From b48b557e165ad04cdb05541c4da286affc1b8cd6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Nov 25 2020 08:37:47 +0000 Subject: add new test which covers rpmdb program Recent SELinux policy brought new types like rpmdb_exec_t and rpmdb_t, which are assigned to the rpmdb program and to the rpmdb process. Because we don't have any test coverage for these types, I wrote a basic test which runs the rpmdb-rebuild service in default configuration and looks for any SELinux denials. --- diff --git a/selinux-policy/rpmdb-and-similar/Makefile b/selinux-policy/rpmdb-and-similar/Makefile new file mode 100644 index 0000000..db3b9b1 --- /dev/null +++ b/selinux-policy/rpmdb-and-similar/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/rpmdb-and-similar +# Description: SELinux interferes with rpmdb program, rpmdb-rebuild service and related programs. +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/rpmdb-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with rpmdb program, rpmdb-rebuild service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/rpmdb-and-similar/PURPOSE b/selinux-policy/rpmdb-and-similar/PURPOSE new file mode 100644 index 0000000..e4558f5 --- /dev/null +++ b/selinux-policy/rpmdb-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/rpmdb-and-similar +Author: Milos Malik + +SELinux interferes with rpmdb program, rpmdb-rebuild service and related programs. + diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf new file mode 100644 index 0000000..9090977 --- /dev/null +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -0,0 +1,3 @@ +path: /selinux-policy/rpmdb-and-similar +tier: 2 + diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh new file mode 100755 index 0000000..18cd66d --- /dev/null +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -0,0 +1,74 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/rpmdb-and-similar +# Description: SELinux interferes with rpmdb program, rpmdb-rebuild service and related programs. +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_PACKAGE="rpm" +SERVICE_NAME="rpmdb-rebuild" +PROCESS_NAME="rpmdb" +PROCESS_CONTEXT="rpmdb_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /var/lib/rpm + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "touch /var/lib/rpm/.rebuilddb" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" + rlRun "touch /var/lib/rpm/.rebuilddb" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd +