Re: [RFC V3 PATCH] selinux-testsuite: Add test for restorecon

[Richard Haines <richard_c_haines@btinternet.com>]

On Fri, 2019-09-13 at 13:09 -0400, Stephen Smalley wrote:
> On 6/3/19 5:56 AM, Richard Haines wrote:
> > This will test the updated libselinux selinux_restorecon(3) using a
> > simple test version of "restorecon", or if the test is run locally,
> > a '-p' option can be used to supply the path of a full version of
> > restorecon(8) (see note in restorecon/test).
> > 
> > As the SELinux testsuite is primarily a set of regression tests for
> > the
> > SELinux kernel, this change also adds support to include the
> > testing of
> > core userspace services such as library functions or utilities. To
> > install and run these type of tests, the following must be run
> > first:
> > 
> > 	# export TEST_USERSPACE=y
> 
> Sorry for the long delay in responding. I would prefer userspace
> tests 
> to remain part of the selinux userspace repository, invoked upon
> make 
> test there.  A test policy if required should be possible via a
> separate 
> standalone cil or te/fc policy module that doesn't depend on the 
> testsuite policy.

That's okay as I didn't expect it to be accepted. I just wanted it to
test the restorecon patches that I submitted as I find it more
convenient to write testsuite tests. Maybe one day I'll rewrite for
libselinux.


> 
> > Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
> > ---
> > V2 Changes:
> > Allow option to run other restorecon binaries.
> > Only run if userspace tests enabled.
> > Add tests for "Ignore the stem..." patch
> > V3 Changes:
> > Add tests for No CAP_SYS_ADMIN permission and SKIP_DIGEST
> > 
> >   README.md                                  |   7 +
> >   policy/Makefile                            |   8 +
> >   policy/test_restorecon.te                  |  74 ++++++++
> >   tests/Makefile                             |   7 +
> >   tests/file/test                            |   2 +-
> >   tests/restorecon/.gitignore                |   5 +
> >   tests/restorecon/Makefile                  |   7 +
> >   tests/restorecon/check_fs.c                |  69 ++++++++
> >   tests/restorecon/get_all_digests.c         | 176
> > +++++++++++++++++++
> >   tests/restorecon/restorecon.c              |  80 +++++++++
> >   tests/restorecon/restorecon_xattr.c        | 116 +++++++++++++
> >   tests/restorecon/selinux_restorecon_skip.c |  66 ++++++++
> >   tests/restorecon/test                      | 188
> > +++++++++++++++++++++
> >   13 files changed, 804 insertions(+), 1 deletion(-)
> >   create mode 100644 policy/test_restorecon.te
> >   create mode 100644 tests/restorecon/.gitignore
> >   create mode 100644 tests/restorecon/Makefile
> >   create mode 100644 tests/restorecon/check_fs.c
> >   create mode 100644 tests/restorecon/get_all_digests.c
> >   create mode 100644 tests/restorecon/restorecon.c
> >   create mode 100644 tests/restorecon/restorecon_xattr.c
> >   create mode 100644 tests/restorecon/selinux_restorecon_skip.c
> >   create mode 100755 tests/restorecon/test
> > 
> > diff --git a/README.md b/README.md
> > index 26784f8..329a495 100644
> > --- a/README.md
> > +++ b/README.md
> > @@ -114,6 +114,13 @@ the tests:
> >   
> >   ## Running the Tests
> >   
> > +The SELinux testsuite is primarily a set of regression tests for
> > the SELinux
> > +kernel, however it is possible to include the testing of core
> > userspace
> > +services such as library functions or utilities. To install any
> > relevant
> > +tests, the following must be run first:
> > +
> > +	# export TEST_USERSPACE=y
> > +
> >   Create a shell with the `unconfined_r` or `sysadm_r` role and the
> > Linux
> >   superuser identity, e.g.:
> >   
> > diff --git a/policy/Makefile b/policy/Makefile
> > index 305b572..9c7d173 100644
> > --- a/policy/Makefile
> > +++ b/policy/Makefile
> > @@ -3,6 +3,7 @@ POLDEV ?= /usr/share/selinux/devel
> >   SEMODULE = /usr/sbin/semodule
> >   CHECKPOLICY = /usr/bin/checkpolicy
> >   CHECKMODULE = /usr/bin/checkmodule
> > +INCLUDEDIR ?= /usr/include
> >   
> >   DISTRO=$(shell ../tests/os_detect)
> >   RHEL_VERS=$(shell echo $(DISTRO) | sed 's/RHEL//')
> > @@ -79,6 +80,13 @@ ifeq (x$(DISTRO),$(filter x$(DISTRO), xRHEL6))
> >   TARGETS:=$(filter-out test_ibpkey.te, $(TARGETS))
> >   endif
> >   
> > +# Add any userspace test policy
> > +ifeq ($(TEST_USERSPACE),y)
> > +    ifeq ($(shell grep -q selabel_get_digests_all_partial_matches
> > $(INCLUDEDIR)/selinux/label.h && echo true),true)
> > +        TARGETS += test_restorecon.te
> > +    endif
> > +endif
> > +
> >   ifeq (x$(DISTRO),$(filter x$(DISTRO),xRHEL4 xRHEL5))
> >   	BUILD_TARGET := build_rhel
> >   	LOAD_TARGET := load_rhel
> > diff --git a/policy/test_restorecon.te b/policy/test_restorecon.te
> > new file mode 100644
> > index 0000000..57699bb
> > --- /dev/null
> > +++ b/policy/test_restorecon.te
> > @@ -0,0 +1,74 @@
> > +#################################
> > +#
> > +# Policy for testing restorecon
> > +#
> > +
> > +require {
> > +	attribute file_type;
> > +	type setfiles_exec_t;
> > +}
> > +
> > +attribute restorecon_domain;
> > +
> > +type test_restorecon_file_t;
> > +files_type(test_restorecon_file_t)
> > +type in_dir_t;
> > +files_type(in_dir_t)
> > +type out_dir_t;
> > +files_type(out_dir_t)
> > +type in_file_t;
> > +files_type(in_file_t)
> > +type out_file_t;
> > +files_type(out_file_t)
> > +
> > +# Domain for restorecon.
