[PATCH] tests/keys: skip KEYCTL_DH_COMPUTE when unavailable

[Pablo Alessandro Santos Hugen <phugen@redhat.com>]

Since 32f07cc40c9b ("crypto: dh - disallow plain "dh" usage in
FIPS mode") landed in linux 5.18, plain "dh" is disallowed in
FIPS mode per SP800-56Arev3. As noted in the commit:

> This change will effectively render the
> keyctl(KEYCTL_DH_COMPUTE) syscall unusable in FIPS mode, but
> it has been brought up that this might even be a good thing
> ([1])."
>
> [1] https://lore.kernel.org/r/20211217055227.GA20698@gondor.apana.org.au

keyctl(KEYCTL_DH_COMPUTE) returns ENOENT in FIPS mode.

So, this patch treat ENOENT and ENOSYS as non-fatal in
keyctl.c (because the operation is unavailable, not denied by
policy). SELinux denials (EACCES) still exit 9. Skip
test_key_no_read_t in FIPS mode since KEYCTL_DH_COMPUTE is
the only operation requiring key { read }.

Fixes: 2d7aad8a1f8c ("selinux-testsuite: Add keys tests")
Signed-off-by: Pablo Alessandro Santos Hugen <phugen@redhat.com>
---
 tests/keys/keyctl.c       | 15 ++++++++++-----
 tests/keys/request_keys.c | 15 ++++++++++-----
 tests/keys/test           | 21 +++++++++++++++------
 3 files changed, 35 insertions(+), 16 deletions(-)

diff --git a/tests/keys/keyctl.c b/tests/keys/keyctl.c
index e13c655..261c00a 100644
--- a/tests/keys/keyctl.c
+++ b/tests/keys/keyctl.c
@@ -142,12 +142,17 @@ int main(int argc, char *argv[])
 	/* Requires key { create read write } */
 	compute = keyctl(KEYCTL_DH_COMPUTE, &params, NULL, 0, 0);
 	if (compute < 0) {
-		fprintf(stderr, "Failed KEYCTL_DH_COMPUTE: %s\n",
-			strerror(errno));
-		exit(9);
-	}
-	if (verbose)
+		if (errno == ENOENT || errno == ENOSYS) {
+			if (verbose)
+				printf("KEYCTL_DH_COMPUTE not available, skipping\n");
+		} else {
+			fprintf(stderr, "Failed KEYCTL_DH_COMPUTE: %s\n",
+				strerror(errno));
+			exit(9);
+		}
+	} else if (verbose) {
 		printf("KEYCTL_DH_COMPUTE key ID size: %d\n", compute);
+	}
 
 	/* Requires key { write link } */
 	link = keyctl(KEYCTL_LINK, base, KEY_SPEC_PROCESS_KEYRING);
diff --git a/tests/keys/request_keys.c b/tests/keys/request_keys.c
index 43b20d9..7cf7cd0 100644
--- a/tests/keys/request_keys.c
+++ b/tests/keys/request_keys.c
@@ -127,12 +127,17 @@ int main(int argc, char **argv)
 	/* Requires key { read write } */
 	compute = keyctl(KEYCTL_DH_COMPUTE, &params, NULL, 0, 0);
 	if (compute < 0) {
-		fprintf(stderr, "Failed KEYCTL_DH_COMPUTE: %s\n",
-			strerror(errno));
-		exit(8);
-	}
-	if (verbose)
+		if (errno == ENOENT || errno == ENOSYS) {
+			if (verbose)
+				printf("\tKEYCTL_DH_COMPUTE not available, skipping\n");
+		} else {
+			fprintf(stderr, "Failed KEYCTL_DH_COMPUTE: %s\n",
+				strerror(errno));
+			exit(8);
+		}
+	} else if (verbose) {
 		printf("\tKEYCTL_DH_COMPUTE key ID size: %d\n", compute);
+	}
 
 	exit(0);
 }
diff --git a/tests/keys/test b/tests/keys/test
index 061bc62..9e50633 100755
--- a/tests/keys/test
+++ b/tests/keys/test
@@ -29,6 +29,9 @@ BEGIN {
         $test_link_53 = 1;
     }
 
+    # KEYCTL_DH_COMPUTE is disabled in FIPS mode
+    chomp( $fips = `cat /proc/sys/crypto/fips_enabled 2>/dev/null` );
+    $skip_dh = ( $fips eq "1" ) ? 1 : 0;
     plan tests => $test_count;
 }
 
@@ -51,8 +54,11 @@ ok( $result >> 8 eq 6 );
 $result = system "runcon -t test_key_no_view_t $basedir/keyctl $v 2>&1";
 ok( $result >> 8 eq 8 );
 
-$result = system "runcon -t test_key_no_read_t $basedir/keyctl $v 2>&1";
-ok( $result >> 8 eq 9 );
+SKIP: {
+    skip( "KEYCTL_DH_COMPUTE unavailable in FIPS mode", 1 ) if $skip_dh;
+    $result = system "runcon -t test_key_no_read_t $basedir/keyctl $v 2>&1";
+    ok( $result >> 8 eq 9 );
+}
 
 $result = system "runcon -t test_key_no_link_t $basedir/keyctl $v 2>&1";
 if ($test_link_53) {
@@ -101,9 +107,12 @@ $result = system(
 );
 ok( $result >> 8 eq 6 );
 
-$result = system(
-"runcon -t test_keyring_service_t $basedir/keyring_service $v test_request_keys_no_read_t $basedir/request_keys 2>&1"
-);
-ok( $result >> 8 eq 8 );
+SKIP: {
+    skip( "KEYCTL_DH_COMPUTE unavailable in FIPS mode", 1 ) if $skip_dh;
+    $result = system(
+    "runcon -t test_keyring_service_t $basedir/keyring_service $v test_request_keys_no_read_t $basedir/request_keys 2>&1"
+    );
+    ok( $result >> 8 eq 8 );
+}
 
 exit;
-- 
2.56.0