dev/null +++ b/selinux-policy/systemd-nsresourced-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +Author: Milos Malik + +SELinux interferes with systemd-nsresourced and related programs + diff --git a/selinux-policy/systemd-nsresourced-and-similar/main.fmf b/selinux-policy/systemd-nsresourced-and-similar/main.fmf new file mode 100644 index 0000000..62b0f5e --- /dev/null +++ b/selinux-policy/systemd-nsresourced-and-similar/main.fmf @@ -0,0 +1,48 @@ +summary: SELinux interferes with systemd-nsresourced and related programs +description: |+ + SELinux interferes with systemd-nsresourced and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service + - nmap-ncat +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - targeted + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2290477 +adjust+: + - enabled: false + when: distro <= fedora-40 + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-9, centos-stream-9, rhel-10, centos-stream-10 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +extra-nitrate: TC#0617562 +id: fec4eaaf-8812-4d12-b915-e8dd2228d895 diff --git a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh new file mode 100755 index 0000000..9fb618c --- /dev/null +++ b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh @@ -0,0 +1,117 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +# Description: SELinux interferes with systemd-nsresourced and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/lib/systemd/systemd-nsresourced" +SERVICE_PACKAGE="systemd" +SERVICE_NAME="systemd-nsresourced" +PROCESS_NAME="systemd-nsresourced" +PROCESS_CONTEXT="systemd_nsresourced_t" +FILE_CONTEXT="systemd_nsresourced_exec_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if seinfo -t | grep -q systemd_nsresourced ; then + rlPhaseStartTest "bz#2290477" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow abrt_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow accountsd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow auditd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow cupsd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow init_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow local_login_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow policykit_auth_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow setroubleshootd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow staff_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow xdm_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for OSes where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlPhaseStartTest "real scenario -- socket activation" + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + ( tail -f - | ncat -U /run/systemd/io.systemd.NamespaceResource ) & + PROVOCATEUR_PID=$! + sleep 1 + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill -9 ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 + if pgrep ncat >& /dev/null ; then + rlRun "killall ncat" 0-255 + fi + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-oomd/Makefile b/selinux-policy/systemd-oomd/Makefile new file mode 100644 index 0000000..f1cb2e5 --- /dev/null +++ b/selinux-policy/systemd-oomd/Makefile @@ -0,0 +1,80 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/systemd-oomd +# Description: Testing systemd-oomd service +# Author: Zdenek Pytela +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/systemd-oomd +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh-sleep40.exp ssh-nosleep.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Zdenek Pytela " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Testing systemd-oomd" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: expect" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: systemd-oomd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Environment: SYSTEMD_PAGER=\"\"" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Releases: -RHEL5" >> $(METADATA) + @echo "Releases: -RHEL6" >> $(METADATA) + @echo "Releases: -RHEL7" >> $(METADATA) + @echo "Releases: -RHEL8" >> $(METADATA) + @echo "Releases: -RHEL9" >> $(METADATA) + @echo "Bug: RHEL-106998" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-oomd/PURPOSE b/selinux-policy/systemd-oomd/PURPOSE new file mode 100644 index 0000000..90bc7a4 --- /dev/null +++ b/selinux-policy/systemd-oomd/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/systemd-oomd +Author: Zdenek Pytela + +Test systemd-oomd service + diff --git a/selinux-policy/systemd-oomd/main.fmf b/selinux-policy/systemd-oomd/main.fmf new file mode 100644 index 0000000..239bb8e --- /dev/null +++ b/selinux-policy/systemd-oomd/main.fmf @@ -0,0 +1,43 @@ +summary: systemd-oomd - userspace out-of-memory (OOM) killer +description: |+ + Testing systemd-oomd service + +contact: Zdenek Pytela +component: + - selinux-policy + - systemd +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - expect + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd-oomd +environment: + AVC_ERROR: +no_avc_check +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - TierCandidatesPASS + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-106998 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + continue: false diff --git a/selinux-policy/systemd-oomd/runtest.sh b/selinux-policy/systemd-oomd/runtest.sh new file mode 100755 index 0000000..e7f74e9 --- /dev/null +++ b/selinux-policy/systemd-oomd/runtest.sh @@ -0,0 +1,156 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/systemd-oomd +# Description: Testing systemd-oomd service +# Author: Zdenek Pytela +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +if ! grep psi=1 /proc/cmdline ; then + grubby --update-kernel ALL --args psi=1 + sync + tmt-reboot +fi + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd-oomd" +SERVICE_NAME="systemd-oomd" +FILE_PATH="/usr/lib/systemd/systemd-oomd" +FILE_CONTEXT="systemd_oomd_exec_t" +PROCESS_NAME="systemd-oomd" +PROCESS_CONTEXT="systemd_oomd_t" + +### systemd-oomd is a system service that uses cgroups-v2 and pressure stall +### information (PSI) to monitor and take a corrective action before an OOM occurs +### in the kernel space. +### Monitoring and actions on units can be enabled by setting ManagedOOMSwap= +### and ManagedOOMMemoryPressure=. Cgroups of units with ManagedOOMSwap= or +### ManagedOOMMemoryPressure= set to kill will be monitored. + +rlJournalStart + if [ ! -x ${FILE_PATH} ]; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlSEConfigureSSH + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + rlRun "cat /etc/system-release" + rlRun "uname -a" + rlRun "rpm -qa | grep -e selinux-policy -e systemd | sort" + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + # Is the service SELinux confined? + CONTEXT=$(stat -c"%C" "${FILE_PATH}") + if [[ ${CONTEXT} =~ ":init_exec_t:" ]] ; then + rlLog "The ${SERVICE_NAME} service is not SELinux confined." + else + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow systemd_oomd_t proc_psi_t : file { getattr ioctl lock open read } [ ]" + rlSESearchRule "allow systemd_oomd_t domain : dir { getattr ioctl lock open read search } [ ]" + rlSESearchRule "allow systemd_oomd_t domain : file { getattr ioctl lock open read } [ ]" + rlSESearchRule "allow systemd_oomd_t cgroup_t : dir { getattr ioctl lock open read search setattr write } [ ]" + rlSESearchRule "allow systemd_oomd_t domain : process { sigkill } [ ]" + rlSESearchRule "allow systemd_oomd_t self : capability { kill } [ ]" + fi + rlPhaseEnd + + ### Basic systemd-oomd setup + ### https://fedoraproject.org/wiki/Changes/EnableSystemdOomd#How_to_test + rlPhaseStartTest "Real scenario" + + # sd-oomd conflicts earlyoom + if systemctl list-unit-files earlyoom.service &>/dev/null; then + rlRun "systemctl disable --now --quiet earlyoom.service" + fi + rlRun "systemctl enable --now ${SERVICE_NAME}" + rlRun "systemctl status ${SERVICE_NAME}" + + # enable swap-based killing on all units in the root slice + mkdir -p /etc/systemd/system/-.slice.d + cat >> /etc/systemd/system/-.slice.d/override.conf << EOF +[Slice] +ManagedOOMSwap=kill +EOF + + # memory pressure example settings + mkdir -p /etc/systemd/system/user@.service.d + cat >> /etc/systemd/system/user@.service.d/override.conf << EOF +[Service] +ManagedOOMMemoryPressure=kill +ManagedOOMMemoryPressureLimit=10% +EOF + + rlRun "systemctl daemon-reload" + rlRun "systemctl restart ${SERVICE_NAME}" + rlRun "systemctl status ${SERVICE_NAME}" + + # create a user and run a stress test - it can hang the system for a while + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3T${RANDOM}" + rlRun "useradd -G systemd-journal ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + + USER_ID=$(id -u ${USER_NAME}) + SYSTEM_SERVICE_NAME="user@${USER_ID}.service" + USER_SERVICE_NAME="useroomcheck-${RANDOM}.service" + rlRun "./ssh-sleep40.exp ${USER_NAME} ${USER_SECRET} localhost systemd-run --user -u ${USER_SERVICE_NAME} tail /dev/zero" + + rlLog "Checking journal for the oom killer string" + rlRun "./ssh-nosleep.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -u ${USER_SERVICE_NAME} -g \"A process of this unit has been killed by the OOM killer\"" + rlRun "./ssh-nosleep.exp ${USER_NAME} ${USER_SECRET} localhost journalctl --user -u ${USER_SERVICE_NAME} -g \"A process of this unit has been killed by the OOM killer\"" + + rlRun "systemctl status ${SERVICE_NAME}" + if [ "${DEBUG}" = "yes" ]; then + rlLog "Displaying list of monitored cgroups and pressure information" + rlRun "oomctl dump" + rlLog "Displaying journal content for the system ${SYSTEM_SERVICE_NAME} service" + rlRun "journalctl -u ${SYSTEM_SERVICE_NAME}" + rlLog "Displaying journal content for the user ${USER_SERVICE_NAME} service" + rlRun "./ssh-nosleep.exp ${USER_NAME} ${USER_SECRET} localhost journalctl --user -u ${USER_SERVICE_NAME}" + fi + rlPhaseEnd + + ### cleanup, restoring the previous content + rlPhaseStartCleanup + rlRun "userdel -rf ${USER_NAME}" + rm -f /etc/systemd/system/-.slice.d/override.conf + rm -f /etc/systemd/system/user@.service.d/override.conf + rlRun "systemctl daemon-reload" + rlSECheckAVC + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-oomd/ssh-nosleep.exp b/selinux-policy/systemd-oomd/ssh-nosleep.exp new file mode 100755 index 0000000..33e5d4f --- /dev/null +++ b/selinux-policy/systemd-oomd/ssh-nosleep.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 30 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/systemd-oomd/ssh-sleep40.exp b/selinux-policy/systemd-oomd/ssh-sleep40.exp new file mode 100755 index 0000000..69563d6 --- /dev/null +++ b/selinux-policy/systemd-oomd/ssh-sleep40.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 30 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command ; sleep 40" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/systemd-rfkill-and-similar/Makefile b/selinux-policy/systemd-rfkill-and-similar/Makefile index 1c92453..05acb33 100644 --- a/selinux-policy/systemd-rfkill-and-similar/Makefile +++ b/selinux-policy/systemd-rfkill-and-similar/Makefile @@ -72,6 +72,7 @@ $(METADATA): Makefile @echo "Bug: 1557595" >> $(METADATA) # Fedora 27 @echo "Bug: 1638981" >> $(METADATA) # Fedora 29 @echo "Bug: 1661724" >> $(METADATA) # Fedora 30 + @echo "Bug: 2149390" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf index ecc2671..31eac8d 100644 --- a/selinux-policy/systemd-rfkill-and-similar/main.fmf +++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf @@ -1,5 +1,57 @@ -path: /selinux-policy/systemd-rfkill-and-similar +summary: SELinux interferes with systemd-rfkill and related programs +description: |+ + SELinux interferes with systemd-rfkill service and related programs. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd-udev + - initscripts + - procps-ng + - kernel-modules +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass + - f32friendly + - f33friendly + - targeted + - fusa tier: 2 -adjust: -- enabled: false - when: distro ~>= fedora-32 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1290255 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309839 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1319499 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1388669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1543650 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1554838 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1557595 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1638981 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1661724 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149390 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0606118 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-rfkill-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-rfkill-and-similar +id: e01aaa07-2437-45d9-b224-5c1d162caec3 diff --git a/selinux-policy/systemd-rfkill-and-similar/runtest.sh b/selinux-policy/systemd-rfkill-and-similar/runtest.sh index 2d027fb..bfdc75c 100755 --- a/selinux-policy/systemd-rfkill-and-similar/runtest.sh +++ b/selinux-policy/systemd-rfkill-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -41,13 +40,18 @@ PROCESS_CONTEXT="systemd_rfkill_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} rlRun "rpm -qa kernel\*" rlRun "uname -r" + if ! rlCheckRpm kernel-automotive ; then + rlRun "yum -y install kernel-modules-`uname -r`" 0,1 + else + rlRun "dnf -y install kernel-automotive-modules-`uname -r`" 0,1 + fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -102,6 +106,13 @@ rlJournalStart rlSESearchRule "allow systemd_rfkill_t syslogd_t : unix_dgram_socket { sendto } [ ]" rlPhaseEnd + if [ -f /sys/fs/selinux/class/capability2/perms/bpf ] ; then + rlPhaseStartTest "bz#2149390" + rlSESearchRule "allow systemd_rfkill_t systemd_rfkill_t : capability2 { bpf } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -112,9 +123,10 @@ rlJournalStart fi rlRun "modprobe rfkill" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-run-and-similar/Makefile b/selinux-policy/systemd-run-and-similar/Makefile new file mode 100644 index 0000000..9fe1e29 --- /dev/null +++ b/selinux-policy/systemd-run-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-run-and-similar +# Description: SELinux interferes with systemd-run and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-run-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-run and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1559409" >> $(METADATA) # Fedora 27 + @echo "Bug: 1647162" >> $(METADATA) # Fedora 29 + @echo "Bug: 1980241" >> $(METADATA) # Fedora 34 + @echo "Bug: 2118784" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-61928" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-62185" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-run-and-similar/PURPOSE b/selinux-policy/systemd-run-and-similar/PURPOSE new file mode 100644 index 0000000..8aee928 --- /dev/null +++ b/selinux-policy/systemd-run-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-run-and-similar +Author: Milos Malik + +SELinux interferes with systemd-run and related programs + diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf new file mode 100644 index 0000000..5d8cff0 --- /dev/null +++ b/selinux-policy/systemd-run-and-similar/main.fmf @@ -0,0 +1,49 @@ +summary: SELinux interferes