> > +type test_restorecon_t;
> > +files_type(test_restorecon_t)
> > +
> > +domain_type(test_restorecon_t)
> > +unconfined_runs_test(test_restorecon_t)
> > +typeattribute test_restorecon_t testdomain;
> > +typeattribute test_restorecon_t restorecon_domain;
> > +
> > +allow test_restorecon_t self:capability sys_admin;
> > +allow test_restorecon_t test_file_t:file relabelfrom;
> > +allow test_restorecon_t file_type:dir { relabel_dir_perms
> > manage_dir_perms };
> > +allow test_restorecon_t file_type:file { rw_file_perms execute
> > relabelto relabelfrom };
> > +allow_map(test_restorecon_t, file_type, file)
> > +corecmd_bin_entry_type(test_restorecon_t)
> > +
> > +# Allow these for statfs(2) if /tmp = TMPFS_MAGIC test
> > +allow test_restorecon_t tmpfs_t:filesystem getattr;
> > +allow test_restorecon_t user_tmp_t:sock_file getattr;
> > +# and this to add the root test directory
> > +allow test_restorecon_t fs_t:filesystem getattr;
> > +
> > +# Allow restorecon(8) to be used instead of the test program
> > +allow test_restorecon_t setfiles_exec_t:file entrypoint;
> > +
> > +######### No CAP_SYS_ADMIN permission ################
> > +
> > +type test_no_admin_restorecon_t;
> > +files_type(test_no_admin_restorecon_t)
> > +
> > +domain_type(test_no_admin_restorecon_t)
> > +unconfined_runs_test(test_no_admin_restorecon_t)
> > +typeattribute test_no_admin_restorecon_t testdomain;
> > +typeattribute test_no_admin_restorecon_t restorecon_domain;
> > +
> > +allow test_no_admin_restorecon_t test_file_t:file relabelfrom;
> > +allow test_no_admin_restorecon_t file_type:dir { relabel_dir_perms
> > manage_dir_perms };
> > +allow test_no_admin_restorecon_t file_type:file { rw_file_perms
> > execute relabelto relabelfrom };
> > +allow_map(test_no_admin_restorecon_t, file_type, file)
> > +corecmd_bin_entry_type(test_no_admin_restorecon_t)
> > +
> > +# and this to add the root test directory
> > +allow test_no_admin_restorecon_t fs_t:filesystem getattr;
> > +
> > +# Allow restorecon(8) to be used instead of the test program
> > +allow test_no_admin_restorecon_t setfiles_exec_t:file entrypoint;
> > +
> > +######################################################
> > +# Allow all of these domains to be entered from sysadm domain
> > +miscfiles_domain_entry_test_files(restorecon_domain)
> > +userdom_sysadm_entry_spec_domtrans_to(restorecon_domain)
> > diff --git a/tests/Makefile b/tests/Makefile
> > index 63aa325..37ed6af 100644
> > --- a/tests/Makefile
> > +++ b/tests/Makefile
> > @@ -50,6 +50,13 @@ ifeq ($(shell grep
> > "^SELINUX_INFINIBAND_PKEY_TEST=" infiniband_pkey/ibpkey_test.
> >   SUBDIRS += infiniband_pkey
> >   endif
> >   
> > +# Keep userspace tests last
> > +ifeq ($(TEST_USERSPACE),y)
> > +    ifeq ($(shell grep -q selabel_get_digests_all_partial_matches
> > $(INCLUDEDIR)/selinux/label.h && echo true),true)
> > +        SUBDIRS += restorecon
> > +    endif
> > +endif
> > +
> >   ifeq ($(DISTRO),RHEL4)
> >       SUBDIRS:=$(filter-out bounds dyntrace dyntrans inet_socket
> > mmap nnp_nosuid overlay unix_socket, $(SUBDIRS))
> >   endif
> > diff --git a/tests/file/test b/tests/file/test
> > index 32dd2bd..cb86f41 100755
> > --- a/tests/file/test
> > +++ b/tests/file/test
> > @@ -50,7 +50,7 @@ system "chcon -t fileop_exec_t $basedir/wait_io
> > 2>&1 > /dev/null";
> >   # Get the SID of the good file.
