From 0b4762ca603ea2a7cea33e1ee40c95ae3177c078 Mon Sep 17 00:00:00 2001
From: Michael Nguyen <mnguyen@redhat.com>
Date: Thu, 28 Apr 2022 07:48:36 -0400
Subject: [PATCH] tests: check for avc denials around daemon-reload

xref https://bugzilla.redhat.com/show_bug.cgi?id=1924869
---
 tests/kola/systemd/systemd-daemon-reload-avc | 24 ++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100755 tests/kola/systemd/systemd-daemon-reload-avc

diff --git a/tests/kola/systemd/systemd-daemon-reload-avc b/tests/kola/systemd/systemd-daemon-reload-avc
new file mode 100755
index 0000000000..68add81422
--- /dev/null
+++ b/tests/kola/systemd/systemd-daemon-reload-avc
@@ -0,0 +1,24 @@
+#!/bin/bash
+# kola: { "exclusive": true }
+# Verify there are no AVC denial before and after reloading the systemd manager configuration
+#
+# https://bugzilla.redhat.com/show_bug.cgi?id=1924869
+set -xeuo pipefail
+
+. $KOLA_EXT_DATA/commonlib.sh
+
+check_avc_denials() {
+    if test -f /var/log/audit/audit.log; then
+        if grep 'avc.*denied' /var/log/audit/audit.log; then
+            fatal "Found AVC denials"
+        fi
+    else
+        if journalctl -q --no-pager --grep='avc.*denied' _TRANSPORT=audit; then
+            fatal "Found AVC denials"
+        fi
+    fi
+}
+
+check_avc_denials
+systemctl daemon-reload
+check_avc_denials