  - name: 
        /Downstream_audit_tests/Regression/auparse-missing-information-when-used-with-format-text
    summary: Check that auparse does not miss information when used with --format-text
    description: ''
    contact:
      - Martin Zelený <mzeleny@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2061726
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2061731
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2062612
    id:
    tag:
      - CI-Tier-1
      - NoRHEL6
      - NoRHEL7
      - Tier1
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: 
        /Downstream_audit_tests/tests/Regression/auparse-missing-information-when-used-with-format-text
    framework: beakerlib
    manual: false
    tty: false
    require:
      - library(audit/testing)
    recommend:
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: &id001 []
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 1
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Regression/auparse-missing-information-when-used-with-format-text/main.fmf
    discover-phase: Downstream_audit_tests
  - name: 
        /Downstream_audit_tests/Regression/bz1663285-ausearch-does-not-record-device-inode-details-when
    summary: Test for BZ#1663285 (ausearch does not record device/inode details when)
    description: |
        Bug summary: ausearch does not record device/inode details when checkpointing a single file
        Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1663285
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1663285
    id:
    tag:
      - CI-Tier-1
      - Tier2
    tier: '2'
    component:
      - audit
    test: ./runtest.sh
    path: 
        /Downstream_audit_tests/tests/Regression/bz1663285-ausearch-does-not-record-device-inode-details-when
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 2
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Regression/bz1663285-ausearch-does-not-record-device-inode-details-when/main.fmf
    discover-phase: Downstream_audit_tests
  - name: 
        /Downstream_audit_tests/Regression/bz1705376-aureport-aborts-when-using-a-specific-input
    summary: Test for BZ#1705376 (aureport aborts when using a specific input)
    description: |
        Bug summary: aureport aborts when using a specific input
        Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1705376
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1705376
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - TIPfail_Security
      - Tier2
      - Tier2security
    tier: '2'
    component:
      - audit
    test: ./runtest.sh
    path: 
        /Downstream_audit_tests/tests/Regression/bz1705376-aureport-aborts-when-using-a-specific-input
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 3
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Regression/bz1705376-aureport-aborts-when-using-a-specific-input/main.fmf
    discover-phase: Downstream_audit_tests
  - name: 
        /Downstream_audit_tests/Regression/bz519790-libauparse-interpreting-ipc-mode-fields-segfault
    summary: Bug 519790 -  crash interpreting IPC mode fields via libauparse
    description: ''
    contact:
      - omoris@redhat.com
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=519790
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - Tier3
      - Tier3security
      - fedora-wanted
    tier: '3'
    component:
      - audit
    test: ./runtest.sh
    path: 
        /Downstream_audit_tests/tests/Regression/bz519790-libauparse-interpreting-ipc-mode-fields-segfault
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audit-libs-devel
      - glibc-devel.s390
      - audispd-plugins
      - audit
      - gcc
      - glibc-devel.ppc
      - glibc-devel
      - glibc-devel.i686
      - audit-libs
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 4
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Regression/bz519790-libauparse-interpreting-ipc-mode-fields-segfault/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Regression/sample-rules-is-readable-for-non-root
    summary: List sample-rules directory as a non root user
    description: ''
    contact:
      - Martin Zelený <mzeleny@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2054432
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2054727
    id:
    tag:
      - CI-Tier-1
      - NoRHEL6
      - NoRHEL7
      - Tier2
    tier: '2'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Regression/sample-rules-is-readable-for-non-root
    framework: beakerlib
    manual: false
    tty: false
    require: []
    recommend:
      - audit
      - /usr/sbin/runuser
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 5
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Regression/sample-rules-is-readable-for-non-root/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/account-lifecycle
    summary: Verify user account lifecycle auditing implementation
    description: |
        There is a specification for User and Group Account Lifecycle auditing [1],
        this test verifies that the specification is implemented correctly.