> >   #
> >   $output = `ls -Z $basedir/temp_file`;
> > -@arr = split( ' ', $output );
> > +@arr    = split( ' ', $output );
> >   if ( index( $arr[0], ":" ) != -1 ) {
> >       $good_file_sid = $arr[0];
> >   }
> > diff --git a/tests/restorecon/.gitignore
> > b/tests/restorecon/.gitignore
> > new file mode 100644
> > index 0000000..98a33e8
> > --- /dev/null
> > +++ b/tests/restorecon/.gitignore
> > @@ -0,0 +1,5 @@
> > +restorecon
> > +selinux_restorecon_skip
> > +restorecon_xattr
> > +get_all_digests
> > +check_fs
> > diff --git a/tests/restorecon/Makefile b/tests/restorecon/Makefile
> > new file mode 100644
> > index 0000000..477f8d1
> > --- /dev/null
> > +++ b/tests/restorecon/Makefile
> > @@ -0,0 +1,7 @@
> > +TARGETS = restorecon selinux_restorecon_skip restorecon_xattr
> > get_all_digests check_fs
> > +LDLIBS += -lselinux
> > +
> > +all: $(TARGETS)
> > +
> > +clean:
> > +	rm -f $(TARGETS)
> > diff --git a/tests/restorecon/check_fs.c
> > b/tests/restorecon/check_fs.c
> > new file mode 100644
> > index 0000000..f18910f
> > --- /dev/null
> > +++ b/tests/restorecon/check_fs.c
> > @@ -0,0 +1,69 @@
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <string.h>
> > +#include <getopt.h>
> > +#include <errno.h>
> > +#include <stdbool.h>
> > +#include <sys/statfs.h>
> > +#include <linux/magic.h>
> > +
> > +static void usage(char *progname)
> > +{
> > +	fprintf(stderr,
> > +		"usage:  %s [-v] <path>\n"
> > +		"Where:\n\t"
> > +		"-v  Display filesystem f_type magic number.\n\t"
> > +		"path  Path to check fs type.\n\n"
> > +		"Returns 1=RAMFS_MAGIC, 2=TMPFS_MAGIC,
> > 3=SYSFS_MAGIC\n", progname);
> > +	exit(-1);
> > +}
> > +
> > +int main(int argc, char **argv)
> > +{
> > +	int opt, rc;
> > +	bool verbose = false;
> > +	struct statfs sfsb;
> > +
> > +	while ((opt = getopt(argc, argv, "v")) > 0) {
> > +		switch (opt) {
> > +		case 'v':
> > +			verbose = true;
> > +			break;
> > +		default:
> > +			usage(argv[0]);
> > +		}
> > +	}
> > +
> > +	if (optind >= argc) {
> > +		fprintf(stderr, "No pathname specified\n");
> > +		return -1;
> > +	}
> > +
> > +	rc = statfs(argv[optind], &sfsb);
> > +	if (rc < 0) {
> > +		fprintf(stderr, "Get filesystem statistics ERROR:
> > %s\n",
> > +			strerror(errno));
> > +		return rc;
> > +	}
> > +
> > +	switch (sfsb.f_type) {
> > +	case RAMFS_MAGIC:
> > +		if (verbose)
> > +			printf("RAMFS_MAGIC\n");
> > +		return 1;
> > +	case TMPFS_MAGIC:
> > +		if (verbose)
> > +			printf("TMPFS_MAGIC\n");
> > +		return 2;
> > +	case SYSFS_MAGIC:
> > +		if (verbose)
> > +			printf("SYSFS_MAGIC\n");
> > +		return 3;
> > +	default:
> > +		if (verbose)
> > +			printf("sfsb.f_type: 0x%lx\n", sfsb.f_type);
> > +		return 0;
> > +	}
> > +
> > +	return rc;
> > +}
> > diff --git a/tests/restorecon/get_all_digests.c
> > b/tests/restorecon/get_all_digests.c
> > new file mode 100644
> > index 0000000..59f0ed8
> > --- /dev/null
> > +++ b/tests/restorecon/get_all_digests.c
> > @@ -0,0 +1,176 @@
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <string.h>
> > +#include <stdint.h>
> > +#include <getopt.h>
> > +#include <errno.h>
> > +#include <stdbool.h>
> > +#include <fts.h>
> > +#include <selinux/selinux.h>
> > +#include <selinux/label.h>
> > +
> > +#define RESTORECON_PARTIAL_MATCH_DIGEST  "security.sehash"
> > +
> > +static void usage(char *progname)
> > +{
> > +	fprintf(stderr,
> > +		"usage:  %s [-vr] <path>\n\n"
> > +		"Where:\n\t"
> > +		"-v  Display information.\n\t"
> > +		"-r  Recursively descend directories.\n\t"
> > +		"path  Path to check current SHA1 digest against
> > file_contexts entries.\n\n"
> > +		"This will check the directory selinux.sehash SHA1
> > digest for "
> > +		"<path> against\na newly generated digest based on the
> > "
> > +		"file_context entries for that node\n(using the regx,
> > mode "
