tests: Add public_content test

Does public_content plugin work as expected with the current
setroubleshoot-server?

tests/Sanity/public_content/Makefile

@@ -0,0 +1,65 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/setroubleshoot-plugins/Sanity/public_content
+#   Description: Does the plugin work as expected?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2017 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/setroubleshoot-plugins/Sanity/public_content
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Does the plugin work as expected?" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          setroubleshoot-plugins" >> $(METADATA)
+	@echo "Requires:        setroubleshoot-plugins setroubleshoot-server audit setools-console psmisc libselinux-utils rsyslog" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+
+	rhts-lint $(METADATA)
+

tests/Sanity/public_content/PURPOSE

@@ -0,0 +1,7 @@
+PURPOSE of /CoreOS/setroubleshoot-plugins/Sanity/public_content
+Author: Milos Malik <mmalik@redhat.com>
+
+Does the plugin work as expected?
+
+Default value of ANALYSIS_DELAY can be overriden.
+

tests/Sanity/public_content/runtest.sh

@@ -0,0 +1,87 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/setroubleshoot-plugins/Sanity/public_content
+#   Description: Does the plugin work as expected?
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2017 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="setroubleshoot-plugins"
+PLUGIN_NAME="public_content"
+ANALYSIS_DELAY=${ANALYSIS_DELAY:-"16"}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm setroubleshoot-server
+        rlServiceStart auditd
+        rlFileBackup /var/lib/setroubleshoot/setroubleshoot_database.xml
+        rlRun "rm -f /var/lib/setroubleshoot/setroubleshoot_database.xml"
+        BEFORE=`mktemp`
+        AFTER=`mktemp`
+        rlRun "killall setroubleshootd" 0,1
+        rlRun "mkdir -p /var/test-dir"
+        rlRun "chcon -t samba_share_t /var/test-dir"
+        rlRun "touch /var/test-file"
+        rlRun "chcon -t samba_share_t /var/test-file"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        if rlIsRHEL 6 7 ; then
+            ADD_OPT="-C"
+        fi
+        rlRun "sesearch -s rsync_t -t samba_share_t -c dir -p read -A --dontaudit ${ADD_OPT} | grep -v '\]' | grep -e allow -e dontaudit" 1
+        rlRun "sesearch -s rsync_t -t samba_share_t -c file -p read -A --dontaudit ${ADD_OPT} | grep -v '\]' | grep -e allow -e dontaudit" 1
+        rlRun "setsebool rsync_export_all_ro off"
+        if ! rlIsRHEL 6 ; then
+            rlRun "setsebool rsync_full_access off"
+        fi
+        rlRun "sealert -l '*' > ${BEFORE}"
+        rlRun "cat /var/log/messages > ./messages"
+        rlRun "setenforce 0"
+        rlRun "runcon system_u:system_r:rsync_t:s0 bash -c 'ls /var/test-dir'" 0,1
+        rlRun "runcon system_u:system_r:rsync_t:s0 bash -c 'cat /var/test-file'" 0,1
+        rlRun "setenforce 1"
+        rlRun "sleep ${ANALYSIS_DELAY}"
+        rlRun "ps -efZ | grep setroubleshootd" 0,1
+        rlRun "sealert -l '*' > ${AFTER}" 0-3
+        rlRun "ausearch -m avc -m selinux_err -i -ts recent | grep 'read.*ls.*test-dir.*:rsync_t:.*:samba_share_t:.*tclass=dir'"
+        rlRun "ausearch -m avc -m selinux_err -i -ts recent | grep 'read.*cat.*test-file.*:rsync_t:.*:samba_share_t:.*tclass=file'"
+        rlRun "diff ${BEFORE} ${AFTER} | grep \"Plugin.*suggests\""
+        rlRun "diff ${BEFORE} ${AFTER} | grep \"Plugin ${PLUGIN_NAME} .*suggests\""
+        rlRun "diff /var/log/messages ./messages | grep -i -e 'setroubleshoot.*exception' -e 'no such file or directory'" 1
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf /var/test-dir /var/test-file"
+        rm -f ${BEFORE}
+        rm -f ${AFTER}
+        rlFileRestore
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+

tests/tests.yml

@@ -8,5 +8,12 @@
     - Regression/no-plugin-exception-during-analyses
     - Regression/sealert-s-traceback-invalid-display
     - Regression/Report-bugs-on-corresponding-components
+    - Sanity/public_content
     required_packages:
     - setroubleshoot-server
+    - setroubleshoot-plugins
+    - audit
+    - setools-console
+    - psmisc
+    - libselinux-utils
+    - rsyslog