with systemd-run and related programs +description: |+ + SELinux interferes with systemd-run and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1559409 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1647162 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1980241 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118784 + - verifies: https://issues.redhat.com/browse/RHEL-61928 + - verifies: https://issues.redhat.com/browse/RHEL-62185 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-run-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-run-and-similar +extra-nitrate: TC#0613618 +id: db391b34-07e9-4514-8b8d-aa8ada185e26 diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh new file mode 100755 index 0000000..e4a4fee --- /dev/null +++ b/selinux-policy/systemd-run-and-similar/runtest.sh @@ -0,0 +1,95 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-run-and-similar +# Description: SELinux interferes with systemd-run and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm systemd + rlRun "setsebool daemons_use_tty on" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1559409 + bz#1647162" + rlSEMatchPathCon "/usr/bin/systemd-run" "bin_t" + rlSESearchRule "allow init_t user_devpts_t : chr_file { setattr open } [ ]" + rlPhaseEnd + + if seinfo --common file -x | grep -q watch ; then + rlPhaseStartTest "bz#1980241" + rlSESearchRule "allow init_t user_devpts_t : chr_file { watch watch_reads } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlWatchdog "systemd-run -p IPAddressDeny=127.0.0.1 -t /bin/sh" 10 + rlWatchdog "systemd-run --user --pty bash -i" 10 + rlWatchdog "systemd-run --system --pty bash -i" 10 + if systemd-run --help | grep -q -- --shell ; then + rlWatchdog "systemd-run --shell" 10 + fi + rlPhaseEnd + + rlPhaseStartTest "bz#2118784" + rlSEMatchPathCon "/var/lib" "var_lib_t" + rlSEMatchPathCon "/var/lib/myservice0" "var_lib_t" + rlSESearchRule "allow init_t var_lib_t : lnk_file { getattr read } [ ]" + rlRun "setsebool daemons_use_tty on" + rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 touch /var/lib/myservice0/foo" + rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 --pipe wc -c /var/lib/myservice0/foo" + rlRun "ls -alZ /var/lib/myservice0 /var/lib/private/myservice0" + rlRun "setsebool daemons_use_tty off" + rlPhaseEnd + + if ! rlIsRHEL "<9.7" ; then + rlPhaseStartTest "RHEL-61928 + RHEL-62185" + rlSESearchRule "allow system_dbusd_t unconfined_service_t : unix_stream_socket { read write } [ ]" + rlRun -s "systemd-run --wait -- systemd-run --user --machine=adm@ --wait true" + rlRun "grep -i success $rlRun_LOG" + rm -f $rlRun_LOG + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlRun "setsebool daemons_use_tty off" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-sysctl-and-similar/Makefile b/selinux-policy/systemd-sysctl-and-similar/Makefile new file mode 100644 index 0000000..fbb3c30 --- /dev/null +++ b/selinux-policy/systemd-sysctl-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +# Description: Does the systemd-sysctl work correctly under SELinux confinement? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x runtest.sh || chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does the systemd-sysctl work correctly under SELinux confinement?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux-utils policycoreutils selinux-policy setools-console systemd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA) + @echo "Bug: 2056207" >> $(METADATA) # Fedora 36 + @echo "Bug: 2056999" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-56988" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-58380" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-sysctl-and-similar/PURPOSE b/selinux-policy/systemd-sysctl-and-similar/PURPOSE new file mode 100644 index 0000000..b98a257 --- /dev/null +++ b/selinux-policy/systemd-sysctl-and-similar/PURPOSE @@ -0,0 +1,33 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +Author: Milos Malik + +Does the systemd-sysctl work correctly under SELinux confinement? + +Inputs + +new system service file definition +selinux labels for various files +selinux rules present at the system + +Outputs + +Test passes or fail based on presence of specific selinux labels or rules +or failures related to starting and stopping systemd-sysctl service + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: real scenario +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 15:14:27 ] :: [ PASS ] :: Command 'service systemd-sysctl start' (Expected 0, got 0) +:: [ 15:14:46 ] :: [ PASS ] :: Command 'service systemd-sysctl status' (Expected 0,1,3, got 0) +:: [ 15:15:15 ] :: [ PASS ] :: Command 'restorecon -Rv /etc /run /var -e /var/ARTIFACTS' (Expected 0-255, got 0) +:: [ 15:15:19 ] :: [ PASS ] :: Command 'service systemd-sysctl restart' (Expected 0, got 0) +:: [ 15:15:38 ] :: [ PASS ] :: Command 'service systemd-sysctl status' (Expected 0,1,3, got 0) +:: [ 15:15:57 ] :: [ PASS ] :: Command 'service systemd-sysctl stop' (Expected 0, got 0) +:: [ 15:16:15 ] :: [ PASS ] :: Command 'service systemd-sysctl status' (Expected 0,1,3, got 3) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 127s +:: Assertions: 7 good, 0 bad +:: RESULT: PASS (real scenario) diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf new file mode 100644 index 0000000..96aa578 --- /dev/null +++ b/selinux-policy/systemd-sysctl-and-similar/main.fmf @@ -0,0 +1,44 @@ +summary: Does the systemd-sysctl work correctly under SELinux confinement? +description: |+ + Does the systemd-sysctl work correctly under SELinux confinement? + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux-utils + - policycoreutils + - selinux-policy + - setools-console + - systemd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - fusa +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056207 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056999 + - verifies: https://issues.redhat.com/browse/RHEL-56988 + - verifies: https://issues.redhat.com/browse/RHEL-58380 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0613033 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +id: 11114547-d1b5-47c1-a3ac-2a3729a87b1c diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh new file mode 100755 index 0000000..5fd8104 --- /dev/null +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -0,0 +1,93 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +# Description: Does the systemd-sysctl work correctly under SELinux confinement? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +PROCESS_CONTEXT="systemd_sysctl_t" +PROCESS_NAME="systemd-sysctl" +SERVICE_NAME="systemd-sysctl" +SERVICE_PACKAGE="systemd" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + rlPhaseStartTest "bz#2056207 + bz#2056999" + rlSEMatchPathCon "/usr/lib/systemd/systemd-sysctl" "systemd_sysctl_exec_t" + rlRun "ls -Z /proc/sys/fs/suid_dumpable | grep :proc_security_t" + rlRun "ls -Z /proc/sys/fs/protected_hardlinks | grep :proc_security_t" + rlRun "ls -Z /proc/sys/fs/protected_symlinks | grep :proc_security_t" + rlRun "ls -Z /proc/sys/kernel/kptr_restrict | grep :proc_security_t" + rlSESearchRule "allow systemd_sysctl_t proc_security_t : file { read } [ ]" + rlPhaseEnd + + if ! rlIsRHEL "<9.6" ; then + rlPhaseStartTest "RHEL-56988 + RHEL-58380" + if [ -e "/usr/share/man/man5/sysctl.d.5.gz" ]; then + rlRun "man sysctl.d | grep /run/sysctl" + fi + rlRun "mkdir -pZ /run/sysctl.d" + rlRun "echo 'net.ipv4.conf.eno1.rp_filter=0' > /run/sysctl.d/51-rp_filter.conf" + rlRun "restorecon -Rv /run/sysctl.d" + rlRun "service systemd-sysctl stop" + rlRun "service systemd-sysctl start" + rlRun "service systemd-sysctl status" 0,3 + rlPhaseEnd + fi + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-timesyncd-and-similar/Makefile b/selinux-policy/systemd-timesyncd-and-similar/Makefile index 25410b7..a5fdcf0 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/Makefile +++ b/selinux-policy/systemd-timesyncd-and-similar/Makefile @@ -55,8 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd-udev initscripts" >> $(METADATA) - @echo "Requires: systemd-timesyncd" >> $(METADATA) # EPEL + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service /usr/lib/systemd/systemd-timesyncd" >> $(METADATA) # EPEL @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -73,6 +72,8 @@ $(METADATA): Makefile @echo "Bug: 1694272" >> $(METADATA) # Fedora 29 @echo "Bug: 1822131" >> $(METADATA) # Fedora 32 @echo "Bug: 1869979" >> $(METADATA) # RHEL-8 + @echo "Bug: 1949315" >> $(METADATA) # Fedora 34 + @echo "Bug: 2175137" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf index 16bf981..29a8118 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf +++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf @@ -1,2 +1,63 @@ -path: /selinux-policy/systemd-timesyncd-and-similar +summary: SELinux interferes with systemd-timesyncd and related programs +description: |+ + SELinux interferes with systemd-timesyncd and related programs. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - /usr/lib/systemd/systemd-timesyncd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - TIPpass_Security + - epel + - rhel8-epel + - rhel9-epel + - targeted + - NoRHIVOS tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1640801 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649257 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649668 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649671 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1653050 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1666222 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1694272 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1822131 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1869979 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949315 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1970865 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2175137 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + because: the systemd-timesyncd service is not available there + - enabled: false + when: arch == i386, ppc64, s390 + continue: false +extra-nitrate: TC#0606395 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar +id: 2cca4aec-eac2-4547-91d0-979541b04f5b diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 18950fe..bded838 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -27,25 +27,28 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" ROOT_PASSWORD="redhat" FILE_PATH="/usr/lib/systemd/systemd-timesyncd" FILE_CONTEXT="systemd_timedated_exec_t" -SERVICE_PACKAGE="systemd-udev" SERVICE_NAME="systemd-timesyncd" PROCESS_NAME="systemd-timesyncd" PROCESS_CONTEXT="systemd_timedated_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if [ -f ${FILE_PATH} ] ; then + SERVICE_PACKAGE=`rpm -qf ${FILE_PATH} | head -n 1` + rlAssertRpm ${SERVICE_PACKAGE} + else + rlRun "yum -y install ${FILE_PATH}" 0-255 + fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -72,10 +75,11 @@ rlJournalStart if rlIsFedora ; then rlPhaseStartTest "bz#1649671" - rlSEMatchPathCon "/run/systemd/timesync" "init_var_run_t" - rlSEMatchPathCon "/run/systemd/timesync/synchronized" "init_var_run_t" + rlSEMatchPathCon "/run/systemd/timesync" "systemd_timedated_var_run_t" + rlSEMatchPathCon "/run/systemd/timesync/synchronized" "systemd_timedated_var_run_t" rlSESearchRule "allow systemd_timedated_t init_var_run_t : dir { write add_name } [ ]" - rlSESearchRule "allow systemd_timedated_t init_var_run_t : file { create write open } [ ]" + rlSESearchRule "allow systemd_timedated_t systemd_timedated_var_run_t : dir { write add_name } [ ]" + rlSESearchRule "allow systemd_timedated_t systemd_timedated_var_run_t : file { create write open } [ ]" rlPhaseEnd rlPhaseStartTest "bz#1694272" @@ -102,15 +106,32 @@ rlJournalStart rlSESearchRule "allow systemd_timedated_t efivarfs_t : file { getattr open read } [ ]" rlPhaseEnd + if ! rlIsRHEL '<9' && ! rlIsCentOS '<9' ; then + rlPhaseStartTest "bz#1949315" + rlSEMatchPathCon "/" "root_t" + rlSEMatchPathCon "/run" "var_run_t" + rlSESearchRule "allow systemd_timedated_t root_t : dir { watch } [ ]" + rlSESearchRule "allow systemd_timedated_t var_run_t : dir { watch } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2175137" + rlSEMatchPathCon "/usr/lib/systemd/systemd-timesyncd" "systemd_timedated_exec_t" + rlSEMatchPathCon "/run/systemd/" "init_var_run_t" + rlSESearchRule "allow systemd_timedated_t init_var_run_t : dir { watch } [ ]" + rlPhaseEnd + fi + + if systemctl list-unit-files | grep -q ${SERVICE_NAME} ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-tmpfiles-and-similar/Makefile b/selinux-policy/systemd-tmpfiles-and-similar/Makefile new file mode 100644 index 0000000..e30c908 --- /dev/null +++ b/selinux-policy/systemd-tmpfiles-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +# Description: SELinux interferes with systemd-tmpfiles and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-tmpfiles and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit expect libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service shadow-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-40374" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-44191" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-139855" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-tmpfiles-and-similar/PURPOSE b/selinux-policy/systemd-tmpfiles-and-similar/PURPOSE new file mode 100644 index 0000000..6f0cf3c --- /dev/null +++ b/selinux-policy/systemd-tmpfiles-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +Author: Milos Malik + +SELinux interferes with systemd-tmpfiles and related programs. + diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf new file mode 100644 index 0000000..21cebdf --- /dev/null +++ b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf @@ -0,0 +1,50 @@ +summary: SELinux interferes with systemd-tmpfiles and related programs +description: |+ + SELinux interferes with systemd-tmpfiles and related programs + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - expect + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +tier: 2 +link: + - verifies: https://issues.redhat.com/browse/RHEL-40374 + - verifies: https://issues.redhat.com/browse/RHEL-44191 + - verifies: https://issues.redhat.com/browse/RHEL-139855 +adjust+: + - enabled: false + when: distro < rhel-9.5 + continue: false + because: RHEL-40374 is fixed in RHEL-9.5 and RHEL-44191 in RHEL-10 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +extra-nitrate: TC#0617577 +id: 03d8e784-9026-46ef-a48b-0bbed63f7f95 diff --git a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh new file mode 100755 index 0000000..a4fd928 --- /dev/null +++ b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh @@ -0,0 +1,106 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +# Description: SELinux interferes with systemd-tmpfiles and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd" +ALLOWED_USERS="staff_u sysadm_u unconfined_u" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-40374 + RHEL-44191" + rlSEMatchPathCon "/usr/bin/systemd-tmpfiles" "systemd_tmpfiles_exec_t" + if rlSEDefined "staff_t" ; then + rlSESearchRule "allow staff_t systemd_tmpfiles_exec_t : file { getattr open read map execute execute_no_trans } [ ]" + fi + rlRun "setsebool ssh_sysadm_login on" + CREATED_USERS="" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -Rv /home/${USER_NAME}" + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user status systemd-tmpfiles-setup.service" + rlRun "grep -i failed $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user --failed" + rlRun "grep '0 loaded units listed' $rlRun_LOG" + rm -f $rlRun_LOG + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + rlPhaseEnd + + rlPhaseStartTest "RHEL-139855" + SOFT_LIMIT=1000 + HARD_LIMIT=1500 + LIMIT_NOFILE="$(systemctl show --value --property DefaultLimitNOFILE)" + LIMIT_NOFILE_SOFT="$(systemctl show --value --property DefaultLimitNOFILESoft)" + rlAssertNotEquals "DefaultLimitNOFILE is set to: ${LIMIT_NOFILE}" $HARD_LIMIT $LIMIT_NOFILE + rlAssertNotEquals "DefaultLimitNOFILESoft is set to: ${LIMIT_NOFILE_SOFT}" $SOFT_LIMIT $LIMIT_NOFILE_SOFT + rlRun "mkdir /run/systemd/system.conf.d/" + rlRun "cat >/run/systemd/system.conf.d/99-NOFILE.conf < +component: + - selinux-policy + - systemd +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - systemd + - /usr/sbin/service + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - targeted + - failinfedora + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1835630 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + because: the systemd-userdbd program is not available there + - enabled: false + when: distro == fedora-30, fedora-31 + continue: false +extra-nitrate: TC#0606124 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-userdbd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-userdbd-and-similar +id: 0e50b61f-a399-47d9-b9f3-dd602e8cd88a diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index 9fba8c9..764eb6b 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -42,15 +41,14 @@ ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u guest_u xguest_u sysadm_u unconfi DENIED_USERS=${DENIED_USERS:-""} rlJournalStart - # the systemd-userdbd service is not available on RHEL-8 - if rlIsRHEL 8 ; then + if [ ! -f /usr/lib/systemd/systemd-userdbd ] ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -58,6 +56,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -101,16 +100,19 @@ rlJournalStart rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then rlPhaseStartTest "real scenario -- ${SERVICE_NAME}.socket" rlRun "systemctl stop systemd-userdbd.socket" rlRun "systemctl status systemd-userdbd.socket" 3 @@ -119,13 +121,15 @@ rlJournalStart rlRun "ls -dZ /run/systemd/userdb | grep :systemd_userdbd_runtime_t" rlRun "ls -Z /run/systemd/userdb/io.systemd.Multiplexer | grep :systemd_userdbd_runtime_t" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 - rlSECheckAVC + rlSECheckAVC --ignore 'type=AVC.*connectto.*userdbctl.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*userdbctl.*:xguest_t:.*:systemd_machined_t:' rlFileRestore rlServiceRestore ${SERVICE_NAME} + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/targetd-and-similar/Makefile b/selinux-policy/targetd-and-similar/Makefile new file mode 100644 index 0000000..85311e7 --- /dev/null +++ b/selinux-policy/targetd-and-similar/Makefile @@ -0,0 +1,78 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/targetd-and-similar +# Description: SELinux interferes with targetd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/targetd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with targetd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: targetd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console targetd targetcli lvm2 /usr/sbin/service httpd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1063714" >> $(METADATA) # RHEL-7 + @echo "Bug: 1373860" >> $(METADATA) # RHEL-7 + @echo "Bug: 1424621" >> $(METADATA) # RHEL-7 + @echo "Bug: 1486252" >> $(METADATA) # RHEL-7 + @echo "Bug: 1486259" >> $(METADATA) # RHEL-7 + @echo "Bug: 1546671" >> $(METADATA) # RHEL-7 + @echo "Bug: 1569663" >> $(METADATA) # RHEL-8 + @echo "Bug: 2062183" >> $(METADATA) # RHEL-8 + @echo "Bug: 2203720" >> $(METADATA) # RHEL-8 + @echo "Bug: 2222199" >> $(METADATA) # Fedora rawhide + + rhts-lint $(METADATA) + diff --git a/selinux-policy/targetd-and-similar/PURPOSE b/selinux-policy/targetd-and-similar/PURPOSE new file mode 100644 index 0000000..f057996 --- /dev/null +++ b/selinux-policy/targetd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/targetd-and-similar +Author: Milos Malik + +SELinux interferes with targetd and related programs. Possible interactions: targetd + btrfs. + diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf new file mode 100644 index 0000000..4e536e1 --- /dev/null +++ b/selinux-policy/targetd-and-similar/main.fmf @@ -0,0 +1,59 @@ +summary: SELinux interferes with targetd and related programs +description: |+ + SELinux interferes with targetd and related programs. Possible interactions: targetd + btrfs. + +contact: Milos Malik +component: + - selinux-policy + - targetd +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - targetd + - targetcli + - lvm2 + - /usr/sbin/service + - httpd +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: false +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TierCandidatesPASS + - epel + - rhel8-epel + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1063714 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373860 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1424621 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1486252 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1486259 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1546671 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1569663 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2062183 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2203720 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2222199 +adjust+: + - enabled: true + when: distro == rhel-7, rhel-8, centos-stream-8, fedora + because: the targetd package is not available elsewhere +extra-nitrate: TC#0337221 +extra-summary: /CoreOS/selinux-policy/Regression/targetd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/targetd-and-similar +id: 5fcb6b1a-15d3-4627-95a5-62a49ba2d7e5 diff --git a/selinux-policy/targetd-and-similar/runtest.sh b/selinux-policy/targetd-and-similar/runtest.sh new file mode 100755 index 0000000..ff7dc99 --- /dev/null +++ b/selinux-policy/targetd-and-similar/runtest.sh @@ -0,0 +1,209 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/targetd-and-similar +# Description: SELinux interferes with targetd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/targetd" +FILE_CONTEXT="targetd_exec_t" +SERVICE_PACKAGE="targetd" +SERVICE_NAME="targetd" +PROCESS_NAME="targetd" +PROCESS_CONTEXT="targetd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup --clean /etc/target/saveconfig.json + rlFileBackup --clean /etc/target/targetd.yaml + rlFileBackup /etc/lvm/lvm.conf + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1063714" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow targetd_t lvm_control_t : chr_file { getattr open read write ioctl } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1373860 + bz#1486252" + rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" + rlSESearchRule "allow targetd_t targetd_t : unix_dgram_socket { create getopt setopt ioctl }" + rlSESearchRule "allow targetd_t proc_net_t : file { getattr open read }" + rlSESearchRule "dontaudit targetd_t targetd_t : capability { net_admin }" + rlSESearchRule "allow targetd_t kernel_t : unix_dgram_socket { sendto }" + rlSESearchRule "dontaudit targetd_t rpm_exec_t : file { getattr }" + rlSESearchRule "allow targetd_t tmp_t : dir { getattr open read }" + rlSESearchRule "dontaudit targetd_t rpm_var_lib_t : file { getattr open }" + rlSESearchRule "dontaudit targetd_t semanage_store_t : dir { getattr }" + rlSESearchRule "allow targetd_t bin_t : file { getattr open read execute_no_trans }" + rlPhaseEnd + + rlPhaseStartTest "bz#1424621 + bz#1486259" + rlSEMatchPathCon "/var/run/dmeventd-client" "lvm_var_run_t" + rlSESearchRule "allow targetd_t bin_t : file { getattr open read execute_no_trans }" + rlSESearchRule "allow targetd_t targetd_t : tcp_socket { accept }" + if rlIsRHEL 5 6 7 ; then + rlSESearchRule "dontaudit targetd_t insmod_exec_t : file { getattr }" + fi + rlSESearchRule "allow targetd_t configfs_t : dir { add_name create getattr open read remove_name rmdir search write }" + rlSESearchRule "allow targetd_t configfs_t : file { getattr open read write }" + rlSESearchRule "allow targetd_t configfs_t : lnk_file { create getattr read unlink }" + # following 2 rules seem to needed by btrfs tool + # rlSESearchRule "allow targetd_t default_t : dir { ioctl read write }" + # rlSESearchRule "allow targetd_t unlabeled_t : dir { ioctl read write }" + # rlSESearchRule "allow targetd_t mnt_t : dir { ioctl read write }" + rlSESearchRule "allow targetd_t exports_t : file { getattr open read }" + rlSESearchRule "allow targetd_t fixed_disk_device_t : blk_file { write }" + rlSESearchRule "allow targetd_t fs_t : filesystem { getattr }" + rlSESearchRule "allow targetd_t kernel_t : system { ipc_info module_request }" + if rlIsRHEL 7 ; then + rlSESearchRule "allow targetd_t lvm_metadata_t : dir { add_name read remove_name write }" + rlSESearchRule "allow targetd_t lvm_metadata_t : file { create link rename unlink append }" + rlSESearchRule "allow targetd_t lvm_var_run_t : fifo_file { getattr open lock read write }" + fi + rlSESearchRule "allow targetd_t modules_conf_t : dir { getattr open read }" + rlSESearchRule "allow targetd_t modules_conf_t : file { getattr open read }" + rlSESearchRule "allow targetd_t modules_object_t : dir { search }" + rlSESearchRule "allow targetd_t modules_object_t : file { getattr open read }" + rlSESearchRule "allow targetd_t nfsd_fs_t : file { getattr open read }" + rlSESearchRule "allow targetd_t targetd_t : capability { ipc_lock sys_admin sys_nice }" + rlSESearchRule "allow targetd_t targetd_t : process { setsched }" + rlSESearchRule "allow targetd_t sysctl_rpc_t : dir { search }" + rlSESearchRule "allow targetd_t sysctl_rpc_t : file { getattr open read write }" + rlSESearchRule "allow targetd_t sysfs_t : file { write }" + rlSESearchRule "allow targetd_t var_lib_nfs_t : dir { add_name remove_name write }" + rlSESearchRule "allow targetd_t var_lib_nfs_t : file { create getattr lock open read rename unlink write }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1569663" + rlSEMatchPathCon "/etc/lvm/lvm.conf" "lvm_etc_t" + rlSESearchRule "allow targetd_t lvm_etc_t : file { map }" + rlPhaseEnd + + rlPhaseStartTest "bz#2062183" + rlSEMatchPathCon "/usr/sbin/lvm" "lvm_exec_t" + rlSESearchRule "allow targetd_t lvm_exec_t : file { getattr open read execute map } [ ]" + rlSESearchRule "type_transition targetd_t lvm_exec_t : process lvm_t" + rlSESearchRule "allow targetd_t lvm_t : process { transition } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#1546671" + rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" + rlSEMatchPathCon "/root/.local" "gconf_home_t" + rlSEMatchPathCon "/home/user/.local" "gconf_home_t" + rlSEMatchPathCon "/etc/lvm/lvm.conf" "lvm_etc_t" + rlSESearchRule "allow targetd_t gconf_home_t : dir { search }" + rlSESearchRule "allow targetd_t lvm_etc_t : file { map }" + rlPhaseEnd + + rlPhaseStartTest "bz#2203720" + rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" + rlSEMatchPathCon "/etc/httpd" "httpd_config_t" + rlSEMatchPathCon "/etc/httpd/conf" "httpd_config_t" + rlSESearchRule "dontaudit targetd_t httpd_config_t : dir { search } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2222199" + rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" + if [ -f /proc/sys/net/ipv6/conf/all/disable_ipv6 ] ; then + rlRun "ls -dZ /proc/sys/net | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv6 | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t" + rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + fi + rlSESearchRule "allow targetd_t sysctl_net_t : dir { search } [ ]" + rlSESearchRule "allow targetd_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "rm -f /etc/target/saveconfig.json" + rlRun "rm -f /etc/target/targetd.yaml" + rlRun "targetctl clear" 0-255 + rlRun "targetctl save" + rlRun "echo \"password: Str0nGp4ssw0rD\" > /etc/target/targetd.yaml" + rlRun "sed -i \"s/use_lvmetad = 1/use_lvmetad = 0/\" /etc/lvm/lvm.conf" + rlRun "ls -Z /etc/target" + LOOP_FILE="vg-targetd.img" + LOOP_DEVICE=`losetup -f` + rlRun "dd if=/dev/zero of=${LOOP_FILE} bs=1MB count=128" + rlRun "losetup ${LOOP_DEVICE} ${LOOP_FILE}" + rlRun "vgcreate vg-targetd ${LOOP_DEVICE}" + rlRun "vgdisplay" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "targetcli ls" + rlRun "targetcli version" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlRun "vgremove vg-targetd" + rlRun "losetup -d ${LOOP_DEVICE}" + rlRun "rm -f ${LOOP_FILE}" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/thttpd-and-similar/Makefile b/selinux-policy/thttpd-and-similar/Makefile new file mode 100644 index 0000000..550c373 --- /dev/null +++ b/selinux-policy/thttpd-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/thttpd-and-similar +# Description: SELinux interferes with thhtpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/thttpd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with thttpd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console thttpd" >> $(METADATA) # EPEL + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Architectures: i386 x86_64" >> $(METADATA) + @echo "Bug: 1069843" >> $(METADATA) # RHEL-6 + @echo "Bug: 1087384" >> $(METADATA) # RHEL-7 + @echo "Bug: 1111581" >> $(METADATA) # RHEL-6 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/thttpd-and-similar/PURPOSE b/selinux-policy/thttpd-and-similar/PURPOSE new file mode 100644 index 0000000..4d669c4 --- /dev/null +++ b/selinux-policy/thttpd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/thttpd-and-similar +Author: Milos Malik + +SELinux interferes with thttpd and related programs. + diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf new file mode 100644 index 0000000..d90db9b --- /dev/null +++ b/selinux-policy/thttpd-and-similar/main.fmf @@ -0,0 +1,55 @@ +summary: SELinux interferes with the thttpd and related programs +description: |+ + SELinux interferes with thttpd and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/service + - setools-console + - thttpd +environment: + AVC_ERROR: +no_avc_check +duration: 5m +enabled: true +tag: + - NoRHEL4 + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted + - epel + - rhel8-epel + - NoRHIVOS +tier: 2 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1069843 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1087384 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1111581 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-alt-7, rhel-9, rhel-10 + because: the thttpd package is not available there + - enabled: false + when: distro >= centos-stream-9 + because: the thttpd package is not available there + - enabled: false + when: arch == i386, ppc64, s390 + continue: false +extra-nitrate: TC#0340646 +extra-summary: /CoreOS/selinux-policy/Regression/thttpd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/thttpd-and-similar +id: dc6bfb6d-cfe5-4f75-87a4-984aa6c8591b diff --git a/selinux-policy/thttpd-and-similar/runtest.sh b/selinux-policy/thttpd-and-similar/runtest.sh new file mode 100755 index 0000000..dcd0776 --- /dev/null +++ b/selinux-policy/thttpd-and-similar/runtest.sh @@ -0,0 +1,112 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/thttpd-and-similar +# Description: SELinux interferes with thttpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/thttpd" +FILE_CONTEXT="httpd_exec_t" +SERVICE_PACKAGE="thttpd" +SERVICE_NAME="thttpd" +PROCESS_NAME="thttpd" +PROCESS_CONTEXT="httpd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop `rlSEListServices 80` + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#1069843" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "/etc/thttpd.conf" "httpd_config_t" + rlSEMatchPathCon "/var/log/thttpd.log" "httpd_log_t" + rlSEMatchPathCon "/var/run/thttpd.pid" "httpd_var_run_t" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "bz#1087384 + bz#1111581" + if rlIsRHEL 6 ; then + rlSEMatchPathCon "/etc/rc.d/init.d/thttpd" "httpd_initrc_exec_t" + else # RHEL-7 etc. + rlSEMatchPathCon "/lib/systemd/system/thttpd.service" "httpd_unit_file_t" + fi + rlSEMatchPathCon "/usr/sbin/thttpd" "httpd_exec_t" + rlSEMatchPathCon "/var/log/thttpd.log" "httpd_log_t" + rlSESearchRule "allow httpd_t httpd_t : capability { sys_chroot }" + rlSESearchRule "allow httpd_t httpd_log_t : file { setattr }" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + # because of the fowner capability + rlRun "setsebool httpd_run_stickshift on" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if rlIsRHEL 5 ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "setsebool httpd_run_stickshift off" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore `rlSEListServices 80` + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/tlp-and-similar/Makefile b/selinux-policy/tlp-and-similar/Makefile index 386b5bd..ed881d4 100644 --- a/selinux-policy/tlp-and-similar/Makefile +++ b/selinux-policy/tlp-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: tlp" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients tlp rfkill" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients tlp rfkill snapd /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) @echo "Bug: 1460481" >> $(METADATA) # RHEL-7 + @echo "Bug: 2221019" >> $(METADATA) # Fedora 38 rhts-lint $(METADATA) diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index 3e91f57..182f8b6 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -1,8 +1,57 @@ -path: /selinux-policy/tlp-and-similar -summary: SELinux interferes with tlp and related programs -description: | - Test coverage for SELinux AVC issues against tlp and related - programs. -adjust: -- enabled: false - when: distro < rhel-7 +summary: the service was running as initrc_t or init_t, now it is confined by SELinux +description: |+ + SELinux interferes with tlp and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - tlp + - rfkill + - snapd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - failinfedora + - f33friendly + - targeted + - epel + - rhel8-epel + - rhel9-epel + - rhel10-epel + - rhel9_broken + - rhel10_broken + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460481 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2221019 +adjust+: + - enabled: false + when: arch == s390x + continue: false + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0569976 +extra-summary: /CoreOS/selinux-policy/Regression/tlp-and-similar +extra-task: /CoreOS/selinux-policy/Regression/tlp-and-similar +id: a467ae20-527e-49c7-a726-fa3a32887a54 diff --git a/selinux-policy/tlp-and-similar/runtest.sh b/selinux-policy/tlp-and-similar/runtest.sh index 55a0f5f..0c67f65 100755 --- a/selinux-policy/tlp-and-similar/runtest.sh +++ b/selinux-policy/tlp-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -41,11 +40,15 @@ PROCESS_CONTEXT="tlp_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -82,7 +85,17 @@ rlJournalStart rlPhaseEnd fi + if rlSEDefined "snappy_var_lib_t" ; then + rlPhaseStartTest "bz#2221019" + rlSESearchRule "dontaudit tlp_t snappy_var_lib_t : dir { search } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" + if rpm -q snapd >& /dev/null ; then + rlRun "ls -alRZ /var/lib/snapd" + fi rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then if rlIsRHEL 5 6 ; then @@ -93,8 +106,10 @@ rlJournalStart fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "tlp-stat -v" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/tlshd-and-similar/Makefile b/selinux-policy/tlshd-and-similar/Makefile new file mode 100644 index 0000000..236ebdf --- /dev/null +++ b/selinux-policy/tlshd-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/tlshd-and-similar +# Description: SELinux interferes with tlshd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/tlshd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with tlshd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console ktls-utils /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-29439" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-42672" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-74424" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/tlshd-and-similar/PURPOSE b/selinux-policy/tlshd-and-similar/PURPOSE new file mode 100644 index 0000000..828f1b5 --- /dev/null +++ b/selinux-policy/tlshd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/tlshd-and-similar +Author: Milos Malik + +SELinux interferes with tlshd and related programs. + diff --git a/selinux-policy/tlshd-and-similar/main.fmf b/selinux-policy/tlshd-and-similar/main.fmf new file mode 100644 index 0000000..79d03bc --- /dev/null +++ b/selinux-policy/tlshd-and-similar/main.fmf @@ -0,0 +1,45 @@ +summary: SELinux interferes with tlshd and related programs +description: |+ + SELinux interferes with tlshd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - ktls-utils + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - failinfedora + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-29439 + - verifies: https://issues.redhat.com/browse/RHEL-42672 + - verifies: https://issues.redhat.com/browse/RHEL-74424 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the ktls-utils package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/tlshd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/tlshd-and-similar +extra-nitrate: TC#0617913 +id: 63121e2f-20f3-4ded-80fe-ab98fecd79af diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh new file mode 100755 index 0000000..0e13e00 --- /dev/null +++ b/selinux-policy/tlshd-and-similar/runtest.sh @@ -0,0 +1,107 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/tlshd-and-similar +# Description: SELinux interferes with tlshd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/tlshd" +SERVICE_PACKAGE="ktls-utils" +SERVICE_NAME="tlshd" +PROCESS_NAME="tlshd" +if seinfo -t | grep -q tlshd ; then + PROCESS_CONTEXT="ktlshd_t" + FILE_CONTEXT="ktlshd_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-29439 + RHEL-42672" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlPhaseEnd + + if rlSEDefined "ktlshd_t" ; then + rlPhaseStartTest "RHEL-74424" + rlSEMatchPathCon "/etc/resolv.conf" "net_conf_t" + rlSEMatchPathCon "/etc/pki/tls/certs/ca-cert.pem" "cert_t" + rlRun "ls -Z /proc/net/if_inet6 | grep :proc_net_t" + rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + rlSESearchRule "allow ktlshd_t ktlshd_t : key { write } [ ]" + rlSESearchRule "allow ktlshd_t cert_t : dir { search } [ ]" + rlSESearchRule "allow ktlshd_t cert_t : file { getattr open read } [ ]" + rlSESearchRule "allow ktlshd_t net_conf_t : file { getattr open read } [ ]" + # rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]" + rlSESearchRule "allow ktlshd_t ktlshd_t : netlink_route_socket { bind create getattr getopt nlmsg_read setopt } [ ]" + rlSESearchRule "allow ktlshd_t ktlshd_t : udp_socket { connect create getattr setopt } [ ]" + rlSESearchRule "allow ktlshd_t sysctl_net_t : dir { search } [ ]" + rlSESearchRule "allow ktlshd_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile new file mode 100644 index 0000000..3fabb16 --- /dev/null +++ b/selinux-policy/tuned-ppd-and-similar/Makefile @@ -0,0 +1,80 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +# Description: SELinux interferes with tuned-ppd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with tuned-ppd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tuned-ppd /usr/sbin/service gdm" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-69450" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69526" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-85849" >> $(METADATA) # RHEL-10 + @echo "Bug: 2358952" >> $(METADATA) # Fedora 42 + @echo "Bug: 2359047" >> $(METADATA) # Fedora 42 + @echo "Bug: 2359851" >> $(METADATA) # Fedora 42 + @echo "Bug: 2360026" >> $(METADATA) # Fedora 42 + @echo "Bug: 2360121" >> $(METADATA) # Fedora 41 + @echo "Bug: 2361423" >> $(METADATA) # Fedora 42 + @echo "Bug: 2367076" >> $(METADATA) # Fedora 41 + @echo "Bug: 2367711" >> $(METADATA) # Fedora 42 + @echo "Bug: RHEL-101686" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-101687" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/tuned-ppd-and-similar/PURPOSE b/selinux-policy/tuned-ppd-and-similar/PURPOSE new file mode 100644 index 0000000..dc2bac6 --- /dev/null +++ b/selinux-policy/tuned-ppd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +Author: Milos Malik + +SELinux interferes with tuned-ppd and related programs. + diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf new file mode 100644 index 0000000..e0593a8 --- /dev/null +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -0,0 +1,54 @@ +summary: SELinux interferes with tuned-ppd and related programs +description: |+ + SELinux interferes with tuned-ppd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - gdm +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-69450 + - verifies: https://issues.redhat.com/browse/RHEL-69526 + - verifies: https://issues.redhat.com/browse/RHEL-85849 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2358952 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359047 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359851 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360026 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360121 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2361423 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367076 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367711 + - verifies: https://issues.redhat.com/browse/RHEL-101686 + - verifies: https://issues.redhat.com/browse/RHEL-101687 +adjust+: + - enabled: false + when: distro < rhel-9.5 + because: the tuned-ppd package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +extra-nitrate: TC#0618543 +id: 58ffbde5-91ba-44e8-8faf-039f1043a503 diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh new file mode 100755 index 0000000..1efe029 --- /dev/null +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -0,0 +1,157 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +# Description: SELinux interferes with tuned-ppd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/tuned-ppd" +SERVICE_PACKAGE="tuned-ppd" +SERVICE_NAME="tuned-ppd" +PROCESS_NAME="tuned-ppd" +if seinfo -t | grep -q tuned_ppd ; then + PROCESS_CONTEXT="tuned_ppd_t" + FILE_CONTEXT="tuned_ppd_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + if rpm -q power-profiles-daemon ; then + rlRun "yum -y remove power-profiles-daemon" + fi + rlRun "yum -y install ${SERVICE_PACKAGE}" + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/tuned/ppd_base_profile + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-69450 + RHEL-69526" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlSESearchRule "allow init_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlPhaseEnd + + if rlSEDefined "xdm_t tuned_ppd_t" ; then + rlPhaseStartTest "RHEL-85849" + rlSESearchRule "allow xdm_t tuned_ppd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow tuned_ppd_t xdm_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + + if rlSEDefined "tuned_ppd_t sssd_t" ; then + rlPhaseStartTest "bz#2367076" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + rlSESearchRule "allow tuned_ppd_t sssd_var_lib_t : sock_file { write } [ ]" + rlSESearchRule "allow tuned_ppd_t sssd_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + if rlSEDefined "tuned_rw_etc_t tuned_ppd_t" ; then + rlPhaseStartTest "bz#2359851 + bz#2360026 + bz#2361423 + bz#2367711" + rlSEMatchPathCon "/etc/tuned" "tuned_etc_t" + rlSEMatchPathCon "/etc/tuned/ppd_base_profile" "tuned_rw_etc_t" + rlSESearchRule "type_transition tuned_ppd_t tuned_etc_t : file tuned_rw_etc_t ppd_base_profile" + rlSESearchRule "allow tuned_ppd_t tuned_etc_t : dir { write add_name } [ ]" + rlSESearchRule "allow tuned_ppd_t tuned_rw_etc_t : file { create write } [ ]" + rlPhaseEnd + fi + + if rlSEDefined "tuned_ppd_t" ; then + rlPhaseStartTest "RHEL-101686 + RHEL-101687" + rlSEMatchPathCon "/sys/devices/system/cpu/intel_pstate" "sysfs_t" + rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2358952 + bz#2359047 + bz#2360121" + rlSEMatchPathCon "/sys/firmware/acpi" "sysfs_t" + rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch_reads } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if [ -f /usr/lib/systemd/system/gdm.service ] ; then + rlRun "service gdm start" + rlRun "service gdm status" + sleep 2 + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "busctl introspect net.hadess.PowerProfiles /org/freedesktop/UPower/PowerProfiles" + rlRun "busctl introspect net.hadess.PowerProfiles /net/hadess/PowerProfiles" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "ls -Z /etc/tuned/ppd_base_profile" + rlRun "tuned-adm active" + rlRun "rm -f /etc/tuned/ppd_base_profile" + if tuned-adm active | grep -q powersave ; then + rlRun "tuned-adm profile balanced" + else + rlRun "tuned-adm profile powersave" + fi + sleep 2 + rlRun "ls -lZ /etc/tuned/ppd_base_profile" + rlRun "tuned-adm auto_profile" + rlRun "ls -lZ /etc/tuned/ppd_base_profile" + rlRun "tuned-adm verify -i" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + if [ -f /usr/lib/systemd/system/gdm.service ] ; then + sleep 2 + rlRun "service gdm stop" + fi + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/unknown-permissions-cil/main.fmf b/selinux-policy/unknown-permissions-cil/main.fmf new file mode 100644 index 0000000..3f49b3f --- /dev/null +++ b/selinux-policy/unknown-permissions-cil/main.fmf @@ -0,0 +1,20 @@ +summary: test coverage for Unknown permissions are now handled as errors in CIL +description: |+ + Unknown permissions are now handled as errors in CIL +contact: Jan Janasek +component: + - selinux-policy +require: + - libselinux + - libselinux-utils + - policycoreutils-devel + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +duration: 20m +enabled: true +tier: 2 +link: + - verifies: https://issues.redhat.com/browse/SELINUX-2380 +id: 707a837f-391b-4182-a150-e0f411afffd5 diff --git a/selinux-policy/unknown-permissions-cil/runtest.sh