> > +		"and path entries).\n", progname);
> > +	exit(1);
> > +}
> > +
> > +static int get_digests(struct selabel_handle *hnd, bool verbose,
> > char *path)
> > +{
> > +	int rc = 0;
> > +	size_t i, digest_len = 0;
> > +	bool status;
> > +	uint8_t *xattr_digest = NULL;
> > +	uint8_t *calculated_digest = NULL;
> > +	char *sha1_buf = NULL;
> > +
> > +	status = selabel_get_digests_all_partial_matches(hnd, path,
> > +							 &calculated_di
> > gest,
> > +							 &xattr_digest,
> > +							 &digest_len);
> > +
> > +	sha1_buf = calloc(1, digest_len * 2 + 1);
> > +	if (!sha1_buf) {
> > +		fprintf(stderr, "Could not calloc buffer ERROR: %s\n",
> > +			strerror(errno));
> > +		rc = -1;
> > +		goto out;
> > +	}
> > +
> > +	/* rc = 0 NO MATCH, rc = 1 MATCH, rc = 2 NO calculated_digest
> > +	 * rc = 4 NO xattr_digest, rc = 6 NO digests
> > +	 */
> > +	if (status) { /* They match */
> > +		if (verbose) {
> > +			printf("xattr and file_contexts SHA1 digests
> > match for: %s\n",
> > +			       path);
> > +
> > +			if (calculated_digest) {
> > +				for (i = 0; i < digest_len; i++)
> > +					sprintf((&sha1_buf[i * 2]),
> > "%02x",
> > +						calculated_digest[i]);
> > +				printf("SHA1 digest: %s\n", sha1_buf);
> > +			}
> > +		}
> > +
> > +		rc = 1;
> > +		goto out;
> > +	} else {
> > +		if (!calculated_digest) {
> > +			rc = 2;
> > +			if (verbose) {
> > +				printf("No SHA1 digest available for:
> > %s\n", path);
> > +				printf("as file_context entry is
> > \"<<none>>\"\n");
> > +			}
> > +		}
> > +
> > +		if (calculated_digest && verbose) {
> > +			printf("The file_context entries for: %s\n",
> > path);
> > +
> > +			for (i = 0; i < digest_len; i++)
> > +				sprintf((&sha1_buf[i * 2]), "%02x",
> > calculated_digest[i]);
> > +			printf("generated SHA1 digest: %s\n",
> > sha1_buf);
> > +		}
> > +		if (!xattr_digest) {
> > +			rc = rc | 4;
> > +			if (verbose)
> > +				printf("however there is no
> > selinux.sehash xattr entry.\n");
> > +			else
> > +				goto out;
> > +
> > +		} else if (verbose) {
> > +			printf("however it does NOT match the current
> > entry of:\n");
> > +			for (i = 0; i < digest_len; i++)
> > +				sprintf((&sha1_buf[i * 2]), "%02x",
> > xattr_digest[i]);
> > +			printf("%s\n", sha1_buf);
> > +		}
> > +	}
> > +
> > +	free(sha1_buf);
> > +out:
> > +	free(xattr_digest);
> > +	free(calculated_digest);
> > +	return rc;
> > +}
> > +
> > +int main(int argc, char **argv)
> > +{
> > +	int opt, fts_flags, status;
> > +	bool verbose = false, recurse = false;
> > +	FTS *fts;
> > +	FTSENT *ftsent;
> > +	char *paths[2] = { NULL, NULL };
> > +	struct selabel_handle *hnd;
> > +
> > +	if (argc < 2)
> > +		usage(argv[0]);
> > +
> > +	while ((opt = getopt(argc, argv, "vr")) > 0) {
> > +		switch (opt) {
> > +		case 'v':
> > +			verbose = true;
> > +			break;
> > +		case 'r':
> > +			recurse = true;
> > +			break;
> > +		default:
> > +			usage(argv[0]);
> > +		}
> > +	}
> > +
> > +	if (optind >= argc) {
> > +		fprintf(stderr, "No pathname specified\n");
> > +		exit(-1);
> > +	}
> > +	paths[0] = argv[optind];
> > +
> > +	hnd = selabel_open(SELABEL_CTX_FILE, NULL, 0);
> > +	if (!hnd) {
> > +		fprintf(stderr, "ERROR: selabel_open - Could not obtain
> > handle.\n");
> > +		return -1;
> > +	}
> > +
> > +	fts_flags = FTS_PHYSICAL | FTS_NOCHDIR;
> > +	fts = fts_open(paths, fts_flags, NULL);
> > +	if (!fts) {
> > +		printf("fts error on %s: %s\n",
> > +		       paths[0], strerror(errno));
> > +		return -1;
> > +	}
> > +
> > +	while ((ftsent = fts_read(fts)) != NULL) {
> > +		switch (ftsent->fts_info) {
> > +		case FTS_D:
> > +			/* If recurse = TRUE, then 'status' will
> > reflect the
> > +			 * last path match with 0 = NO MATCH, 1 =
> > MATCH,
> > +			 * 2 = NO calculated_digest, 4 = NO
> > xattr_digest and
> > +			 * 6 = NO digests.