        [1] https://people.redhat.com/sgrubb/audit/user-account-lifecycle.txt
    contact:
      - aborah@redhat.com
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1294663
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1225560
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700761
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1624764
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - TIPfail
      - TIPfail_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
      - shadow-utils
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/account-lifecycle
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - policycoreutils-python-utils
      - audispd-plugins
      - shadow-utils
      - audit
      - expect
      - policycoreutils-python
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 15m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 6
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/account-lifecycle/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/ambient-capabilities
    summary: Test for ambient capabilities
    description: ''
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1165316
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - TIPpass_Security
      - Tier1
      - Tier1security
      - kernel
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/ambient-capabilities
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - libgcc.s390
      - glibc-devel.s390
      - audispd-plugins
      - libcap-ng-devel
      - audit
      - gcc
      - glibc-devel.ppc
      - libgcc.ppc
      - glibc-devel
      - glibc-devel.i686
      - kernel
      - libgcc.i686
      - libgcc
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 7
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/ambient-capabilities/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/audisp-syslog-plugin
    summary: Sanity of syslog audisp plugin
    description: |+
        Test for syslog facility selection for audispd syslog plugin.

        Added ability for audispd syslog plugin to choose facility local0-7
        For the new feature allowing audisp-syslog plugin copy events to  facility
        local0-7, you would edit  /etc/audisp/plugins.d/syslog.conf so  that its
        active. You would also add a second option to the args line for  whichever
        facility you intended. You also might want to edit rsyslog's  configuration
        to put anything logged with the local facility into a  specific file for ease
        of testing. Then restart the audit daemon and  then look in the file rsyslog
        is sending it to.

    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1241634
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1002660
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919878
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=667536
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1497279
    id:
    tag:
      - CI-Tier-1
      - TIPpass
      - TIPpass_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
      - rsyslog
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/audisp-syslog-plugin
    framework: beakerlib
    manual: false
    tty: false
    require:
      - library(audit/testing)
    recommend:
      - audispd-plugins
      - audit
      - rsyslog
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 15m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 8
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/audisp-syslog-plugin/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/audit-configuration
    summary: Test for audit configuration
    description: |
        This test verifies that audit configuration in kernel works as expected,
        ie. changes made are effective and all changes are correctly reported. The
        list of test items is as follows:

          * Default rules and default audit state
          * Adding rule
          * Removing rule
          * Changing backlog size
          * Setting failure flag
          * Setting rate limit
          * Trimming
          * Setting enabled flag (requires restart)
          * Making login uids unchangeable (requires restart)
        Added notier tag because our tiers are using workaround breaking this test.
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1924561
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1655270
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1399823
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - TIPfail
      - TIPfail_Security
      - TierCandidatesPASS
      - fedora-wanted
      - kernel
      - notier
    tier:
    component:
      - audit
      - kernel
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/audit-configuration
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - kernel
      - audispd-plugins
      - audit
      - expect
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 30m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 9
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/audit-configuration/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/audit-log-update
    summary: Automatic update of testing audit logs
    description: |
        For testing purposes we maintain a set of sample audit logs. We want to
        have as much types of events as possible. Many types of events are hard
        to trigger and some even represent various anomalies. This test checks
        if actual audit log on a system executing this test has some types of
        events missing in the current version of sample audit log. If so, log
        is extended. 
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link: []
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - TIPpass
      - TIPpass_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/audit-log-update
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - wget
      - audit
      - s-nail
      - mailx
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 15m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 10
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/audit-log-update/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/audit-rules-built-from-directory
    summary: Audit rules are built from directory
    description: |
        Bug summary: FutureFeature: Audit rules are built from a directory of rule files
        Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=967238
    contact:
      - omoris@redhat.com
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=967238
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1065067
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1142989
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1478311
    id:
    tag:
      - CI-Tier-1
      - NoRHEL3
      - NoRHEL4
      - NoRHEL5
      - TIPpass_Security
      - Tier2
      - Tier2security
    tier: '2'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/audit-rules-built-from-directory
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - rpm-build
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 11
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/audit-rules-built-from-directory/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/audit-testsuite
    summary: Execute audit-testsuite
    description: |-
        This test executes audit-testsuite. By default, test download upstream
        audit-testsuite from github [1] and execute all tests. Optionally, you
        can specify the following test parameters:

          * TESTS       - set of tests to be executed,
          * GIT_URL     - URL to alternative git repository (eg. fork from the upstream),
          * GIT_BRANCH  - checkout specific branch for test execution, useful for downstream
                          tests and tests not yet merged into master branch.
          * DEBUG       - execute debugging shell after tests execution (for manual 
                          execution only)

        [1] https://github.com/linux-audit/audit-testsuite
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1426659
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1382500
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1382499
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1382504
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1382508
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1410862
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1155608
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1846972
    id:
    tag:
      - CI-Tier-1
      - NoFIPS
      - NoRHEL4
      - NoRHEL5
      - TIPpass
      - TIPpass_Security
      - Tier1
      - Tier1security
      - kernel
      - rhel9-buildroot
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/audit-testsuite
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - libgcc.s390
      - glibc-devel.s390
      - gettext-devel
      - gcc
      - glibc-devel
      - perl-Test-Harness
      - perl
      - git
      - libgcc.ppc
      - glibc-devel.i686
      - perl-File-Which
      - kernel
      - libgcc.i686
      - audispd-plugins
      - expect
      - libgcc
      - perl-Test
      - perl-Time-HiRes
      - audit
      - iproute
      - glibc-devel.ppc
      - nmap-ncat
      - libtool
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 12
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/audit-testsuite/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/audit-updates-rhel53
    summary: Functionality tests for audit packages that have been updated to the
        newer upstream version 1.7.7
    description: |
        Test Name: audit-updates-rhel53 - Bugzilla(s) 446080
        Author: Eduard Benes <ebenes@redhat.com>
        Location: /CoreOS/audit/Sanity/audit-updates-rhel53

        Short Description: Functionality tests for audit packages that have been updated to the newer upstream version 1.7.7


        Long Description:

        See errata RHEA-2009:8168 for detailed description and expected results.
        Selected parts of how to test section provided by Steve Grubb:

         * New ausyscall program added for cross referencing syscall name and number
        info

        Not much to tell about this one. Just play with it and see if it breaks.
        ausyscall x86_64 dup            should find 3 different dupes
        ausyscall x86_64 dup --exact    should find one
        ausyscall x86_64 --dump         should dump the whole syscall table


         * aureport now has a report about keys it sees in audit events

        This should be tested in the multiple key thing above. The --summary report
        should give totals for different keys. Otherwise it just pulls out each one.


         * The rule:

        -a always,user -S open -F filetype=file

        should not be legal. The older libs would allow it.


         * The rule:

        -a always,user -S open -F ppid=1

        Should not be legal. The older libs would allow it.


         * The rule:

        -a always,exit -S open -F dir=/etc -k test

        Should be legal. The older version would see it as an error.


         * if you have /etc/audit/auditd.conf log_group=wheel (or anything other than
        root) and you have a rule like:

        -a always,exit -S open -F exit=-EPERM -k access

        you will get an audit record generated with a key of access against the
        dispatcher just by running aureport --start today. You should not get that
        generated. You will need to have wheel group access to /var/log/audit/audit* and
        /etc/audit/auditd.conf fixed in order to test this.


         * "aureport --start today PM" should produce an error. It did not previously.