b/selinux-policy/unknown-permissions-cil/runtest.sh new file mode 100755 index 0000000..8bf258f --- /dev/null +++ b/selinux-policy/unknown-permissions-cil/runtest.sh @@ -0,0 +1,152 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Unknown permissions are now handled as errors in CIL +# Author: Jan Janasek +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE="my_policy.cil" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "sestatus" + echo "(type my_test_domain_t)" > $FILE + echo "(type my_test_file_t)" >> $FILE + sleep 2 + rlPhaseEnd + + + rlPhaseStartTest "permission watch" + echo "(allow my_test_domain_t my_test_file_t (dir (watch)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (watching)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission that is not defined in a class" + echo "(allow my_test_domain_t my_test_file_t (dir (add_name)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (file (add_name)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission sendto" + echo "(allow my_test_domain_t my_test_file_t (node (sendto)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (node (sendsto)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (sendto)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission stop" + echo "(allow my_test_domain_t my_test_file_t (system (stop)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (system (stops)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (stop)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission reload" + echo "(allow my_test_domain_t my_test_file_t (service (reload)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (service (reloads)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (reload)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission use" + echo "(allow my_test_domain_t my_test_file_t (fd (use)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (fd (using)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (use)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission flow_in" + echo "(allow my_test_domain_t my_test_file_t (packet (flow_in)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (packet (flows_in)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (system (flow_in)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission contains" + echo "(allow my_test_domain_t my_test_file_t (context (contains)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (context (contain)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (fd (contains)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission lock" + echo "(allow my_test_domain_t my_test_file_t (shm (lock)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (shm (locked)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow my_test_domain_t my_test_file_t (system (lock)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartCleanup + rm $FILE + rlRun "semodule -r my_policy" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/selinux-policy/usbguard-daemon-and-similar/main.fmf b/selinux-policy/usbguard-daemon-and-similar/main.fmf index 1b207f2..0b882ca 100644 --- a/selinux-policy/usbguard-daemon-and-similar/main.fmf +++ b/selinux-policy/usbguard-daemon-and-similar/main.fmf @@ -1,5 +1,51 @@ -path: /selinux-policy/usbguard-daemon-and-similar -tier: 2 -adjust: -- enabled: false - when: distro < rhel-7 +summary: SELinux interferes with usbguard and related programs +description: |+ + SELinux interferes with usbguard and related programs. + +contact: Milos Malik +component: + - usbguard + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - initscripts + - usbguard + - usbguard-selinux +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - f33friendly + - fedora-wanted + - targeted + - NoRHIVOS +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1808527 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1840265 +adjust+: + - enabled: false + when: arch == s390x + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0606079 +extra-summary: /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar +extra-task: /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar +id: a551a723-5ba8-43c9-939b-1d18d4cc2153 diff --git a/selinux-policy/usbguard-daemon-and-similar/runtest.sh b/selinux-policy/usbguard-daemon-and-similar/runtest.sh index ea2c953..94fc163 100755 --- a/selinux-policy/usbguard-daemon-and-similar/runtest.sh +++ b/selinux-policy/usbguard-daemon-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -41,7 +40,7 @@ PROCESS_CONTEXT="usbguard_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -78,6 +77,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "semodule -lfull | grep usbguard" @@ -86,9 +86,10 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/usbmuxd-and-similar/Makefile b/selinux-policy/usbmuxd-and-similar/Makefile new file mode 100644 index 0000000..d397168 --- /dev/null +++ b/selinux-policy/usbmuxd-and-similar/Makefile @@ -0,0 +1,73 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +# Description: SELinux interferes with usbmuxd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/usbmuxd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with usbmuxd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: usbmuxd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console usbmuxd initscripts" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1521054" >> $(METADATA) # RHEL-7 + @echo "Bug: 1582205" >> $(METADATA) # RHEL-7 + @echo "Bug: 1930992" >> $(METADATA) # Fedora 33 + @echo "Bug: 1936705" >> $(METADATA) # Fedora 34 + @echo "Bug: 1959747" >> $(METADATA) # Fedora 35 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/usbmuxd-and-similar/PURPOSE b/selinux-policy/usbmuxd-and-similar/PURPOSE new file mode 100644 index 0000000..b81475e --- /dev/null +++ b/selinux-policy/usbmuxd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +Author: Milos Malik + +SELinux interferes with usbmuxd and related programs. + diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf new file mode 100644 index 0000000..c3e9fe8 --- /dev/null +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -0,0 +1,58 @@ +summary: SELinux interferes with usbmuxd and related programs +description: |+ + SELinux interferes with usbmuxd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - usbmuxd + - initscripts +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TipWaived7 + - f31friendly + - f32friendly + - targeted + - NoRHIVOS +tier: 3 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1521054 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1582205 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1930992 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1936705 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1959747 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965411 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1973886 +adjust+: + - enabled: false + when: distro >= rhel-9 + because: the usbmuxd package is not available there + - enabled: false + when: distro >= centos-stream-9 + because: the usbmuxd package is not available there + - enabled: false + when: arch == aarch64, s390x + continue: false +extra-nitrate: TC#0300434 +extra-summary: /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +id: 2e39eebe-4456-4b06-90c0-1d2fd4e931a7 diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh new file mode 100755 index 0000000..76928a7 --- /dev/null +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -0,0 +1,123 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +# Description: SELinux interferes with usbmuxd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/usbmuxd" +FILE_CONTEXT="usbmuxd_exec_t" +SERVICE_PACKAGE="usbmuxd" +SERVICE_NAME="usbmuxd" +PROCESS_NAME="usbmuxd" +PROCESS_CONTEXT="usbmuxd_t" + +rlJournalStart + if rlIsRHEL && ! rlIsRHEL 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1521054 + bz#1582205" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/run/udev/data" "udev_var_run_t" + rlSEMatchPathCon "/run/udev/data/c189:0" "udev_var_run_t" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" + rlSESearchRule "allow usbmuxd_t udev_var_run_t : dir { getattr open search } [ ]" + rlSESearchRule "allow usbmuxd_t udev_var_run_t : file { getattr open read } [ ]" + rlPhaseEnd + + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + rlPhaseStartTest "bz#1930992" + rlSEMatchPathCon "/sys" "sysfs_t" + rlSESearchRule "allow usbmuxd_t sysfs_t : filesystem { getattr } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1936705" + rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t" + rlSESearchRule "allow usbmuxd_t cgroup_t : filesystem { getattr } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1959747" + rlRun "ls -dZ /proc/1 | grep :init_t" + rlRun "ls -Z /proc/1/environ | grep :init_t" + rlSESearchRule "dontaudit usbmuxd_t init_t : dir { search } [ ]" + rlSESearchRule "dontaudit usbmuxd_t init_t : file { getattr open read ioctl } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/valkey-and-similar/Makefile b/selinux-policy/valkey-and-similar/Makefile new file mode 100644 index 0000000..e194474 --- /dev/null +++ b/selinux-policy/valkey-and-similar/Makefile @@ -0,0 +1,72 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/valkey-and-similar +# Description: SELinux interferes with valkey and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/valkey-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with valkey and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: valkey" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console valkey /usr/sbin/service valkey-rdma" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-102631" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-108982" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-154814" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-161115" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/valkey-and-similar/PURPOSE b/selinux-policy/valkey-and-similar/PURPOSE new file mode 100644 index 0000000..e131f98 --- /dev/null +++ b/selinux-policy/valkey-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/valkey-and-similar +Author: Milos Malik + +SELinux interferes with valkey-server, valkey-sentinel and related programs. + diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf new file mode 100644 index 0000000..6a1b18b --- /dev/null +++ b/selinux-policy/valkey-and-similar/main.fmf @@ -0,0 +1,51 @@ +summary: SELinux interferes with valkey and related programs +description: |+ + SELinux interferes with valkey-server, valkey-sentinel and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - valkey + - valkey-rdma + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tier: '3' +link: + - verifies: https://issues.redhat.com/browse/RHEL-102631 + - verifies: https://issues.redhat.com/browse/RHEL-108982 + - verifies: https://issues.redhat.com/browse/RHEL-154814 + - verifies: https://issues.redhat.com/browse/RHEL-161115 +tag: + - Tier3 + - Tier3se + - NoRHIVOS + - avoidImageMode +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the package is not available there + - enabled: false + when: distro ~< rhel-9.8 + because: RHEL-108982 was fixed only here in rhel-9 + - enabled: false + when: distro ~< rhel-10.1 + because: RHEL-102631 was fixed only here in rhel-10 +extra-nitrate: TC#0619564 +id: 337de041-c42f-4292-99d4-f687ec629fc9 diff --git a/selinux-policy/valkey-and-similar/runtest.sh b/selinux-policy/valkey-and-similar/runtest.sh new file mode 100755 index 0000000..8b2830d --- /dev/null +++ b/selinux-policy/valkey-and-similar/runtest.sh @@ -0,0 +1,109 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/valkey-and-similar +# Description: SELinux interferes with valkey and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_CONTEXT="redis_exec_t" +SERVICE_PACKAGE="valkey" +SERVICE_NAME="valkey" +PROCESS_NAME="valkey-server" +PROCESS_CONTEXT="redis_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if rpm -qa | grep -q valkey ; then + rlAssertRpm ${SERVICE_PACKAGE} + rlServiceStop valkey valkey-sentinel + fi + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-102631" + rlSEMatchPathCon `which valkey-server` ${FILE_CONTEXT} + rlSEMatchPathCon `which valkey-sentinel` ${FILE_CONTEXT} + rlSEMatchPathCon "/etc/valkey" "redis_conf_t" + rlSEMatchPathCon "/etc/valkey/sentinel.conf" "redis_conf_t" + rlSEMatchPathCon "/etc/valkey/valkey.conf" "redis_conf_t" + rlSEMatchPathCon "/var/log/valkey" "redis_log_t" + rlSEMatchPathCon "/var/lib/valkey" "redis_var_lib_t" + rlSEMatchPathCon "/var/run/valkey" "redis_var_run_t" + rlSEMatchPathCon "/usr/lib/systemd/system/valkey-sentinel.service" "redis_unit_file_t" + rlSEMatchPathCon "/usr/lib/systemd/system/valkey.service" "redis_unit_file_t" + rlPhaseEnd + + if rpm -q valkey-rdma >& /dev/null ; then + rlPhaseStartTest "RHEL-154814 + RHEL-161115" + rlSESearchRule "allow redis_t redis_t : netlink_rdma_socket { getattr create setopt bind } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- ${SERVICE_NAME} service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlWatchdog "valkey-cli --stat" 10 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + SERVICE_NAME="valkey-sentinel" + PROCESS_NAME="valkey-sentinel" + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- ${SERVICE_NAME} service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlWatchdog "valkey-cli --stat -u valkey://default:PASSWORD@localhost:26379/0" 10 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlServiceRestore valkey valkey-sentinel + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile new file mode 100644 index 0000000..1a55b01 --- /dev/null +++ b/selinux-policy/virt-install-additional/Makefile @@ -0,0 +1,82 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/virt-install-additional +# Description: SELinux interferes with virt-install and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/virt-install-additional +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with virt-install and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit usbutils lsscsi" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Architectures: aarch64 s390x x86_64" >> $(METADATA) + @echo "Bug: RHEL-56029" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-65038" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65266" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65373" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65383" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65385" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65789" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69118" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69920" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-74230" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-76104" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-98559" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-101417" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-236185" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/virt-install-additional/PURPOSE b/selinux-policy/virt-install-additional/PURPOSE new file mode 100644 index 0000000..abe4221 --- /dev/null +++ b/selinux-policy/virt-install-additional/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/virt-install-additional +Author: Milos Malik + +SELinux interferes with virt-install and related programs. +Also covers: numad. diff --git a/selinux-policy/virt-install-additional/dimm.xml b/selinux-policy/virt-install-additional/dimm.xml new file mode 100644 index 0000000..326c928 --- /dev/null +++ b/selinux-policy/virt-install-additional/dimm.xml @@ -0,0 +1,6 @@ + + + 524287 + 0 + + diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf new file mode 100644 index 0000000..cdd36ae --- /dev/null +++ b/selinux-policy/virt-install-additional/main.fmf @@ -0,0 +1,68 @@ +summary: SELinux interferes with virt-install and related programs. +description: |+ + SELinux interferes with virt-install and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/service + - setools-console + - virt-install + - libvirt-client + - numad + - nbdkit + - usbutils + - lsscsi +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - kernel-rt + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - failinfedora + - NoRHIVOS + - avoidImageMode +link: + - verifies: https://issues.redhat.com/browse/RHEL-56029 + - verifies: https://issues.redhat.com/browse/RHEL-65038 + - verifies: https://issues.redhat.com/browse/RHEL-65266 + - verifies: https://issues.redhat.com/browse/RHEL-65373 + - verifies: https://issues.redhat.com/browse/RHEL-65383 + - verifies: https://issues.redhat.com/browse/RHEL-65385 + - verifies: https://issues.redhat.com/browse/RHEL-65789 + - verifies: https://issues.redhat.com/browse/RHEL-69118 + - verifies: https://issues.redhat.com/browse/RHEL-69920 + - verifies: https://issues.redhat.com/browse/RHEL-74230 + - verifies: https://issues.redhat.com/browse/RHEL-76104 + - verifies: https://issues.redhat.com/browse/RHEL-98559 + - verifies: https://issues.redhat.com/browse/RHEL-101417 + - verifies: https://issues.redhat.com/browse/RHEL-236185 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the test is not relevant for these RHELs + - enabled: false + when: distro == ppc64le + because: the virt-install package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/virt-install-additional +extra-task: /CoreOS/selinux-policy/Regression/virt-install-additional +extra-nitrate: TC#0617996 +id: a2688b1a-bb0f-4489-bfd0-ef573d832d8a diff --git a/selinux-policy/virt-install-additional/nodedev.xml b/selinux-policy/virt-install-additional/nodedev.xml new file mode 100644 index 0000000..7dcb0df --- /dev/null +++ b/selinux-policy/virt-install-additional/nodedev.xml @@ -0,0 +1,7 @@ + +PLACEHOLDER + + +8d312cf6-f92a-485c-8db8-ba9299848f46 + + diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh new file mode 100755 index 0000000..35afc89 --- /dev/null +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -0,0 +1,385 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/virt-install-additional +# Description: SELinux interferes with virt-install and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm virt-install + + rlRun "yum -y install libvirt\* qemu\* --skip-broken" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-65038" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t svirt_tcg_t : lnk_file { read } [ ]" + rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getrlimit } [ ]" + rlSESearchRule "allow virtqemud_t svirt_t : process { getrlimit } [ ]" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test1 --cpu mode=maximum,check=none,migratable=on,numa.cell.id=0,numa.cell.cpus=0,numa.cell.memory=512000,numa.cell.unit="KiB" --memory maxMemory.slots=16,maxMemory=4096" 0,1 + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test1.*running'" + rlWatchdog "virsh attach-device test1 dimm.xml" 30 + sleep 10 + rlRun "virsh destroy test1" + rlRun "virsh undefine test1" 0,1 + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-65373" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t virtqemud_t : tun_socket { relabelto relabelfrom } [ ]" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test2 --network type=network,mac.address='52:54:00:ee:01:68',source=default,model.type=virtio,driver.queues=4" 0,1 + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test2.*running'" + rlRun "virsh destroy test2" + rlRun "virsh undefine test2" 0,1 + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-65383" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test3 --network type=network,mac.address='52:54:00:23:f2:12',source=default,model.type=virtio --xml xpath.set=./devices/interface/port/@isolated=yes" 0,1 + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test3.*running'" + rlRun "virsh destroy test3" + rlRun "virsh undefine test3" 0,1 + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-65789" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t numad_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "allow virtqemud_t numad_t : process { transition } [ ]" + rlSESearchRule "type_transition virtqemud_t numad_exec_t : process numad_t" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test4 --numatune memory.mode='strict',memory.placement='auto'" 0,1 + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test4.*running'" + rlRun "virsh destroy test4" + rlRun "virsh undefine test4" 0,1 + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-56029 + RHEL-69118" + if rlIsRHEL 9 || rlIsCentOS 9 ; then + rlSESearchRule "allow virtd_t nbdkit_exec_t : file { entrypoint } [ ]" + elif rlIsRHEL 10 || rlIsCentOS 10 ; then + rlSESearchRule "allow virtqemud_t nbdkit_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "allow virtqemud_t nbdkit_t : process { transition } [ ]" + rlSESearchRule "type_transition virtqemud_t nbdkit_exec_t : process nbdkit_t" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlFileBackup /etc/libvirt/qemu.conf + rlRun "sed -i 's/^.*storage_use_nbdkit.*=.*$/storage_use_nbdkit = 1/' /etc/libvirt/qemu.conf" + rlRun "grep storage_use_nbdkit /etc/libvirt/qemu.conf" + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=localhost,source.host0.port=22 --wait 0 --name test5" 0,1 + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test5.*running'" + rlRun "virsh destroy test5" + rlRun "virsh undefine test5" 0,1 + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlFileRestore + rlPhaseEnd + + rlPhaseStartTest "RHEL-69920" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t svirt_t : process { getsched } [ ]" + rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getsched } [ ]" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test6" 0,1 + sleep 30 + rlRun "virsh vcpuinfo test6" + rlRun "virsh list" + rlRun "virsh list | grep 'test6.*running'" + rlRun "virsh destroy test6" + rlRun "virsh undefine test6" 0,1 + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-74230" + rlSEMatchPathCon "/dev/bus/usb/001/001" "usb_device_t" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { getattr } [ ]" + rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { open read write lock setattr } [ virt_use_usb ]" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "service virtnodedevd start" + rlRun "lsusb -t" + # USB devices may not be available + rlRun "virsh nodedev-list | grep usb" 0,1 + for USB_ID in `virsh nodedev-list | grep usb` ; do + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${USB_ID} --host-device ${USB_ID}" 0,1 + done + sleep 10 + rlRun "virsh list" + for VM_NAME in `virsh list --name` ; do + rlRun "virsh destroy ${VM_NAME}" + rlRun "virsh undefine ${VM_NAME}" 0,1 + done + rlRun "service virtnodedevd stop" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-76104" + rlSEMatchPathCon "/dev/sg0" "scsi_generic_device_t" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t scsi_generic_device_t : chr_file { getattr open read write lock setattr } [ ]" + fi + rlRun "modprobe scsi_debug ptype=5" + sleep 2 + rlRun "lsscsi -gs" + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "service virtnodedevd start" + # SCSI devices may not be available + rlRun "virsh nodedev-list | grep scsi" 0,1 + for SCSI_ID in `virsh nodedev-list | grep scsi` ; do + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${SCSI_ID} --host-device ${SCSI_ID}" 0,1 + done + sleep 10 + rlRun "virsh list" + for VM_NAME in `virsh list --name` ; do + rlRun "virsh destroy ${VM_NAME}" + rlRun "virsh undefine ${VM_NAME}" 0,1 + done + rlRun "service virtnodedevd stop" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlRun "modprobe -r scsi_debug" + rlPhaseEnd + + rlPhaseStartTest "RHEL-65266" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + fi + rlRun "service virtqemud start" + rlRun "service virtnodedevd start" + rlRun "mkdir -p devices" + rlRun "pushd devices" + rlRun "virsh nodedev-list" + for I in `virsh nodedev-list` ; do + rlRun "virsh nodedev-dumpxml $I > $I" + done + if grep balloon * ; then + J=`grep -l balloon *` + rlRun "virsh nodedev-reattach $J" + else + rlLog "no balloon device was found - cannot reattach it" + fi + rlRun "popd" + rlRun "rm -rf devices" + sleep 2 + rlRun "service virtnodedevd stop" + rlRun "service virtqemud stop" + rlPhaseEnd + + rlPhaseStartTest "RHEL-65385" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "virsh net-list" + rlRun "virsh net-dumpxml default > default.xml" + rlRun "virsh net-destroy default" + rlRun "virsh net-undefine default" + rlRun "sed -i \"s/^\(.*bridge\) \(.*\)$/\1 macTableManager='libvirt' \2/\" default.xml" + rlRun "virsh net-create ./default.xml" + sleep 2 + rlRun "virsh net-list" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test7" 0,1 + sleep 10 + rlRun "virsh list" + rlRun "virsh list | grep 'test7.*running'" + rlRun "virsh destroy test7" + rlRun "virsh undefine test7" 0,1 + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-98559" + if rlSEDefined "virtnodedevd_t mdevctl_conf_t" ; then + rlSEMatchPathCon "/etc/mdevctl.d" "mdevctl_conf_t" + rlSESearchRule "allow virtnodedevd_t mdevctl_conf_t : dir { create } [ ]" + fi + rlRun "service virtqemud start" + rlRun "service virtnodedevd start" + rlRun "virsh nodedev-list | grep pci" + LAST_PCI_DEVICE=`virsh nodedev-list | grep pci | tail -n 1` + rlRun "sed -i \"s/PLACEHOLDER/${LAST_PCI_DEVICE}/\" nodedev.xml" + rlRun "cat nodedev.xml" + rlRun "virsh nodedev-define ./nodedev.xml" + sleep 1 + rlRun "service virtnodedevd stop" + rlRun "service virtqemud stop" + rlPhaseEnd + + rlPhaseStartTest "RHEL-101417" + if [ -d /sys/bus/pci/devices ] ; then + rlRun "find /sys/bus/pci/devices -type f -name config -ls" + fi + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + fi + rlRun "service virtqemud start" + rlRun "service virtnodedevd start" + rlRun "virsh nodedev-list | grep pci" + for I in `virsh nodedev-list | grep pci` ; do + rlRun "virsh nodedev-reset $I" 0,1 + sleep 1 + done + rlRun "service virtnodedevd stop" + rlRun "service virtqemud stop" + rlPhaseEnd + + rlPhaseStartTest "RHEL-236185" + rlSEMatchPathCon "/usr/bin/udevadm" "udev_exec_t" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t udev_exec_t : file { execute map } [ ]" + rlSESearchRule "type_transition virtqemud_t udev_exec_t : process udev_t" + rlSESearchRule "allow virtqemud_t udev_t : process { transition } [ ]" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/virtualization-daemons/Makefile b/selinux-policy/virtualization-daemons/Makefile new file mode 100644 index 0000000..3ae25e6 --- /dev/null +++ b/selinux-policy/virtualization-daemons/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/virtualization-daemons +# Description: Various virtualization daemons are confined by SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/virtualization-daemons +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Various virtualization daemons are confined by SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: libvirt" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service libvirt-daemon libvirt-daemon-common libvirt-client libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-lxc libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage-core libvirt-daemon-driver-vbox">> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2291273" >> $(METADATA) # Fedora 41 + @echo "Bug: RHEL-40834" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-77620" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/virtualization-daemons/PURPOSE b/selinux-policy/virtualization-daemons/PURPOSE new file mode 100644 index 0000000..e3776a9 --- /dev/null +++ b/selinux-policy/virtualization-daemons/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/virtualization-daemons +Author: Milos Malik + +Various virtualization daemons are confined by SELinux. Do they work +as expected? + diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf new file mode 100644 index 0000000..73b3f8c --- /dev/null +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -0,0 +1,62 @@ +summary: SELinux interferes with various virtualization daemons. +description: |+ + SELinux interferes with various virtualization daemons. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - libvirt-client + - libvirt-daemon + - libvirt-daemon-common + - libvirt-daemon-driver-interface + - libvirt-daemon-driver-libxl + - libvirt-daemon-driver-lxc + - libvirt-daemon-driver-network + - libvirt-daemon-driver-nodedev + - libvirt-daemon-driver-nwfilter + - libvirt-daemon-driver-qemu + - libvirt-daemon-driver-secret + - libvirt-daemon-driver-storage-core + - libvirt-daemon-driver-vbox +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2291273 + - verifies: https://issues.redhat.com/browse/RHEL-40834 + - verifies: https://issues.redhat.com/browse/RHEL-77620 +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - failinfedora + - NoRHIVOS + - avoidImageMode +adjust+: + - enabled: false + when: distro < centos-stream-9 + because: the virtualization daemons are not available there + - enabled: false + when: distro < rhel-9 + because: the virtualization daemons are not available there +extra-nitrate: TC#0617680 +id: 1f7a8a37-7977-4ee0-8b8a-979c03aff369 diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh new file mode 100755 index 0000000..a142de9 --- /dev/null +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -0,0 +1,223 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/virtualization-daemons +# Description: Various virtualization daemons are confined by SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_NAMES="libvirtd virtinterfaced virtlockd virtlogd virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd virtxend" +if seinfo -a | grep -q virt_driver_domain ; then +ALL_TUPLES="libvirtd:libvirtd:virtd_t \ + virtinterfaced:virtinterfaced:virtinterfaced_t \ + virtlockd:virtlockd:virtlogd_t \ + virtlogd:virtlogd:virtlogd_t \ + virtlxcd:virtlxcd:virtd_lxc_t \ + virtnetworkd:virtnetworkd:virtnetworkd_t \ + virtnodedevd:virtnodedevd:virtnodedevd_t \ + virtnwfilterd:virtnwfilterd:virtnwfilterd_t \ + virtproxyd:virtproxyd:virtproxyd_t \ + virtqemud:virtqemud:virtqemud_t \ + virtsecretd:virtsecretd:virtsecretd_t \ + virtstoraged:virtstoraged:virtstoraged_t \ + virtvboxd:virtvboxd:virtvboxd_t" +# virtxend:virtxend:virtxend_t" +else +ALL_TUPLES="libvirtd:libvirtd:virtd_t \ + virtinterfaced:virtinterfaced:virtd_t \ + virtlockd:virtlockd:virtlogd_t \ + virtlogd:virtlogd:virtlogd_t \ + virtlxcd:virtlxcd:virtd_t \ + virtnetworkd:virtnetworkd:virtd_t \ + virtnodedevd:virtnodedevd:virtd_t \ + virtnwfilterd:virtnwfilterd:virtd_t \ + virtproxyd:virtproxyd:virtd_t \ + virtqemud:virtqemud:virtd_t \ + virtsecretd:virtsecretd:virtd_t \ + virtstoraged:virtstoraged:virtd_t \ + virtvboxd:virtvboxd:virtd_t" +# virtxend:virtxend:virtd_t +fi +INSTALL_OPTION="" +if yum --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if yum install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if yum install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qa libvirt\*" + + rlServiceStop ${SERVICE_NAMES} + rlFileBackup /etc/shadow + rlRun "yum -y install libvirt\* -x \*devel ${INSTALL_OPTION}" 0-255 + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + if seinfo -a | grep -q virt_driver_domain ; then + rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtinterfaced_exec_t" + rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_lxc_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtnetworkd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnodedevd" "virtnodedevd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnwfilterd" "virtnwfilterd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtproxyd" "virtproxyd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtqemud" "virtqemud_exec_t" + rlSEMatchPathCon "/usr/sbin/virtsecretd" "virtsecretd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtstoraged" "virtstoraged_exec_t" + rlSEMatchPathCon "/usr/sbin/virtvboxd" "virtvboxd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtxend" "virtxend_exec_t" + else + rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnodedevd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnwfilterd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtproxyd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtqemud" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtsecretd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtstoraged" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtvboxd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtxend" "virtd_exec_t" + fi + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + # start all the services + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + fi + done + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + # restart all the services + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "virt-admin -c ${SERVICE_NAME}:///system exit" 0,1 + fi + done + # stop all the services + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + fi + done + rlPhaseEnd + + if seinfo -a | grep -q virt_driver_domain ; then + rlPhaseStartTest "RHEL-77620" + rlSEMatchPathCon "/usr/bin/virt-admin" "bin_t" + rlSESearchRule "type_transition init_t bin_t : process unconfined_service_t" + rlSESearchRule "allow virtqemud_t unconfined_service_t : dir { search } [ ]" + rlSESearchRule "allow virtqemud_t unconfined_service_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- admin sockets" + # start all admin sockets + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then + rlRun "systemctl start ${SERVICE_NAME}-admin.socket" + fi + done + # connect to the services via admin sockets + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then + rlRun "virt-admin -c ${SERVICE_NAME}:///system client-list admin" 0,1 + rlRun "systemd-run virt-admin -c ${SERVICE_NAME}:///system server-list" 0,1 + fi + done + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + # stop all admin sockets + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then + rlRun "systemctl stop ${SERVICE_NAME}-admin.socket" + fi + done + rlPhaseEnd + + if seinfo -a | grep -q virt_driver_domain ; then + rlPhaseStartTest "bz#2291273 + RHEL-40834" + rlSESearchRule "allow virtnetworkd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtnetworkd_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtnodedevd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtnodedevd_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtnwfilterd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtnwfilterd_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtsecretd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtsecretd_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtstoraged_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtstoraged_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtvboxd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtvboxd_t unconfined_t : file { open read } [ ]" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAMES} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/watch-permissions/Makefile b/selinux-policy/watch-permissions/Makefile new file mode 100644 index 0000000..52ffa08 --- /dev/null +++ b/selinux-policy/watch-permissions/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/watch-permissions +# Description: Are various watch permissions defined in SELinux policy? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/watch-permissions +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Are various watch permissions defined in SELinux policy?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit git libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 1915034" >> $(METADATA) # Fedora rawhide + + rhts-lint $(METADATA) + diff --git a/selinux-policy/watch-permissions/PURPOSE b/selinux-policy/watch-permissions/PURPOSE new file mode 100644 index 0000000..6cdb8e4 --- /dev/null +++ b/selinux-policy/watch-permissions/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/watch-permissions +Author: Milos Malik + +Description: Are various watch permissions defined in SELinux policy? + diff --git a/selinux-policy/watch-permissions/main.fmf b/selinux-policy/watch-permissions/main.fmf new file mode 100644 index 0000000..ad23040 --- /dev/null +++ b/selinux-policy/watch-permissions/main.fmf @@ -0,0 +1,33 @@ +path: /selinux-policy/watch-permissions +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - git + - libselinux + - libselinux-utils + - policycoreutils + - setools-console + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915034 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the watch permission is not defined there +extra-nitrate: TC#0615395 +id: c4421242-0b97-4a1e-abbb-1dbe5dd21355 +tag: + - NoRHIVOS diff --git a/selinux-policy/watch-permissions/runtest.sh b/selinux-policy/watch-permissions/runtest.sh new file mode 100755 index 0000000..aa26229 --- /dev/null +++ b/selinux-policy/watch-permissions/runtest.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/watch-permissions +# Description: Are various watch permissions defined in SELinux policy? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1915034" + for PERM in watch watch_mount watch_sb watch_with_perm watch_reads ; do + rlRun "seinfo --common file -x | grep -w ${PERM}" + done + rlRun "seinfo -c filesystem -x | grep -w watch" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/setools/apol/Makefile b/setools/apol/Makefile new file mode 100644 index 0000000..c3390e4 --- /dev/null +++ b/setools/apol/Makefile @@ -0,0 +1,65 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/setools/Sanity/apol +# Description: basic apol testing +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/setools/Sanity/apol +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: basic apol test" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: setools" >> $(METADATA) + @echo "Requires: setools-console setools-gui tigervnc-server selinux-policy-mls selinux-policy-targeted gnome-session-xsession gnome-shell" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-29967" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/setools/apol/PURPOSE b/setools/apol/PURPOSE new file mode 100644 index 0000000..0b80714 --- /dev/null +++ b/setools/apol/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/setools/Sanity/apol +Author: Milos Malik + +Is apol able to run? + diff --git a/setools/apol/main.fmf b/setools/apol/main.fmf new file mode 100644 index 0000000..43a9e88 --- /dev/null +++ b/setools/apol/main.fmf @@ -0,0 +1,38 @@ +summary: basic apol test +description: |+ + Is apol able to run? + +contact: Milos Malik +component: + - setools +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - gnome-shell + - gnome-session-xsession + - setools-console + - setools-gui + - tigervnc-server + - selinux-policy-mls + - selinux-policy-targeted +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://issues.redhat.com/browse/RHEL-29967 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-10 + continue: false +extra-summary: /CoreOS/setools/Sanity/apol +extra-task: /CoreOS/setools/Sanity/apol +extra-nitrate: TC#0617470 diff --git a/setools/apol/runtest.sh b/setools/apol/runtest.sh new file mode 100755 index 0000000..32f2aa4 --- /dev/null +++ b/setools/apol/runtest.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setools/Sanity/apol +# Description: basic apol testing +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep setools" + for POLICY_KIND in mls targeted ; do + rlAssertRpm selinux-policy-${POLICY_KIND} + done + rlFileBackup /etc/tigervnc/vncserver.users + rlPhaseEnd + + rlPhaseStartTest "real scenario -- RHEL-29967" + USER_NAME="toor" + USER_SECRET="S3kr3t${RANDOM}" + if ! grep -q ":10=${USER_NAME}" /etc/tigervnc/vncserver.users ; then + rlRun "echo -en '\n:10=${USER_NAME}\n' >> /etc/tigervnc/vncserver.users" + fi + rlRun "useradd -o -u 0 -g 0 ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "mkdir -p /home/${USER_NAME}/.config" + rlRun "mkdir -p /home/${USER_NAME}/.vnc" + rlRun "echo ${USER_SECRET} | vncpasswd -f > /home/${USER_NAME}/.vnc/passwd" + rlRun "chmod go= /home/${USER_NAME}/.vnc/passwd" + rlRun "ls -l /home/${USER_NAME}/.vnc/" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "systemctl enable vncserver@:10.service" + rlRun "systemctl start vncserver@:10.service" + sleep 15 + rlRun "cat /home/${USER_NAME}/.vnc/*.log" + rlRun "systemctl status vncserver@:10.service" + for POLICY_KIND in mls targeted ; do + rlRun "cp /etc/selinux/${POLICY_KIND}/policy/policy.* /home/${USER_NAME}/policy.${POLICY_KIND}" + rlWatchdog "DISPLAY=:10 apol -v /home/${USER_NAME}/policy.${POLICY_KIND} >& output.txt" 30 + rlRun "grep -i 'success.*open.*permission map' output.txt" + rlRun "grep -i 'success.*open.*policy' output.txt" + rlRun "grep -i -e traceback -e error output.txt" 1 + done + rlRun "systemctl stop vncserver@:10.service" + rlRun "systemctl status vncserver@:10.service" 3 + rlRun "systemctl disable vncserver@:10.service" + sleep 15 + rlRun "userdel -rfZ ${USER_NAME}" + rlPhaseEnd + + rlPhaseStartCleanup + rlFileRestore + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/setools/rebuild-from-srpm/main.fmf b/setools/rebuild-from-srpm/main.fmf new file mode 100644 index 0000000..ae3136d --- /dev/null +++ b/setools/rebuild-from-srpm/main.fmf @@ -0,0 +1,33 @@ +summary: Can setools be built from its source RPM? +contact: Milos Malik +component: + - setools +test: ./runtest.sh +framework: beakerlib +recommend: + - dnf-utils + - rpm-build + - libsepol + - libsemanage + - libselinux + - policycoreutils +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - avoidImageMode +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2251915 + - verifies: https://issues.redhat.com/browse/RHEL-18067 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0616295 +id: 37430912-7a9e-40e7-a569-cbef9529b9e3 diff --git a/setools/rebuild-from-srpm/runtest.sh b/setools/rebuild-from-srpm/runtest.sh new file mode 100755 index 0000000..cf031ab --- /dev/null +++ b/setools/rebuild-from-srpm/runtest.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm libsepol + rlAssertRpm libsemanage + rlAssertRpm libselinux + rlAssertRpm policycoreutils + if ! rpm -q rpm-build ; then + rlRun "yum -y install rpm-build" 0-255 + fi + + rlRun "rm -f setools*.src.rpm" + rlRun "yumdownloader --source setools" + rlRun "ls -l setools*src.rpm" + rlPhaseEnd + + rlPhaseStartTest "bz#2251915 + RHEL-18067" + if rlIsRHEL ; then + rlRun "yum-builddep -y setools --enablerepo '*CRB'" + elif rlIsCentOS ; then + rlRun "yum-builddep -y setools --enablerepo crb" + else # Fedora + rlRun "yum-builddep -y setools" + fi + rlRun "rpmbuild --rebuild setools*.src.rpm" + rlRun "ls -lR ~/rpmbuild/RPMS | grep setools" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f setools*.src.rpm" + rlPhaseEnd +rlJournalEnd + diff --git a/setools/seinfo/Makefile b/setools/seinfo/Makefile new file mode 100644 index 0000000..1906663 --- /dev/null +++ b/setools/seinfo/Makefile @@ -0,0 +1,77 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/setools/Sanity/seinfo +# Description: Does seinfo work well? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/setools/Sanity/seinfo +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does seinfo work well? Does it support all features?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) + @echo "RunFor: setools" >> $(METADATA) + @echo "Requires: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: diffutils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 499247" >> $(METADATA) # Fedora + @echo "Bug: 584286" >> $(METADATA) # RHEL-5 + @echo "Bug: 649699" >> $(METADATA) # RHEL-5 + @echo "Bug: 650092" >> $(METADATA) # RHEL-6 + @echo "Bug: 739628" >> $(METADATA) # RHEL-6 + @echo "Bug: 928705" >> $(METADATA) # RHEL-7 + @echo "Bug: 1581761" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/setools/seinfo/PURPOSE b/setools/seinfo/PURPOSE new file mode 100644 index 0000000..206824a --- /dev/null +++ b/setools/seinfo/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/setools/Sanity/seinfo +Author: Milos Malik + +Does seinfo work well? Does it support all features? + diff --git a/setools/seinfo/main.fmf b/setools/seinfo/main.fmf new file mode 100644 index 0000000..0803d4e --- /dev/null +++ b/setools/seinfo/main.fmf @@ -0,0 +1,45 @@ +summary: Does seinfo work well? Does it support all features? +description: |+ + Does seinfo work well? Does it support all features? + +contact: Milos Malik +component: + - setools +test: ./runtest.sh +framework: beakerlib +recommend: + - setools + - setools-console + - selinux-policy + - selinux-policy-targeted + - grep + - diffutils +duration: 20m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - TipWaived5 + - TipWaived6 + - f31friendly + - f32friendly + - failinrhel8ci + - targeted +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=499247 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=584286 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=649699 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=650092 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739628 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=928705 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1581761 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=920981 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1581848 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0067249 +extra-summary: /CoreOS/setools/Sanity/seinfo +extra-task: /CoreOS/setools/Sanity/seinfo diff --git a/setools/seinfo/runtest.sh b/setools/seinfo/runtest.sh new file mode 100755 index 0000000..46e4b4e --- /dev/null +++ b/setools/seinfo/runtest.sh @@ -0,0 +1,198 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setools/Sanity/seinfo +# Description: Does seinfo work well? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="setools" + +rlJournalStart + rlPhaseStartSetup + if rlIsRHEL 5 ; then + rlAssertRpm ${PACKAGE} + else + rlAssertRpm ${PACKAGE}-console + fi + rlAssertRpm selinux-policy + rlAssertRpm selinux-policy-targeted + SHORT_OUTPUT=`mktemp` + LONG_OUTPUT=`mktemp` + rlPhaseEnd + + if seinfo --version | grep -q '3\.3' ; then + rlPhaseStartTest "bz#499247 + bz#584286" + rlRun "seinfo" + rlRun "seinfo --version" + rlRun "seinfo --stats" + for CLASS in "capability" ; do + rlRun "SIMPLE_COUNT=\`seinfo -c${CLASS} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -c${CLASS} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + done + + for TYPE in "root_t" ; do + rlRun "SIMPLE_COUNT=\`seinfo -t${TYPE} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -t${TYPE} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + done + + if ! rlIsRHEL 5 ; then + ATTRIBUTE="domain" + else + ATTRIBUTE="@ttr0135" + fi + rlRun "SIMPLE_COUNT=\`seinfo -a${ATTRIBUTE} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -a${ATTRIBUTE} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + + for ROLE in "sysadm_r" ; do + rlRun "SIMPLE_COUNT=\`seinfo -r${ROLE} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -r${ROLE} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + done + + for USER in "root" ; do + rlRun "SIMPLE_COUNT=\`seinfo -u${USER} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -u${USER} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + done + + for BOOLEAN in "ftpd_connect_db" ; do + rlRun "SIMPLE_COUNT=\`seinfo -b${BOOLEAN} | wc -c\`" + rlAssertGreater "the output without details should be short" ${SIMPLE_COUNT} 10 + rlRun "EXPANDED_COUNT=\`seinfo -x -b${BOOLEAN} | wc -c\`" + rlAssertGreater "the output with details should be longer" ${EXPANDED_COUNT} ${SIMPLE_COUNT} + done + + if rlIsRHEL 5 ; then + for OPTION_PAIR in \ + "-c|--classes" \ + "-t|--types" \ + "-a|--attribs" \ + "-r|--roles" \ + "-u|--users" \ + "-b|--boolean" \ + "-S|--sensitivities" \ + "-C|--categories" \ + "-f|--fs_use" \ + "-g|--genfscon" \ + "-n|--netifcon" \ + "-o|--nodecon" \ + "-p|--portcon" \ + "-i|--initialsid" ; do + SHORT_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 1` + rlRun "seinfo ${SHORT_OPTION} >& ${SHORT_OUTPUT}" + LONG_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 2` + rlRun "seinfo ${LONG_OPTION} >& ${LONG_OUTPUT}" + rlRun "diff ${SHORT_OUTPUT} ${LONG_OUTPUT} >& /dev/null" + done + else + for OPTION_PAIR in \ + "-c|--class" \ + "-t|--type" \ + "-a|--attribute" \ + "-r|--role" \ + "-u|--user" \ + "-b|--bool" ; do + SHORT_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 1` + rlRun "seinfo ${SHORT_OPTION} >& ${SHORT_OUTPUT}" + LONG_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 2` + rlRun "seinfo ${LONG_OPTION} >& ${LONG_OUTPUT}" + rlRun "diff ${SHORT_OUTPUT} ${LONG_OUTPUT} >& /dev/null" + done + fi + rlPhaseEnd + fi + + if false ; then # both bugs were closed as WONTFIX + rlPhaseStartTest "bz#649699 + bz#650092" + for SHORT_OPTION in "-c" "-t" "-a" "-r" "-u" "-b" ; do + rlRun "seinfo ${SHORT_OPTION}xyz" 1-255 + done + for LONG_OPTION in "--class" "--sensitivity" "--category" "--type" "--attribute" \ + "--role" "--user" "--bool" "--constrain" "--initialsid" "--fs_use" "--genfscon" \ + "--netifcon" "--nodecon" "--all" "--portcon --protocol" "--expand" "--stats" \ + "--version" "--help"; do + rlRun "seinfo ${LONG_OPTION}=xyz" 1-255 + done + rlPhaseEnd + fi + + rlPhaseStartTest "bz#739628" + rlRun "seinfo -r | grep -v -e Roles: -e _r$ -e ^$" 1 + rlRun "seinfo -u | grep -v -e Users: -e _u$ -e ^$ -e root$" 1 + rlRun "seinfo -t | grep -v -e Types: -e _t$ -e ^$" 1 + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#928705 + bz#1581761" + rlRun "seinfo -tspamc_t -x | grep -i alias" + rlRun "seinfo -tspamc_t -x | grep spamc_t" + rlRun "seinfo -tspamc_t -x | grep spamassassin_t" + rlRun "seinfo -tspamassassin_t -x | grep -i alias" + rlRun "seinfo -tspamassassin_t -x | grep spamassassin_t" + rlRun "seinfo -tspamassassin_t -x | grep -i spamc_t" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#1029837" + # there is a difference when seinfo analyzes the policy file stored under /etc/selinux and the active policy stored in the SELinux file-system + if rlIsRHEL 5 6 ; then + SELINUX_FS="/selinux" + else + SELINUX_FS="/sys/fs/selinux" + fi + rlRun "seinfo ${SELINUX_FS}/policy" + for POLICY_TYPE in minimum mls targeted ; do + if [ -f /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then + rlRun "seinfo /etc/selinux/${POLICY_TYPE}/policy/policy.*" + fi + done + rlPhaseEnd + + if seinfo --version | grep '^4\.' ; then + rlPhaseStartTest "additional v.4 features in comparison to v.3" + for OPTION in "common" "default" "typebounds" "validatetrans" ; do + rlRun "seinfo --${OPTION}" + rlRun "seinfo --${OPTION} | grep -i ${OPTION}" + done + rlPhaseEnd + fi + + rlPhaseStartCleanup + rm -f ${SHORT_OUTPUT} + rm -f ${LONG_OUTPUT} + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/setools/sesearch/Makefile b/setools/sesearch/Makefile new file mode 100644 index 0000000..93c7504 --- /dev/null +++ b/setools/sesearch/Makefile @@ -0,0 +1,77 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/setools/Sanity/sesearch +# Description: Does sesearch work well? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/setools/Sanity/sesearch +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does sesearch work well? Does it support all features?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "Requires: python3-setools" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 526460" >> $(METADATA) # Fedora 11 + @echo "Bug: 583915" >> $(METADATA) # RHEL-6 + @echo "Bug: 602166" >> $(METADATA) # RHEL-6 + @echo "Bug: 649711" >> $(METADATA) # RHEL-5 + @echo "Bug: 650094" >> $(METADATA) # RHEL-6 + @echo "Bug: 836213" >> $(METADATA) # RHEL-7 + @echo "Bug: 924588" >> $(METADATA) # RHEL-7 + @echo "Bug: 1029837" >> $(METADATA) # RHEL-7 + @echo "Bug: 1595582" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/setools/sesearch/PURPOSE b/setools/sesearch/PURPOSE new file mode 100644 index 0000000..9524a62 --- /dev/null +++ b/setools/sesearch/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/setools/Sanity/sesearch +Author: Milos Malik + +Does sesearch work well? Does it support all features? + diff --git a/setools/sesearch/main.fmf b/setools/sesearch/main.fmf new file mode 100644 index 0000000..5ea16da --- /dev/null +++ b/setools/sesearch/main.fmf @@ -0,0 +1,44 @@ +summary: Does sesearch work well? Does it support all features? +description: |+ + Does sesearch work well? Does it support all features? + +contact: Milos Malik +component: + - setools +test: ./runtest.sh +framework: beakerlib +recommend: + - setools-console + - python3-setools + - selinux-policy + - selinux-policy-targeted +duration: 15m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - TierCandidatesFAIL + - TipWaived7 + - f32friendly + - f33friendly + - targeted +tier: 1 +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=526460 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=583915 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=602166 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=649711 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=650094 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=836213 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924588 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1029837 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595582 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=920981 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595572 +adjust+: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0062271 +extra-summary: /CoreOS/setools/Sanity/sesearch +extra-task: /CoreOS/setools/Sanity/sesearch diff --git a/setools/sesearch/runtest.sh b/setools/sesearch/runtest.sh new file mode 100755 index 0000000..feb7a22 --- /dev/null +++ b/setools/sesearch/runtest.sh @@ -0,0 +1,141 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setools/Sanity/sesearch +# Description: Does sesearch work well? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="setools" + +rlJournalStart + rlPhaseStartSetup + if rlIsRHEL 5 ; then + rlAssertRpm ${PACKAGE} + elif rlIsRHEL 6 7 ; then + rlAssertRpm ${PACKAGE}-libs + rlAssertRpm ${PACKAGE}-console + else + rlAssertRpm ${PACKAGE}-console + fi + rlPhaseEnd + + if rlIsRHEL '<=7' ; then + rlPhaseStartTest "Records counting" + if rlIsRHEL 5 6 ; then + rlRun "MAX_COUNT=\`sesearch --all | wc -l\`" + else + rlRun "MAX_COUNT=\`sesearch --allow --auditallow --dontaudit --type --role_allow --role_trans --range_trans | wc -l\`" + fi + if rlIsRHEL 5 ; then + for PARAM in "allow" "neverallow" "audit" "role_trans" "type" ; do + rlRun "FULL_COUNT=\`sesearch --${PARAM} | wc -l\`" + rlRun "echo \${FULL_COUNT}" + rlRun "FILTERED_COUNT=\`sesearch --${PARAM} | grep ${PARAM} | wc -l\`" + rlRun "echo \${FILTERED_COUNT}" + rlAssertGreaterOrEqual "the difference must be between 0 and 2" 2 $((FULL_COUNT - FILTERED_COUNT)) + rlAssertGreaterOrEqual "the difference must be between 0 and 2" $((FULL_COUNT - FILTERED_COUNT)) 0 + rlAssertGreaterOrEqual "number of all rules must be greater or equal to this number" ${MAX_COUNT} ${FULL_COUNT} + done + + rlRun "FULL_COUNT=\`sesearch --rangetrans | wc -l\`" + rlRun "echo \${FULL_COUNT}" + rlRun "FILTERED_COUNT=\`sesearch --rangetrans | grep range_trans | wc -l\`" + rlRun "echo \${FILTERED_COUNT}" + rlAssertGreaterOrEqual "the difference must be between 0 and 2" 2 $((FULL_COUNT - FILTERED_COUNT)) + rlAssertGreaterOrEqual "the difference must be between 0 and 2" $((FULL_COUNT - FILTERED_COUNT)) 0 + rlAssertGreaterOrEqual "number of all rules must be greater or equal to this number" ${MAX_COUNT} ${FULL_COUNT} + else + for PARAM in "allow" "neverallow" "auditallow" "dontaudit" "range_trans" "role_trans" "type" ; do + rlRun "FULL_COUNT=\`sesearch --${PARAM} | grep -v -e 'Found ' -e '^$' | wc -l\`" + rlRun "echo \${FULL_COUNT}" + rlRun "FILTERED_COUNT=\`sesearch --${PARAM} | grep -v -e 'Found ' -e '^$' | grep ${PARAM} | wc -l\`" + rlRun "echo \${FILTERED_COUNT}" + rlAssertEquals "these 2 numbers should be equal" ${FULL_COUNT} ${FILTERED_COUNT} + rlAssertGreater "number of all rules must be greater than any of these numbers" ${MAX_COUNT} ${FULL_COUNT} + done + fi + + rlRun "FULL_COUNT=\`sesearch --role_allow | wc -l\`" + rlRun "echo \${FULL_COUNT}" + rlRun "FILTERED_COUNT=\`sesearch --role_allow | grep allow | wc -l\`" + rlRun "echo \${FILTERED_COUNT}" + rlAssertGreaterOrEqual "the difference must be between 0 and 2" 2 $((FULL_COUNT - FILTERED_COUNT)) + rlAssertGreaterOrEqual "the difference must be between 0 and 2" $((FULL_COUNT - FILTERED_COUNT)) 0 + rlAssertGreaterOrEqual "number of all rules must be greater or equal to this number" ${MAX_COUNT} ${FULL_COUNT} + rlPhaseEnd + fi + + rlPhaseStartTest "bz#649711 + bz#650094 + bz#924588" + rlLog "All three bugs were closed as WONTFIX, so this phase was commented out" + #for SHORT_OPTION in "-s" "-t" "-c" ; do + #rlRun "sesearch -A ${SHORT_OPTION} xxx" 1-255 + #done + + #for LONG_OPTION in "--source" "--target" "--class" ; do + #rlRun "sesearch --allow ${LONG_OPTION}=xxx" 1-255 + #done + rlPhaseEnd + + if rlIsRHEL '<=7' ; then + rlPhaseStartTest "bz#836213" + rlRun "sesearch -s ipsec_t -t ipsec_mgmt_t -c process --allow 2>&1 | grep -i \"found .* av rules\"" + rlRun "sesearch -s ipsec_t -t ipsec_mgmt_t -c process --dontaudit 2>&1 | grep -i \"found .* av rules\"" + rlRun "sesearch -s ipsec_t -t ipsec_mgmt_t -c process --all 2>&1 | grep -i \"found .* av rules\"" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#1029837" + if rlIsRHEL 5 6 ; then + SELINUX_FS="/selinux" + else + SELINUX_FS="/sys/fs/selinux" + fi + rlRun "sesearch -T ${SELINUX_FS}/policy >/dev/null" + for POLICY_TYPE in minimum mls targeted ; do + if [ -f /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then + rlRun "sesearch -T /etc/selinux/${POLICY_TYPE}/policy/policy.* >/dev/null" + fi + done + rlPhaseEnd + + rlPhaseStartTest "bz#1595582" + REFERENCE_FILE=`mktemp` + OUTPUT_FILE=`mktemp` + REAL_TYPE="spamc_home_t" + rlRun "sesearch -t ${REAL_TYPE} --allow --dontaudit --auditallow | sort > ${REFERENCE_FILE}" + for ALIAS in spamassassin_home_t pyzor_home_t razor_home_t ; do + rlRun "sesearch -t ${ALIAS} --allow --dontaudit --auditallow | sort > ${OUTPUT_FILE}" + rlRun "diff ${REFERENCE_FILE} ${OUTPUT_FILE}" + done + rm -f ${REFERENCE_FILE} ${OUTPUT_FILE} + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/setroubleshoot/independent-on-initscripts/main.fmf b/setroubleshoot/independent-on-initscripts/main.fmf new file mode 100644 index 0000000..c1563a5 --- /dev/null +++ b/setroubleshoot/independent-on-initscripts/main.fmf @@ -0,0 +1,20 @@ +summary: Is setroubleshoot still dependent on initscripts* packages? +contact: Milos Malik +component: + - setroubleshoot +test: ./test.sh +framework: beakerlib +recommend: + - setroubleshoot-server +duration: 5m +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2365614 + - verifies: https://issues.redhat.com/browse/RHEL-90842 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, + centos-stream-9 + continue: false +extra-nitrate: TC#0619234 +id: 945c84e9-8e15-4ab6-a2be-65841c8e0a8a diff --git a/setroubleshoot/independent-on-initscripts/test.sh b/setroubleshoot/independent-on-initscripts/test.sh new file mode 100755 index 0000000..7d1e6a4 --- /dev/null +++ b/setroubleshoot/independent-on-initscripts/test.sh @@ -0,0 +1,18 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm setroubleshoot-server + rlPhaseEnd + + rlPhaseStartTest "bz#2365614" + rlRun "rpm -q --requires setroubleshoot-server | grep initscripts" 1 + rlRun "rpm -q --scripts setroubleshoot-server | grep service" 1 + rlRun "rpm -q --scripts setroubleshoot-server | grep 'auditctl.*reload'" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd diff --git a/tests-pr.yml b/tests-pr.yml deleted file mode 100644 index 5b5e020..0000000 --- a/tests-pr.yml +++ /dev/null @@ -1,39 +0,0 @@ -- hosts: localhost - tags: - - classic - - pre_tasks: - - name: Generate list of tests in this PR - shell: | - git fetch https://src.fedoraproject.org/tests/selinux.git master:upstream-master - git log --format= --stat --name-only upstream-master..HEAD | sed '/\//!d;s#\(.*\)/.*#\1#' | sort -u | xargs - delegate_to: localhost - register: tests_list - - - name: Set tests - set_fact: - tests: "{{ tests_list.stdout.split(' ') }}" - - # Update to the latest kernel to allow installing kernel-* packages - # matching the running kernel version. - # See: https://pagure.io/fedora-ci/general/issue/162 - # May be removed once the issue above is resolved. - - name: Update kernel packages and reboot - block: - - name: Update kernel-core - shell: dnf update -y kernel-core - - - name: Restart host - shell: sleep 2 && shutdown -r now "Ansible updates triggered" - async: 1 - poll: 0 - ignore_errors: true - - - name: Wait for host to come back - wait_for_connection: - delay: 10 - timeout: 300 - - roles: - - role: standard-test-beakerlib -