> > +			 */
> > +			status = get_digests(hnd, verbose, ftsent-
> > >fts_path);
> > +			if (status < 0)
> > +				goto out;
> > +			break;
> > +		default:
> > +			break;
> > +		}
> > +
> > +		if (!recurse)
> > +			break;
> > +	}
> > +
> > +out:
> > +	(void) fts_close(fts);
> > +	(void) selabel_close(hnd);
> > +	return status;
> > +}
> > diff --git a/tests/restorecon/restorecon.c
> > b/tests/restorecon/restorecon.c
> > new file mode 100644
> > index 0000000..9daa19a
> > --- /dev/null
> > +++ b/tests/restorecon/restorecon.c
> > @@ -0,0 +1,80 @@
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <string.h>
> > +#include <getopt.h>
> > +#include <errno.h>
> > +#include <stdbool.h>
> > +#include <selinux/selinux.h>
> > +#include <selinux/label.h>
> > +#include <selinux/restorecon.h>
> > +
> > +static void usage(char *progname)
> > +{
> > +	fprintf(stderr,
> > +		"usage:  %s [-IDrv] <path>\n\n"
> > +		"Where:\n\t"
> > +		"-I  Set SELINUX_RESTORECON_IGNORE_DIGEST\n\t"
> > +		"-D  Enable digests\n\t"
> > +		"-r  Recursively descend directories.\n\t"
> > +		"-v  Display information.\n\t"
> > +		"path  Path of file or directory to check.\n\n"
> > +		"The parameters must follow those of restorecon(8)\n",
> > progname);
> > +	exit(-1);
> > +}
> > +
> > +int main(int argc, char **argv)
> > +{
> > +	int opt, rc, flags = 0;
> > +	bool request_digest = false;
> > +	struct selabel_handle *hnd = NULL;
> > +
> > +	if (argc < 2)
> > +		usage(argv[0]);
> > +
> > +	while ((opt = getopt(argc, argv, "IDrv")) > 0) {
> > +		switch (opt) {
> > +		case 'I':
> > +			flags |= SELINUX_RESTORECON_IGNORE_DIGEST;
> > +			request_digest = true;
> > +			break;
> > +		case 'D':
> > +			request_digest = true;
> > +			break;
> > +		case 'r':
> > +			flags |= SELINUX_RESTORECON_RECURSE;
> > +			break;
> > +		case 'v':
> > +			flags |= SELINUX_RESTORECON_VERBOSE;
> > +			break;
> > +		default:
> > +			usage(argv[0]);
> > +		}
> > +	}
> > +
> > +	if (optind >= argc) {
> > +		fprintf(stderr, "No pathname specified\n");
> > +		return -1;
> > +	}
> > +
> > +	struct selinux_opt fc_opts[] = {
> > +		{ SELABEL_OPT_DIGEST, (request_digest ? (char *)1 :
> > NULL) }
> > +	};
> > +
> > +	hnd = selabel_open(SELABEL_CTX_FILE, fc_opts, 1);
> > +	if (!hnd) {
> > +		fprintf(stderr, "ERROR: selabel_open - Could not obtain
> > handle.\n");
> > +		return -1;
> > +	}
> > +
> > +	/* Use own handle */
> > +	selinux_restorecon_set_sehandle(hnd);
> > +
> > +	rc = selinux_restorecon(argv[optind], flags);
> > +	if (rc < 0)
> > +		fprintf(stderr, "selinux_restorecon ERROR: %s\n",
> > +			strerror(errno));
> > +
> > +	selabel_close(hnd);
> > +	return rc;
> > +}
> > +
> > diff --git a/tests/restorecon/restorecon_xattr.c
> > b/tests/restorecon/restorecon_xattr.c
> > new file mode 100644
> > index 0000000..12e89b3
> > --- /dev/null
> > +++ b/tests/restorecon/restorecon_xattr.c
> > @@ -0,0 +1,116 @@
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <unistd.h>
> > +#include <string.h>
> > +#include <getopt.h>
> > +#include <errno.h>
> > +#include <stdbool.h>
> > +#include <selinux/selinux.h>
> > +#include <selinux/label.h>
> > +#include <selinux/restorecon.h>
> > +
> > +static void usage(char *progname)
> > +{
> > +	fprintf(stderr,
> > +		"\nusage: %s [-vrdD] <path>\n"
> > +		"\nWhere:\n\t"
> > +		"-n  Do not append \"Match\" or \"No Match\" to
> > displayed digests.\n\t"
> > +		"-r  Recursively descend directories.\n\t"
> > +		"-m  Do not read /proc/mounts for entries to be
> > excluded.\n\t"
> > +		"-d  Delete non-matching digest entries.\n\t"
> > +		"-D  Delete all digest entries.\n\t"
> > +		"path  Path to search for xattr \"security.sehash\"
> > entries.\n\n",
> > +		progname);
> > +	exit(-1);
> > +}
> > +
> > +int main(int argc, char **argv)
> > +{
> > +	int opt, rc;
> > +	unsigned int xattr_flags = 0, delete_digest = 0, recurse = 0;
> > +	unsigned int delete_all_digests = 0;
> > +	struct dir_xattr *current, *next, **xattr_list = NULL;