         * ausearch interpretation of i386 syscalls on an x86_64 computer gave the
        wrong results. Use this audit event for testing on an x86_64 machine:

        type=SYSCALL msg=audit(1224864719.162:10038): arch=40000003 syscall=102
        success=yes exit=5 a0=a a1=bfcc1f80 a2=25b0c4 a3=0 items=0 ppid=1 pid=11761
        auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1
        comm="prelude-manager" exe="/usr/bin/prelude-manager"
        subj=system_u:system_r:prelude_t:s0-s15:c0.c1023 key=(null)

        should be a socketcall(recv) when "cat file | ausearch -i" is used.
    contact:
      - omoris@redhat.com
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=446080
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - TIPpass
      - TIPpass_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/audit-updates-rhel53
    framework: beakerlib
    manual: false
    tty: false
    require:
      - library(audit/testing)
    recommend:
      - audit-libs-devel
      - procps-ng
      - audit
      - audit-libs
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 15m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 13
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/audit-updates-rhel53/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/auditctl-rules-allow-a0-a3-to-be-negative-numbers
    summary: auditctl rules allow a0-a3 to be negative numbers
    description: ''
    contact:
      - omoris@redhat.com
    enabled: true
    order: 50
    link: []
    id:
    tag:
      - CI-Tier-1
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: 
        /Downstream_audit_tests/tests/Sanity/auditctl-rules-allow-a0-a3-to-be-negative-numbers
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 14
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/auditctl-rules-allow-a0-a3-to-be-negative-numbers/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/auditctl-smoke
    summary: Smoke test for auditctl
    description: ''
    contact:
      - omoris@redhat.com
    enabled: true
    order: 50
    link: []
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - TIPfail
      - TIPfail_Security
      - Tier1
      - Tier1security
      - kernel
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/auditctl-smoke
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
      - rsyslog
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 15
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/auditctl-smoke/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/aulast-smoke
    summary: Sanity test for aulast
    description: ''
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=922508
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1127312
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=975796
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1019376
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1158521
    id:
    tag:
      - CI-Tier-1
      - NoRHEL5
      - TIPfail_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/aulast-smoke
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - openssh-server
      - openssh
      - audit
      - expect
      - openssh-clients
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 16
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/aulast-smoke/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/ausearch-checkpoint
    summary: Sanity test for ausearch checkpoint feature
    description: |
        Sanity test for ausearch options --checkpoint.
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link: []
    id:
    tag:
      - CI-Tier-1
      - NoRHEL6
      - TIPpass_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/ausearch-checkpoint
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 17
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/ausearch-checkpoint/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/ausearch-eoe-timeout
    summary: Sanity test for ausearch end_of_event_timeout (rhbz#1921658)
    description: ''
    contact:
      - Martin Zelený <mzeleny@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1921658
    id:
    tag:
      - CI-Tier-1
      - NoRHEL6
      - NoRHEL7
      - Tier2
    tier: '2'
    component:
      - audit
    test: ./test.sh
    path: /Downstream_audit_tests/tests/Sanity/ausearch-eoe-timeout
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - diffutils
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 18
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/ausearch-eoe-timeout/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/ausearch-expression
    summary: Sanity test for ausearch expression API
    description: |-
        Audit lib provides the following function in API for auparse:

          * int ausearch_add_expression(auparse_state_t *au,
                                        const char *expression,
                                        char **error,
                                        ausearch_rule_t how);

        This is a sanity test for this function. Currently only the supported
        fields are virtual ones and *uid and *gid.

        We are testing the following

         * logical operators !, && and ||;
         * comparison operators <, <=, ==, >, >=, !==, i=, i!=, r= and r!=;
         * virtual fields \timestamp, \timestamp_ex and \record_type;
         * actual fields: *uid and *gid.
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1399314
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - TIPpass
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/ausearch-expression
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audit-libs-devel
      - audispd-plugins
      - audit
      - gcc
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 19
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/ausearch-expression/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/ausearch-smoke
    summary: Sanity test for ausearch
    description: |
        Uses ausearch-test [1] provided by Steve Grubb.

