policycoreutils/tests/setsebool/runtest.sh

152 lines
6.3 KiB
Bash
Raw Normal View History

#!/bin/bash
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# runtest.sh of /CoreOS/policycoreutils/Sanity/setsebool
# Description: does setsebool work correctly ?
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2011 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Include rhts environment
. /usr/bin/rhts-environment.sh
. /usr/share/beakerlib/beakerlib.sh
PACKAGE="policycoreutils"
USER_NAME="user${RANDOM}"
USER_SECRET="s3kr3t${RANDOM}"
BOOLEAN="ftpd_connect_db"
if rlIsRHEL 5 6 ; then
SELINUX_FS_MOUNT="/selinux"
else # RHEL-7 and above
SELINUX_FS_MOUNT="/sys/fs/selinux"
fi
rlJournalStart
rlPhaseStartSetup
rlAssertRpm ${PACKAGE}
OUTPUT_FILE=`mktemp`
chcon -t tmp_t ${OUTPUT_FILE}
rlRun "useradd ${USER_NAME}"
rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
rlPhaseEnd
rlPhaseStartTest
for OPTION in "" "-P" ; do
for OPERATOR in " " "=" ; do
for VALUE in 0 1 false true off on ; do
rlRun "setsebool ${OPTION} ${BOOLEAN}${OPERATOR}${VALUE} | grep -i -e illegal -e usage -e invalid" 1
if [ ${VALUE} == "0" -o ${VALUE} == "false" ] ; then
SHOWN_VALUE="off"
elif [ ${VALUE} == "1" -o ${VALUE} == "true" ] ; then
SHOWN_VALUE="on"
else
SHOWN_VALUE=${VALUE}
fi
rlRun "getsebool -a | grep \"^${BOOLEAN}.*${SHOWN_VALUE}\""
done
done
done
rlPhaseEnd
rlPhaseStartTest
rlRun "setsebool" 1
rlRun "setsebool xyz=1 2>&1 | tee /dev/stderr | grep -i -e \"invalid boolean\" -e \"not found\" -e \"not defined\""
rlRun "setsebool xyz=-1 2>&1 | tee /dev/stderr | grep -i \"illegal value\""
rlRun "setsebool xyz=2 2>&1 | tee /dev/stderr | grep -i \"illegal value\""
if ! rlIsRHEL 5 6 ; then
rlRun "setsebool -N 2>&1 | tee /dev/stderr | grep -i \"boolean.*required\""
rlRun "setsebool -P 2>&1 | tee /dev/stderr | grep -i \"boolean.*required\""
fi
rlRun "setsebool -P xyz=1 2>&1 | tee /dev/stderr | grep -i -e \"invalid boolean\" -e \"not found\" -e \"not defined\""
rlRun "setsebool -P xyz=-1 2>&1 | tee /dev/stderr | grep -i \"illegal value\""
rlRun "setsebool -P xyz=2 2>&1 | tee /dev/stderr | grep -i \"illegal value\""
rlPhaseEnd
if ! rlIsRHEL 5 6 ; then
rlPhaseStartTest
rlRun "su -l -c '/usr/sbin/setsebool allow_ypbind 0' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}"
rlAssertGrep "try as root" ${OUTPUT_FILE} -i
rlRun "su -l -c '/usr/sbin/setsebool allow_ypbind 1' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}"
rlAssertGrep "try as root" ${OUTPUT_FILE} -i
rlRun "su -l -c '/usr/sbin/setsebool -P allow_ypbind 0' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}"
rlAssertGrep "try as root" ${OUTPUT_FILE} -i
rlRun "su -l -c '/usr/sbin/setsebool -P allow_ypbind 1' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}"
rlAssertGrep "try as root" ${OUTPUT_FILE} -i
rlPhaseEnd
rlPhaseStartTest
for OPTION in "" "-P" ; do
rlRun "getsebool allow_ypbind | grep nis_enabled"
rlRun "setsebool ${OPTION} allow_ypbind on"
rlRun "getsebool allow_ypbind | grep \"nis_enabled.*on\""
rlRun "setsebool ${OPTION} allow_ypbind off"
rlRun "getsebool allow_ypbind | grep \"nis_enabled.*off\""
done
rlPhaseEnd
rlPhaseStartTest
# https://fedoraproject.org/wiki/Features/SELinuxBooleansRename
for LINE in `cat /etc/selinux/*/booleans.subs_dist | sort | uniq | tr -s ' ' | tr ' ' ':'` ; do
OLD_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 1`
NEW_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 2`
rlRun "getsebool ${OLD_BOOLEAN_NAME} 2>&1 | tee ${OUTPUT_FILE}"
rlRun "getsebool ${NEW_BOOLEAN_NAME} 2>&1 | tee -a ${OUTPUT_FILE}"
rlRun "uniq -c ${OUTPUT_FILE} | grep '2 '"
done
rlPhaseEnd
fi
rlPhaseStartTest "audit messages"
START_DATE_TIME=`date "+%m/%d/%Y %T"`
sleep 1
rlRun "setsebool ${BOOLEAN} on"
rlRun "setsebool ${BOOLEAN} off"
rlRun "setsebool ${BOOLEAN} on"
sleep 1
rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=1 old_val=0\""
rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=0 old_val=1\""
if rlIsRHEL ; then
rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=SYSCALL.*comm=setsebool\""
fi
rlPhaseEnd
rlPhaseStartTest "extreme cases"
# pretend that no booleans are defined
rlRun "mkdir ./booleans"
rlRun "mount --bind ./booleans ${SELINUX_FS_MOUNT}/booleans"
rlRun "setsebool ${BOOLEAN} on 2>&1 | tee ${OUTPUT_FILE}"
rlAssertGrep "could not change active booleans" ${OUTPUT_FILE} -i
rlRun "setsebool ${BOOLEAN} off 2>&1 | tee ${OUTPUT_FILE}"
rlAssertGrep "could not change active booleans" ${OUTPUT_FILE} -i
rlRun "umount ${SELINUX_FS_MOUNT}/booleans"
rlRun "rmdir ./booleans"
rlPhaseEnd
rlPhaseStartCleanup
rlRun "userdel -rf ${USER_NAME}"
rm -f ${OUTPUT_FILE}
rlPhaseEnd
rlJournalPrintText
rlJournalEnd