> > +	bool verbose = false;
> > +
> > +	if (argc < 2)
> > +		usage(argv[0]);
> > +
> > +	while ((opt = getopt(argc, argv, "vrdD")) > 0) {
> > +		switch (opt) {
> > +		case 'v':
> > +			verbose = true;
> > +			break;
> > +		case 'r':
> > +			recurse = SELINUX_RESTORECON_XATTR_RECURSE;
> > +			break;
> > +		case 'd':
> > +			delete_digest =
> > +				SELINUX_RESTORECON_XATTR_DELETE_NONMATC
> > H_DIGESTS;
> > +			break;
> > +		case 'D':
> > +			delete_all_digests =
> > +				SELINUX_RESTORECON_XATTR_DELETE_ALL_DIG
> > ESTS;
> > +			break;
> > +		default:
> > +			usage(argv[0]);
> > +		}
> > +	}
> > +
> > +	if (optind >= argc) {
> > +		fprintf(stderr, "No pathname specified\n");
> > +		exit(-1);
> > +	}
> > +
> > +	xattr_flags = delete_digest | delete_all_digests | recurse;
> > +
> > +	if (selinux_restorecon_xattr(argv[optind], xattr_flags,
> > &xattr_list)) {
> > +		fprintf(stderr, "Error selinux_restorecon_xattr: %s\n",
> > +			strerror(errno));
> > +		rc = -1;
> > +		goto out;
> > +	}
> > +
> > +	if (xattr_list && verbose) {
> > +		current = *xattr_list;
> > +		while (current) {
> > +			next = current->next;
> > +			printf("%s ", current->directory);
> > +
> > +			switch (current->result) {
> > +			case MATCH:
> > +				printf("Digest: %s Match\n", current-
> > >digest);
> > +				break;
> > +			case NOMATCH:
> > +				printf("Digest: %s No Match\n",
> > current->digest);
> > +				break;
> > +			case DELETED_MATCH:
> > +				printf("Deleted Digest: %s Match\n",
> > current->digest);
> > +				break;
> > +			case DELETED_NOMATCH:
> > +				printf("Deleted Digest: %s No Match\n",
> > +				       current->digest);
> > +				break;
> > +			case ERROR:
> > +				printf("Digest: %s Error removing
> > xattr\n",
> > +				       current->digest);
> > +				break;
> > +			}
> > +			current = next;
> > +		}
> > +		/* Free memory */
> > +		current = *xattr_list;
> > +		while (current) {
> > +			next = current->next;
> > +			free(current->directory);
> > +			free(current->digest);
> > +			free(current);
> > +			current = next;
> > +		}
> > +	} else if (verbose) {
> > +		printf("No digests available\n");
> > +	}
> > +
> > +	rc = 0;
> > +out:
> > +	return rc;
> > +}
> > diff --git a/tests/restorecon/selinux_restorecon_skip.c
> > b/tests/restorecon/selinux_restorecon_skip.c
> > new file mode 100644
> > index 0000000..a09b658
> > --- /dev/null
> > +++ b/tests/restorecon/selinux_restorecon_skip.c
> > @@ -0,0 +1,66 @@
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <string.h>
> > +#include <getopt.h>
> > +#include <errno.h>
> > +#include <stdbool.h>
> > +#include <selinux/selinux.h>
> > +#include <selinux/label.h>
> > +#include <selinux/restorecon.h>
> > +
> > +static void usage(char *progname)
> > +{
> > +	fprintf(stderr,
> > +		"usage:  %s [-SIrv] <path>\n\n"
> > +		"Where:\n\t"
> > +		"-S  set SELINUX_RESTORECON_SKIP_DIGEST\n\t"
> > +		"-I  Set SELINUX_RESTORECON_IGNORE_DIGEST\n\t"
> > +		"-r  Recursively descend directories.\n\t"
> > +		"-v  Display information.\n\t"
> > +		"path  Path of file or directory to check.\n",
> > progname);
> > +	exit(-1);
> > +}
> > +
> > +int main(int argc, char **argv)
> > +{
> > +	int opt, rc, flags = 0;
> > +
> > +	if (argc < 2)
> > +		usage(argv[0]);
> > +
> > +	while ((opt = getopt(argc, argv, "SIrv")) > 0) {
> > +		switch (opt) {
> > +		case 'I':
> > +			flags |= SELINUX_RESTORECON_IGNORE_DIGEST;
> > +			break;
> > +		case 'S':
> > +			flags |= SELINUX_RESTORECON_SKIP_DIGEST;
> > +			break;
> > +		case 'r':
> > +			flags |= SELINUX_RESTORECON_RECURSE;
> > +			break;
> > +		case 'v':
> > +			flags |= SELINUX_RESTORECON_VERBOSE;
> > +			break;
> > +		default:
> > +			usage(argv[0]);
> > +		}
> > +	}
> > +
> > +	if (optind >= argc) {
> > +		fprintf(stderr, "No pathname specified\n");
> > +		return -1;
> > +	}
> > +
> > +	/*
> > +	 * selinux_restorecon() calls selabel_open(3) and by default
> > enables
> > +	 * digests.
> > +	 */
> > +	rc = selinux_restorecon(argv[optind], flags);
> > +	if (rc < 0)
> > +		fprintf(stderr, "selinux_restorecon ERROR: %s\n",
> > +			strerror(errno));
> > +
> > +	return rc;
> > +}
> > +
> > diff --git a/tests/restorecon/test b/tests/restorecon/test
> > new file mode 100755
> > index 0000000..a21765e
> > --- /dev/null
> > +++ b/tests/restorecon/test
> > @@ -0,0 +1,188 @@
> > +#!/usr/bin/perl
> > +use Test::More;
> > +
> > +# Options: -v = Verbose, -p <path_to_restorecon>
> > +# NOTE: If using the -p option to use a different version of
> > restorecon,
> > +# ensure they are labeled correctly before use. This can be
> > achieved by:
> > +#    chcon -h -t bin_t .../sbin/restorecon
> > +#    chcon -h -t setfiles_exec_t .../sbin/setfiles
> > +# The test_restorecon.te policy has rules to support this
> > labeling.
> > +
> > +BEGIN {
> > +    $basedir = $0;
> > +    $basedir =~ s|(.*)/[^/]*|$1|;
> > +
> > +    $v      = " ";
> > +    $bindir = $basedir;
> > +    $i      = 0;
> > +    foreach $arg (@ARGV) {
> > +        if ( $arg eq "-v" ) {
> > +            $v = $arg;
> > +        }
> > +        elsif ( $arg eq "-p" ) {
> > +            $bindir = $ARGV[ $i + 1 ];
> > +            if ( not -e "$bindir/restorecon" ) {
> > +                plan skip_all => "$bindir/restorecon not found";
> > +            }
> > +        }
> > +        $i++;
> > +    }
> > +
> > +    # check if /tmp is really type tmpfs (TMPFS_MAGIC).
> > +    $test_tmpfs = 0;
> > +    $result     = system("$basedir/check_fs $v /tmp 2>/dev/null");
> > +    if ( $result >> 8 eq 2 ) {
> > +        $test_tmpfs = 1;
> > +        plan tests => 12;
> > +    }
> > +    else {
> > +        plan tests => 11;
> > +    }
> > +}
> > +
> > +print "Using \"restorecon\" from $bindir\n";
> > +
> > +# Make sure test directory removed then generate new. Using a root
> > dir to test
> > +# libselinux: Ignore the stem when looking up all matches in file
> > context
> > +print "Generating test directories\n";
> > +system("rm -rf /restore_test");
> > +system("mkdir -p /restore_test/in_dir");
> > +system("mkdir -p /restore_test/out_dir");
> > +
> > +# Using semanage is much quicker than using semodule to build fc
> > entries.