        [1] http://people.redhat.com/sgrubb/audit/ausearch-test-0.5.tar.gz
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1049916
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=967240
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1260873
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1065067
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1142989
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1186158
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1169461
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1120286
    id:
    tag:
      - CI-Tier-1
      - NoRHEL6
      - TIPpass
      - TIPpass_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/ausearch-smoke
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audit-libs-devel
      - audispd-plugins
      - wget
      - audit
      - gcc
      - sharutils
      - rpm-build
      - gzip
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 15m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 20
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/ausearch-smoke/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/autrace-basic-functionality
    summary: Test autrace for basic functionality
    description: |
        CVS: http://cvs.devel.redhat.com/cgi-bin/cvsweb.cgi/tests/audit/Sanity/autrace-basic-functionality/
    contact:
      - omoris@redhat.com
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358775
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1185892
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=700005
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=702279
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=697463
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1172624
    id:
    tag:
      - CI-Tier-1
      - TIPpass_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/autrace-basic-functionality
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 21
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/autrace-basic-functionality/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/bz1985630-audit-shipped-rules
    summary: Test audit shipped sample rules
    description: |
        Bug summary: Shipped /usr/share/audit/sample-rules/ *.rules cannot be used on all supported architectures
        Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1985630
    contact:
      - Martin Zelený <mzeleny@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1985630
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - NoRHEL7
    tier:
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/bz1985630-audit-shipped-rules
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 1h
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 22
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/bz1985630-audit-shipped-rules/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/check-auvirt-options-listing
    summary: check option listing in auvirt --help
    description: |+
        Bug summary: auvirt --help shows an incorrect option "--show--uuid"
        Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1129076

        Check for the present of specific options in "auvirt --help"

    contact:
      - omoris@redhat.com
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1129076
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - TIPpass_Security
      - Tier2
      - Tier2security
    tier: '2'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/check-auvirt-options-listing
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 2m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 23
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/check-auvirt-options-listing/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/dns-reverse-lookup
    summary: Empty addr parameter to audit logging function should cause to bypass
        reverse dns lookup.
    description: |
        Test Name: dns-reverse-lookup
        Author: Eduard Benes <ebenes@redhat.com>
        Location: /CoreOS/audit/Sanity/dns-reverse-lookup

        Short Description: Empty addr parameter to audit logging function should cause 
        to bypass reverse dns lookup.


        Long Description:

        If the addr parameter being passed to an audit logging function (such as 
        audit_log_user_message) is "", it should bypass a reverse dns lookup. 
        This can be verified by stracing this program: 

        #include <libaudit.h> 
        int main(void) { 
          int fd = audit_open(); 
          audit_log_user_message(fd, AUDIT_USER_AUTH, "", NULL, "", NULL, 1); 
          return 0; 
        } 

        Stracing this program will give much more than ~40 lines of output if 
        dns reverse lookup has been performed. Number around 40 is acceptable.
    contact:
      - omoris@redhat.com
    enabled: true
    order: 50
    link: []
    id:
    tag:
      - CI-Tier-1
      - NoRHEL3
      - NoRHEL4
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/dns-reverse-lookup
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audit-libs-devel
      - audispd-plugins
      - audit
      - gcc
      - strace
      - audit-libs
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 24
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/dns-reverse-lookup/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/fanotify
    summary: Test for fanotify event
    description: ''
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1451872
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - TIPfail
      - TIPfail_Security
      - Tier1
      - Tier1security
      - kernel
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/fanotify
    framework: beakerlib
    manual: false
    tty: false
    require:
      - library(audit/testing)
    recommend:
      - kernel
      - audit
      - glibc-devel.ppc64
      - gcc
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 15m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 25
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/fanotify/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/filter
    summary: Test for audit filter (auditctl -F)
    description: |
        Sanity test for audit filter - auditctl "-F" option. At the moment
        the following filter are covered by the test:

          * -F pid/exe   (RHEL-7.3)
          * -F saddr_fam (RHEL-7.7)
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1715852
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1135565
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1715679
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - TIPpass_Security
      - Tier1
      - Tier1security
      - kernel
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/filter
    framework: beakerlib
    manual: false
    tty: false
    require:
      - library(audit/testing)
    recommend:
      - nc
      - audit
      - gcc
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 26
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/filter/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/multikey
    summary: Smoke test for multikey support (added in 2.6.6)
    description: |
        Since 2.6.6 audit support multiple keys for audit events. You can create
        audit rules with more than one keys and you can also search logs using
        more than one key. This test covers both cases. Please notice that in
        ausearch, multiple key parameters mean logical AND.
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link: []
    id:
    tag:
      - CI-Tier-1
      - TIPpass_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/multikey
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 15m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 27
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/multikey/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/options-log-format
    summary: Sanity of log_format option of auditd
    description: |+
        Test that log_format options of auditd works as expected.

        The log_format describes how the information should be stored on disk.
        There are 2 options and 1 depreated: 

          * NOLOG    - deprecated, if you are setting this format, now you should set 
                       the write_logs option to no;

          * RAW      - the audit records will be stored in a format exactly as the 
                       kernel sends it (default);

          * ENRICHED - will resolve all uid, gid, syscall,  architecture, and socket
                       address information before writing the event to disk. This aids 
                       in making sense of events created on one system but 
                       reported/analized on another system. 


    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1414812
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1406525
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1382397
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1127343
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - TIPfail
      - TIPfail_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/options-log-format
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - vim-common
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 28
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/options-log-format/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/options-verify-email
    summary: Sanity of verify_email option of auditd
    description: |-
        Test that verify_email option of auditd work as expected.

               verify_email
                      This option determines if the email address given in
                      action_mail_acct is checked to see if the domain name
                      can be resolved. This option must be given before
                      action_mail_acct or the default value of yes will be used.

        Test also verifies that e-mail verification works.
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1406887
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - TIPpass_Security
      - Tier1
      - Tier1security
      - TierCandidatesPASS
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/options-verify-email
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 29
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/options-verify-email/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/options-write-logs
    summary: Sanity of write_logs options of auditd
    description: |
        Test that write_logs option of auditd work as expected.

        The write_log options determines whether or not to write logs to the disk:

          * yes - log to disk;

          * no - do not log to disk.
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1414812
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - TIPpass_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/options-write-logs
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 30
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/options-write-logs/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/packaged-rules-files
    summary: Test sanity of packaged rules files
    description: |
        Audit package comes with a set of audit rules files. This test verifies
        that

         a) each of these files can be loaded into kernel and
         b) all rules from each file were loaded correctly.

        Please notice that automatic verification of (b) is a non-trivial problem
        and hence there is a list of exceptions - rules which are loaded correctly,
        but it cannot be easily checked.
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1462178
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1421416
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1767054
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1404093
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - NoRHEL5
      - NoRHEL6
      - TIPpass
      - TIPpass_Security
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/packaged-rules-files
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - aide
      - audit
      - stunnel
      - libreswan
      - cups
      - selinux-policy-mls
      - Network-Manager
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 15m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 31
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/packaged-rules-files/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/permissions
    summary: Test for permissions of files related to audit
    description: |+
        Attributes:

         * owner
         * group
         * permissions
         * selinux context

        Objects:

         * Directories:
         
           * /etc/audit/
           * /etc/audit/rules.d/
           * /var/log/audit/

         * Files:

           * /etc/audit/auditd.conf
           * /etc/audit/audit.rules
           * /var/log/audit/audit.log
           * /var/log/audit/audit.log.* (rotated logs)

        Expected Values: 

        In general we expect root for both user and group ownership for all objects.
        The only exception is when log_group is set non-root in audit.conf, then 
        /var/log/audit and all audit.log files should be owned by that particular
        group. Log files in /var/log/audit are writable by root only, rotated logs 
        are not writable. Detailed expected values can be found in tables below:

        User       : root
        Group      : root
        Context    : system_u:object_r:auditd_etc_t:s0
        Permissions:
         - /etc/audit/                0750
         - /etc/audit/rules.d/        0750
         - /etc/audit/auditd.conf     0640
         - /etc/audit/audit.rules     0640


