tests/mkdir/restorecon.sh

   1 #!/bin/sh
   2 # test mkdir, mknod, mkfifo -Z
   3
   4 # Copyright (C) 2013-2024 Free Software Foundation, Inc.
   5
   6 # This program is free software: you can redistribute it and/or modify
   7 # it under the terms of the GNU General Public License as published by
   8 # the Free Software Foundation, either version 3 of the License, or
   9 # (at your option) any later version.
  10
  11 # This program is distributed in the hope that it will be useful,
  12 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 # GNU General Public License for more details.
  15
  16 # You should have received a copy of the GNU General Public License
  17 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
  18
  19 . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
  20 print_ver_ mkdir mknod mkfifo
  21 require_selinux_
  22
  23 mkdir subdir || framework_failure_
  24 ctx='root:object_r:tmp_t'
  25 mls_enabled_ && ctx="$ctx:s0"
  26 chcon "$ctx" subdir || skip_ "Failed to set context: $ctx"
  27 cd subdir
  28
  29 # --- mkdir -Z ---
  30 # Since in a tmp_t dir, dirs can be created as user_tmp_t ...
  31 mkdir standard || framework_failure_
  32 mkdir restored || framework_failure_
  33 if restorecon restored 2>/dev/null; then
  34   # ... but when restored can be set to user_home_t
  35   # So ensure the type for these mkdir -Z cases matches
  36   # the directory type as set by restorecon.
  37   mkdir -Z single || fail=1
  38   # Run these as separate processes in case global context
  39   # set for an arg, impacts on another arg
  40   # TODO: Have the defaultcon() vary over these directories
  41   for dir in single_p single_p/existing multi/ple; do
  42     mkdir -Zp "$dir" || fail=1
  43   done
  44   restored_type=$(get_selinux_type 'restored')
  45   test "$(get_selinux_type 'single')" = "$restored_type" || fail=1
  46   test "$(get_selinux_type 'single_p')" = "$restored_type" || fail=1
  47   test "$(get_selinux_type 'single_p/existing')" = "$restored_type" || fail=1
  48   test "$(get_selinux_type 'multi')" = "$restored_type" || fail=1
  49   test "$(get_selinux_type 'multi/ple')" = "$restored_type" || fail=1
  50 fi
  51 if test "$fail" = '1'; then
  52   ls -UZd standard restored
  53   ls -UZd single single_p single_p/existing multi multi/ple
  54 fi
  55
  56 # --- mknod -Z and mkfifo -Z ---
  57 # Assume if selinux present that we can create fifos
  58 for cmd_w_arg in 'mknod' 'mkfifo'; do
  59   # In OpenBSD's /bin/sh, mknod is a shell built-in.
  60   # Running via "env" ensures we run our program and not the built-in.
  61   basename="$cmd_w_arg"
  62   test "$basename" = 'mknod' && nt='p' || nt=''
  63   env -- $cmd_w_arg $basename $nt || fail=1
  64   env -- $cmd_w_arg ${basename}_restore $nt || fail=1
  65   if restorecon ${basename}_restore 2>/dev/null; then
  66     env -- $cmd_w_arg -Z ${basename}_Z $nt || fail=1
  67     restored_type=$(get_selinux_type "${basename}_restore")
  68     test "$(get_selinux_type ${basename}_Z)" = "$restored_type" || fail=1
  69   fi
  70 done
  71
  72 Exit $fail