> > +print "semanage adding file context entries\n";
> > +system("semanage fcontext -a -t test_file_t -f d /restore_test");
> > +system("semanage fcontext -a -t in_dir_t -f d
> > /restore_test/in_dir");
> > +system("semanage fcontext -a -t out_dir_t -f d
> > /restore_test/out_dir");
> > +
> > +print "Add files to the directories\n";
> > +system("touch /restore_test/out_dir/out_file1");
> > +system("touch /restore_test/in_dir/in_file1");
> > +
> > +print "Test no CAP_SYS_ADMIN (setxattr failed)\n";
> > +system(
> > +    "runcon -t test_restorecon_t $basedir/restorecon_xattr -rD $v
> > /restore_test"
> > +);
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test");
> > +if ( $result >> 8 eq 4 ) {
> > +    print "Run selinux_restorecon with digests enabled and no
> > CAP_SYS_ADMIN\n";
> > +    system(
> > +"runcon -t test_no_admin_restorecon_t $bindir/restorecon -rD $v
> > /restore_test 2>&1"
> > +    );
> > +    print "Check there are no xattr digest entries\n";
> > +    $result = system(
> > +"runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test"
> > +    );
> > +    ok( $result >> 8 eq 4 );
> > +}
> > +else {
> > +    print "Failed no CAP_SYS_ADMIN test\n";
> > +    ok(0);
> > +}
> > +
> > +print "Run restorecon to add digest entries, then check they
> > match\n";
> > +system("runcon -t test_restorecon_t $bindir/restorecon -rD $v
> > /restore_test");
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test");
> > +ok( $result >> 8 eq 1 );
> > +
> > +print "Add new file context entries, then check digests do not
> > match\n";
> > +system("semanage fcontext -a -t in_file_t -f f
> > \"/restore_test/in_dir(/.*)?\"");
> > +system(
> > +    "semanage fcontext -a -t out_file_t -f f
> > \"/restore_test/out_dir(/.*)?\"");
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test");
> > +ok( $result eq 0 );
> > +
> > +print "Now fix with restorecon and check digests match\n";
> > +system("runcon -t test_restorecon_t $bindir/restorecon -rD $v
> > /restore_test");
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test");
> > +ok( $result >> 8 eq 1 );
> > +
> > +print "Remove sehash entry on /restore_test/out_dir then check if
> > removed\n";
> > +system(
> > +"runcon -t test_restorecon_t setfattr -x security.sehash
> > /restore_test/out_dir"
> > +);
> > +$result = system(
> > +"runcon -t test_restorecon_t $basedir/get_all_digests $v
> > /restore_test/out_dir"
> > +);
> > +ok( $result >> 8 eq 4 );
> > +
> > +print
> > +  "Run restorecon with SELINUX_RESTORECON_IGNORE_DIGEST = TRUE.
> > This will\n";
> > +print "rewrite the missing digest, then check they match\n";
> > +system("runcon -t test_restorecon_t $bindir/restorecon -Ir $v
> > /restore_test");
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test");
> > +ok( $result >> 8 eq 1 );
> > +
> > +print "Remove some file context entries, then check digests do not
> > match\n";
> > +system("semanage fcontext -d -t in_dir_t -f d
> > /restore_test/in_dir");
> > +system("semanage fcontext -d -t out_dir_t -f d
> > /restore_test/out_dir");
> > +system("semanage fcontext -d -t in_file_t -f f
> > \"/restore_test/in_dir(/.*)?\"");
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test");
> > +ok( $result eq 0 );
> > +
> > +print "Run restorecon with digests disabled, then check digests
> > still do\n";
> > +print "not match as they were not updated\n";
> > +system("runcon -t test_restorecon_t $bindir/restorecon -r $v
> > /restore_test");
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test");
> > +ok( $result eq 0 );
> > +
> > +print "Run restorecon with digests enabled, then check they
> > match\n";
> > +system("runcon -t test_restorecon_t $bindir/restorecon -rD $v
> > /restore_test");
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test");
> > +ok( $result >> 8 eq 1 );
> > +
> > +print "Test SELINUX_RESTORECON_SKIP_DIGEST\n";
> > +system(
> > +    "runcon -t test_restorecon_t $basedir/restorecon_xattr -rD $v
> > /restore_test"
> > +);
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test");
> > +if ( $result >> 8 eq 4 ) {
> > +    print
> > +"Run selinux_restorecon with digests enabled and
> > SELINUX_RESTORECON_SKIP_DIGEST = TRUE\n";
> > +    system(
> > +"runcon -t test_restorecon_t $basedir/selinux_restorecon_skip -rS
> > $v /restore_test"
> > +    );
> > +
> > +    $result = system(
> > +"runcon -t test_restorecon_t $basedir/get_all_digests -r $v
> > /restore_test"
> > +    );
> > +    ok( $result >> 8 eq 4 );
> > +}
> > +else {
> > +    print "Failed SELINUX_RESTORECON_SKIP_DIGEST test\n";
> > +    ok(0);
> > +}
> > +
> > +system(
> > +    "semanage fcontext -d -t in_file_t -f f
> > \"/restore_test/out_dir(/.*)?\"");
> > +system("semanage fcontext -d -t test_file_t -f d /restore_test");
> > +system("rm -rf /restore_test");
> > +
> > +print
> > +  "Run restorecon on /sys with digests enabled, then check digests
> > are not\n";
> > +print "written as /sys is SYSFS_MAGIC.\n";
> > +system("runcon -t test_restorecon_t $bindir/restorecon -rD $v
> > /sys/fs/selinux");
> > +$result = system(
> > +    "runcon -t test_restorecon_t $basedir/get_all_digests $v
> > /sys/fs/selinux");
> > +ok( $result >> 8 eq 4 );
> > +
> > +if ($test_tmpfs) {
> > +    print
> > +"Run restorecon on /tmp with digests enabled, then check digests
> > are not\n";
> > +    print "written as /tmp is TMPFS_MAGIC\n";
> > +    system("runcon -t test_restorecon_t $bindir/restorecon -rD $v
> > /tmp");
> > +    $result =
> > +      system("runcon -t test_restorecon_t $basedir/get_all_digests
> > $v /tmp");
> > +    ok( $result >> 8 eq 4 );
> > +}
> > +
> > +exit;
> >