        User       : root
        Group      : root/log_group
        Context    : system_u:object_r:auditd_log_t:s0
        Permissions:
         - /var/log/audit/            0700/0750
         - /var/log/audit/audit.log   0600/0640
         - /var/log/audit/audit.log.* 0400/0440


    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link:
      - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1362582
    id:
    tag:
      - CI-Tier-1
      - NoRHEL4
      - Tier1
      - Tier1security
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/permissions
    framework: beakerlib
    manual: false
    tty: false
    require:
      - audit
    recommend:
      - audispd-plugins
      - audit
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 32
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/permissions/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Downstream_audit_tests/Sanity/syscalls-smoke
    summary: Sanity test for auditing specific syscalls
    description: |
        Test auditing for specific syscalls. Any change in audit regarding syscalls 
        auditing might be put into this test. Currently it contains the following:

          * mq_open (BZ#955749)
    contact:
      - Ondrej Moris <omoris@redhat.com>
    enabled: true
    order: 50
    link: []
    id:
    tag:
      - CI-Tier-1
      - NoRHEL5
      - NoRHEL6
      - TIPfail
      - TIPfail_Security
      - Tier1
      - Tier1security
      - kernel
    tier: '1'
    component:
      - audit
    test: ./runtest.sh
    path: /Downstream_audit_tests/tests/Sanity/syscalls-smoke
    framework: beakerlib
    manual: false
    tty: false
    require:
      - library(audit/testing)
    recommend:
      - audit
      - gcc
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 15m
    result: respect
    where: *id001
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 33
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Downstream_audit_tests/tests/Sanity/syscalls-smoke/main.fmf
    discover-phase: Downstream_audit_tests
  - name: /Upstream_fapolicyd_tests/Sanity/audit-rule-number
    summary:
    description: chech the decision rule number is sent to audit
    contact:
      - Dalibor Pospíšil <dapospis@redhat.com>
    enabled: true
    order: 50
    link:
      - verifies: https://issues.redhat.com/browse/RHEL-624
      - verifies: https://issues.redhat.com/browse/RHEL-628
      - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2216668
      - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2216666
    id: e5ea5841-8f6f-4e7a-a68e-6f57f61f6984
    tag:
      - Tier2
      - CI-Tier-1
    tier: '2'
    component:
      - fapolicyd
      - audit
    test: ./runtest.sh
    path: /Upstream_fapolicyd_tests/tests/Sanity/audit-rule-number
    framework: beakerlib
    manual: false
    tty: false
    require:
      - rpm-build
      - rpm
      - rpmdevtools
      - curl
      - fapolicyd
      - git-core
      - audit
      - gcc
    recommend:
      - fapolicyd-selinux
      - yum-utils
      - python3
      - setools-console
      - sqlite
      - /usr/sbin/semanage
      - expect
      - setools
      - policycoreutils
      - library(distribution/epel-internal)
      - selinux-policy-devel
    environment:
        TMT_PLAN_DATA: /var/tmp/tmt/run-017/Plans/gating/data
        TMT_PLAN_ENVIRONMENT_FILE: /var/tmp/tmt/run-017/Plans/gating/data/variables.env
        TMT_TREE: /var/tmp/tmt/run-017/Plans/gating/tree
        TMT_VERSION: 1.33.0
    duration: 5m
    result: respect
    where: []
    check: []
    restart-on-exit-code: []
    restart-max-count: 1
    restart-with-reboot: false
    serial-number: 34
    sources:
      - /var/tmp/tmt/run-017/Plans/gating/discover/Upstream_fapolicyd_tests/tests/main.fmf
      - /var/tmp/tmt/run-017/Plans/gating/discover/Upstream_fapolicyd_tests/tests/Sanity/audit-rule-number/main.fmf
    discover-phase: Upstream_fapolicyd_tests
