From aa40b4deae9200b2ae7a633f150aa4338991eb65 Mon Sep 17 00:00:00 2001 From: Iveta Cesalova Date: Wed, 10 Mar 2021 10:10:40 +0100 Subject: [PATCH] daemon-selinux-context added --- core/daemon-selinux-context/Makefile | 64 ++++++++++++++++++++ core/daemon-selinux-context/PURPOSE | 6 ++ core/daemon-selinux-context/TC#0334116.fmf | 7 +++ core/daemon-selinux-context/TC#0577346.fmf | 11 ++++ core/daemon-selinux-context/main.fmf | 21 +++++++ core/daemon-selinux-context/runtest.sh | 68 ++++++++++++++++++++++ 6 files changed, 177 insertions(+) create mode 100644 core/daemon-selinux-context/Makefile create mode 100644 core/daemon-selinux-context/PURPOSE create mode 100644 core/daemon-selinux-context/TC#0334116.fmf create mode 100644 core/daemon-selinux-context/TC#0577346.fmf create mode 100644 core/daemon-selinux-context/main.fmf create mode 100755 core/daemon-selinux-context/runtest.sh diff --git a/core/daemon-selinux-context/Makefile b/core/daemon-selinux-context/Makefile new file mode 100644 index 0000000..8e4d45f --- /dev/null +++ b/core/daemon-selinux-context/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/squid/Sanity/daemon-selinux-context +# Description: test selinux context of all squid's processes +# Author: Ondrej Ptak +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/squid/Sanity/daemon-selinux-context +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Ondrej Ptak " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: test selinux context of all squid's processes" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: squid" >> $(METADATA) + @echo "Requires: squid" >> $(METADATA) + @echo "RhtsRequires: library(squid/squid)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/core/daemon-selinux-context/PURPOSE b/core/daemon-selinux-context/PURPOSE new file mode 100644 index 0000000..0b28ceb --- /dev/null +++ b/core/daemon-selinux-context/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/squid/Sanity/daemon-selinux-context +Description: test selinux context of all squid's processes. +There is different context on RHEL5 and RHEL{6,7} expected. +Every process with name "squid" is checked. + +Author: Ondrej Ptak diff --git a/core/daemon-selinux-context/TC#0334116.fmf b/core/daemon-selinux-context/TC#0334116.fmf new file mode 100644 index 0000000..4218903 --- /dev/null +++ b/core/daemon-selinux-context/TC#0334116.fmf @@ -0,0 +1,7 @@ +component: +- squid +tag: +- TIPpass_Apps +- Tier1 +extra-nitrate: TC#0334116 +extra-summary: /CoreOS/squid/Sanity/daemon-selinux-context diff --git a/core/daemon-selinux-context/TC#0577346.fmf b/core/daemon-selinux-context/TC#0577346.fmf new file mode 100644 index 0000000..fd02437 --- /dev/null +++ b/core/daemon-selinux-context/TC#0577346.fmf @@ -0,0 +1,11 @@ +component: [] +environment: + MODSTREAMS: squid:4 +tag: +- TIPpass_Apps +- TestCaseCopy +- Tier1 +relevancy: | + distro < rhel-8: False +extra-nitrate: TC#0577346 +extra-summary: /CoreOS/squid/Sanity/daemon-selinux-context [squid:4] diff --git a/core/daemon-selinux-context/main.fmf b/core/daemon-selinux-context/main.fmf new file mode 100644 index 0000000..3421140 --- /dev/null +++ b/core/daemon-selinux-context/main.fmf @@ -0,0 +1,21 @@ +summary: test selinux context of all squid's processes +description: | + There is different context on RHEL5 and RHEL{6,7} expected. + Every process with name "squid" is checked. + + Author: Ondrej Ptak +contact: Iveta Cesalova +component: +- squid +test: ./runtest.sh +path: /Sanity/daemon-selinux-context +framework: beakerlib +require: +- library(squid/squid) +recommend: +- squid +duration: 5m +enabled: true +tier: '1' +extra-summary: /CoreOS/squid/Sanity/daemon-selinux-context +extra-task: /CoreOS/squid/Sanity/daemon-selinux-context diff --git a/core/daemon-selinux-context/runtest.sh b/core/daemon-selinux-context/runtest.sh new file mode 100755 index 0000000..60e415a --- /dev/null +++ b/core/daemon-selinux-context/runtest.sh @@ -0,0 +1,68 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/squid/Sanity/daemon-selinux-context +# Description: test selinux context of all squid's processes +# Author: Ondrej Ptak +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES=${PACKAGES:-"squid"} + +rlJournalStart + rlPhaseStartSetup + rlImport --all + rlAssertRpm --all + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "squidStart" + rlPhaseEnd + + rlPhaseStartTest + rlRun "squid_pids=\$(ps axo pid,comm|grep '\bsquid\b'|awk '{print \$1}')"\ + 0 "detecting squid's processes" + rlRun " [ -n \"$squid_pids\" ] " 0 "squid has at least one running process" + + if rlIsRHEL 5 ; then + grep_pattern="(user_u|root):system_r:squid_t" + else + grep_pattern="(system_u|unconfined_u):system_r:squid_t:s0" + fi + + for p in $squid_pids; + do + rlRun "ps -Z $p > ps_log" 0 "getting selinux context of process $p" + rlAssertGrep "$grep_pattern" ps_log -E || \ + rlLogInfo "$p's context is: \"$(cat ps_log|grep squid|awk '{print $1}')\"" + done + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "squidStop" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd