diff --git a/libselinux/validatetrans/Makefile b/libselinux/validatetrans/Makefile new file mode 100644 index 0000000..b5a4d30 --- /dev/null +++ b/libselinux/validatetrans/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libselinux/Sanity/validatetrans +# Description: Does the validatetrans tool work as expected? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libselinux/Sanity/validatetrans +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.cil + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does the validatetrans tool work as expected?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: libselinux" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/libselinux/validatetrans/PURPOSE b/libselinux/validatetrans/PURPOSE new file mode 100644 index 0000000..1732b31 --- /dev/null +++ b/libselinux/validatetrans/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/libselinux/Sanity/validatetrans +Author: Milos Malik + +Does the validatetrans tool work as expected? + diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf new file mode 100644 index 0000000..886443b --- /dev/null +++ b/libselinux/validatetrans/main.fmf @@ -0,0 +1,4 @@ +path: /libselinux/validatetrans +relevancy: +- "distro < fedora-32: False" + diff --git a/libselinux/validatetrans/runtest.sh b/libselinux/validatetrans/runtest.sh new file mode 100755 index 0000000..fb58d69 --- /dev/null +++ b/libselinux/validatetrans/runtest.sh @@ -0,0 +1,95 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libselinux/Sanity/validatetrans +# Description: Does the validatetrans tool work as expected? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libselinux" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlAssertRpm ${PACKAGE} + rlRun "rpm -qf `which validatetrans`" + rlRun "rpm -qf `which seinfo`" + rlRun "rpm -qf `which semodule`" + rlRun "rpm -qf `which ausearch`" + + rlSESetEnforce + rlSEStatus + rlPhaseEnd + + rlPhaseStartTest "correct usage" + rlRun "seinfo --validatetrans" + rlRun "semodule -i testpolicy.cil" + rlRun "seinfo --validatetrans" + rlRun "mkdir -p tested-dir" + rlRun "touch tested-file" + rlRun "mkfifo tested-fifo_file" + for TCLASS in dir file fifo_file ; do + rlSESetTimestamp + sleep 1 + rlRun "chcon -t bin_t tested-${TCLASS}" + # file context change from anything to swapfile_t should pass + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 ${TCLASS} unconfined_u:object_r:swapfile_t:s0" 0 + rlRun "chcon -t swapfile_t tested-${TCLASS}" + # file context change from swapfile_t to anything should fail + rlRun "validatetrans unconfined_u:object_r:swapfile_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 ${TCLASS} unconfined_u:object_r:bin_t:s0" 255 + rlRun "chcon -t bin_t tested-${TCLASS}" 1 + sleep 1 + rlSECheckAVC --expect "type=SELINUX_ERR.*op=security_validate_transition.*:swapfile_t:.*:bin_t:.*tclass=${TCLASS}" + rlRun "rm -rf tested-${TCLASS}" + done + rlRun "semodule -r testpolicy" + rlRun "seinfo --validatetrans" + rlPhaseEnd + + rlPhaseStartTest "incorrect number of parameters" + rlRun "validatetrans param1 2>&1 | grep -i usage" + rlRun "validatetrans param1 param2 2>&1 | grep -i usage" + rlRun "validatetrans param1 param2 param3 2>&1 | grep -i usage" + rlRun "validatetrans param1 param2 param3 param4 param5 2>&1 | grep -i usage" + rlPhaseEnd + + rlPhaseStartTest "incomplete or invalid parameters" + # first context incomplete + rlRun "validatetrans unconfined_u:object_r:bin_t: unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'" + # second context incomplete + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t: file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'" + # third context incomplete + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t: 2>&1 | grep -i 'invalid argument'" + # invalid target class + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 xyz unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid class'" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/libselinux/validatetrans/testpolicy.cil b/libselinux/validatetrans/testpolicy.cil new file mode 100644 index 0000000..d7df639 --- /dev/null +++ b/libselinux/validatetrans/testpolicy.cil @@ -0,0 +1,4 @@ +(validatetrans dir (neq t1 swapfile_t)) +(validatetrans file (neq t1 swapfile_t)) +(validatetrans fifo_file (neq t1 swapfile_t)) +