policycoreutils/tests/setsebool/runtest.sh

#!/bin/bash
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#   runtest.sh of /CoreOS/policycoreutils/Sanity/setsebool
#   Description: does setsebool work correctly ?
#   Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#   Copyright (c) 2011 Red Hat, Inc. All rights reserved.
#
#   This copyrighted material is made available to anyone wishing
#   to use, modify, copy, or redistribute it subject to the terms
#   and conditions of the GNU General Public License version 2.
#
#   This program is distributed in the hope that it will be
#   useful, but WITHOUT ANY WARRANTY; without even the implied
#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
#   PURPOSE. See the GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public
#   License along with this program; if not, write to the Free
#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
#   Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# Include rhts environment
. /usr/bin/rhts-environment.sh
. /usr/share/beakerlib/beakerlib.sh

PACKAGE="policycoreutils"
USER_NAME="user${RANDOM}"
USER_SECRET="s3kr3t${RANDOM}"
BOOLEAN="ftpd_connect_db"
if rlIsRHEL 5 6 ; then
    SELINUX_FS_MOUNT="/selinux"
else # RHEL-7 and above
    SELINUX_FS_MOUNT="/sys/fs/selinux"
fi

rlJournalStart
    rlPhaseStartSetup
        rlAssertRpm ${PACKAGE}
        OUTPUT_FILE=`mktemp`
        chcon -t tmp_t ${OUTPUT_FILE}

        rlRun "useradd ${USER_NAME}"
        rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
    rlPhaseEnd

    rlPhaseStartTest
        for OPTION in "" "-P" ; do
            for OPERATOR in " " "=" ; do
                for VALUE in 0 1 false true off on ; do
                    rlRun "setsebool ${OPTION} ${BOOLEAN}${OPERATOR}${VALUE} | grep -i -e illegal -e usage -e invalid" 1
                    if [ ${VALUE} == "0" -o ${VALUE} == "false" ] ; then
                        SHOWN_VALUE="off"
                    elif [ ${VALUE} == "1" -o ${VALUE} == "true" ] ; then
                        SHOWN_VALUE="on"
                    else
                        SHOWN_VALUE=${VALUE}
                    fi
                    rlRun "getsebool -a | grep \"^${BOOLEAN}.*${SHOWN_VALUE}\""
                done
            done
        done
    rlPhaseEnd

    rlPhaseStartTest
        rlRun "setsebool" 1
        rlRun "setsebool xyz=1 2>&1 | tee /dev/stderr | grep -i -e \"invalid boolean\" -e \"not found\" -e \"not defined\""
        rlRun "setsebool xyz=-1 2>&1 | tee /dev/stderr | grep -i \"illegal value\""
        rlRun "setsebool xyz=2 2>&1 | tee /dev/stderr | grep -i \"illegal value\""
        if ! rlIsRHEL 5 6 ; then
            rlRun "setsebool -N 2>&1 | tee /dev/stderr | grep -i \"boolean.*required\""
            rlRun "setsebool -P 2>&1 | tee /dev/stderr | grep -i \"boolean.*required\""
        fi
        rlRun "setsebool -P xyz=1 2>&1 | tee /dev/stderr | grep -i -e \"invalid boolean\" -e \"not found\" -e \"not defined\""
        rlRun "setsebool -P xyz=-1 2>&1 | tee /dev/stderr | grep -i \"illegal value\""
        rlRun "setsebool -P xyz=2 2>&1 | tee /dev/stderr | grep -i \"illegal value\""
    rlPhaseEnd

    if ! rlIsRHEL 5 6 ; then
    rlPhaseStartTest
        rlRun "su -l -c '/usr/sbin/setsebool allow_ypbind 0' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}"
        rlAssertGrep "try as root" ${OUTPUT_FILE} -i
        rlRun "su -l -c '/usr/sbin/setsebool allow_ypbind 1' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}"
        rlAssertGrep "try as root" ${OUTPUT_FILE} -i
        rlRun "su -l -c '/usr/sbin/setsebool -P allow_ypbind 0' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}"
        rlAssertGrep "try as root" ${OUTPUT_FILE} -i
        rlRun "su -l -c '/usr/sbin/setsebool -P allow_ypbind 1' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}"
        rlAssertGrep "try as root" ${OUTPUT_FILE} -i
    rlPhaseEnd

    rlPhaseStartTest
        for OPTION in "" "-P" ; do
            rlRun "getsebool allow_ypbind | grep nis_enabled"
            rlRun "setsebool ${OPTION} allow_ypbind on"
            rlRun "getsebool allow_ypbind | grep \"nis_enabled.*on\""
            rlRun "setsebool ${OPTION} allow_ypbind off"
            rlRun "getsebool allow_ypbind | grep \"nis_enabled.*off\""
        done
    rlPhaseEnd

    rlPhaseStartTest
        # https://fedoraproject.org/wiki/Features/SELinuxBooleansRename
        for LINE in `cat /etc/selinux/*/booleans.subs_dist | sort | uniq | tr -s ' ' | tr ' ' ':'` ; do
            OLD_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 1`
            NEW_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 2`
            rlRun "getsebool ${OLD_BOOLEAN_NAME} 2>&1 | tee ${OUTPUT_FILE}"
            rlRun "getsebool ${NEW_BOOLEAN_NAME} 2>&1 | tee -a ${OUTPUT_FILE}"
            rlRun "uniq -c ${OUTPUT_FILE} | grep '2 '"
        done
    rlPhaseEnd
    fi

    rlPhaseStartTest "audit messages"
        START_DATE_TIME=`date "+%m/%d/%Y %T"`
        sleep 1
        rlRun "setsebool ${BOOLEAN} on"
        rlRun "setsebool ${BOOLEAN} off"
        rlRun "setsebool ${BOOLEAN} on"
        sleep 1
        rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=1 old_val=0\""
        rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=0 old_val=1\""
        if rlIsRHEL ; then
            rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=SYSCALL.*comm=setsebool\""
        fi
    rlPhaseEnd

    rlPhaseStartTest "extreme cases"
        # pretend that no booleans are defined
        rlRun "mkdir ./booleans"
        rlRun "mount --bind ./booleans ${SELINUX_FS_MOUNT}/booleans"
        rlRun "setsebool ${BOOLEAN} on 2>&1 | tee ${OUTPUT_FILE}"
        rlAssertGrep "could not change active booleans" ${OUTPUT_FILE} -i
        rlRun "setsebool ${BOOLEAN} off 2>&1 | tee ${OUTPUT_FILE}"
        rlAssertGrep "could not change active booleans" ${OUTPUT_FILE} -i
        rlRun "umount ${SELINUX_FS_MOUNT}/booleans"
        rlRun "rmdir ./booleans"
    rlPhaseEnd

    rlPhaseStartCleanup
        rlRun "userdel -rf ${USER_NAME}"
        rm -f ${OUTPUT_FILE}
    rlPhaseEnd
rlJournalPrintText
rlJournalEnd