checkpoint/restart: define selinux tests

[This is a test for the selinux context restoration behavior of the application checkpoint/restart kernel feature.]

Define a policy module which defines three domains, ckpt_test_{1,2,3}_t. We run a self-checkpoint program under ckpt_test_1_t to create a labeled checkpoint file. ckpt_test_2_t is allowed to restore a task with ckpt_test_1_t labels, while ckpt_test_3_t may not. We try:
1. restarting ckpt from context ckpt_test_2_t, without --keeplsm, meaning task label at restart should be ckpt_test_2_t.
2. restarting ckpt from context ckpt_test_3_t, with --keeplsm, meaning task label at restart should be ckpt_test_1_t. But that isn't allowed, so restart should fail.
3. restarting ckpt from context ckpt_test_2_t, with --keeplsm, meaning task label at restart should be ckpt_test_2_t.

After doing self-checkpoint, ckpt copies the content of /proc/self/attr/current to ./context. We use the contents of that file to verify that the task was restarted with the proper task label.

Eventually tests should be written to test ipc labels.

This is a part of the c/r tests at

	git://git.sr71.net/~hallyn/cr_tests.git

The lsm c/r patches are so far not integrated in the main checkpoint/restart patchset, but can be seen at

	http://git.kernel.org/gitweb.cgi?p=linux/kernel/git/sergeh/linux-cr.git;a=shortlog;h=ckpt-v18.lsm.1

This set has been tested on RHEL5.3 running with refpolicy.

---
 Makefile           |    9 ++
 README             |   23 +++++++
 ckpt.c             |   76 ++++++++++++++++++++++++
 cr-tests-policy.fc |    5 +
 cr-tests-policy.if |   42 +++++++++++++
 cr-tests-policy.te |   62 ++++++++++++++++++++
 runtest.sh         |  163 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 wrap.c             |   22 +++++++
 8 files changed, 402 insertions(+)

new file mode 100644
index 0000000..2ae8d96
@@ -0,0 +1,9 @@
+targets = ckpt wrap
+
+all: $(targets)
+
+ckpt: ckpt.c ../cr.h
+	gcc -o ckpt ckpt.c
+
+clean:
+	rm -rf $(targets) out context cr-test.out cr-test-module restart wrap

new file mode 100644
index 0000000..fc59c3c
@@ -0,0 +1,23 @@
+Make sure
+	expand-check = 0
+is in /etc/selinux/semanage.conf.
+
+You also need to add 'restore' to the definitions of
+all_file_perms, all_process_perms, all_ipc_perms, and all_msg_perms
+in /usr/share/selinux/devel/include/support/all_perms.spt.  The
+refpolicy source likewise must be updated to know of these perms.
+
+Test sequence:
+
+	1. load policy
+	2. run ckpt as ckpt_test_1_t to create a checkpoint image
+		with tasks etc under that label
+	3. run restart as ckpt_test_2_t without KEEP_LSM, making
+		sure tasks are under ckpt_test_2_t label.
+	4. run restart as ckpt_test_2_t with KEEP_LSM, making
+		sure tasks are under ckpt_test_1_t label.
+	5. run restart as ckpt_test_3_t, which does not have
+		restore rights to ckpt_test_1_t, with KEEP_LSM,
+		making sure we get -EPERM.
+
+Later we may want to also test file and ipc labels.

new file mode 100644
index 0000000..b35d9a7
@@ -0,0 +1,5 @@
+# cr_tests/selinux/ckpt executable will have:
+# label: system_u:object_r:ckpt_test_exec_t
+# MLS sensitivity: s0
+# MCS categories: <none>
+

new file mode 100644
index 0000000..3e92cc3
@@ -0,0 +1,22 @@
+/*
+ * Copyright 2009 IBM Corp.
+ * Author: Serge Hallyn
+ *
+ * if i do
+ *	runcon -t ckpt_test_1_t ./ckpt
+ * then the file->f_cred for ckpt will actually be runcon's
+ * before the context switch.  We don't want to have to give
+ * the restarter the rights to process:restore unconfined_t,
+ * so we'll do
+ *	runcon -t ckpt_test_1_t ./wrap ./ckpt
+ * so that ckpt is actually opened by a task with type
+ * ckpt_test_1_t, so that all file->f_creds are in that context.
+ */
+
+int main(int argc, char *argv[])
+{
+	char *newcmd, **newargv;
+	newargv = argv+1;
+	newcmd = argv[0];
+	return execv(newcmd, newargv);
+}