* Fri Oct 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.1-1

- New rebase https://github.com/containers/udica/releases/tag/v0.2.1

.gitignore

@@ -1,3 +1,11 @@
 /v0.1.1.tar.gz
 /v0.1.2.tar.gz
 /v0.1.3.tar.gz
+/v0.1.4.tar.gz
+/v0.1.5.tar.gz
+/v0.1.6.tar.gz
+/v0.1.7.tar.gz
+/v0.1.8.tar.gz
+/v0.1.9.tar.gz
+/v0.2.0.tar.gz
+/v0.2.1.tar.gz

sources

@@ -1 +1 @@
-SHA512 (v0.1.3.tar.gz) = c0ef057f30ae4475c08d5a2972110b3608d535dd02ecb4c8aaeef676cf0510c28410063573613487e3a647f5a4c507b6eb831edaf3ab3c5de06b1fda62e2b603
+SHA512 (v0.2.1.tar.gz) = 11238515e704faaffb0ba29ba99d07dfb21ca4628d496710231b8bcac640083b28d76b092ac3237b7d46922f2454d89ba1e0e00ba8378bb2f8c828c8d53500bf

tests/docker/runtest.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Description: Compare udica output between podman and docker
+#   Author: Jan Zarsky <jzarsky@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2019 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="udica"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm "udica"
+        rlAssertRpm "policycoreutils"
+        rlAssertRpm "podman"
+        rlAssertRpm "docker"
+        rlRun "rlServiceStart docker"
+        OUTPUT_FILE=$(mktemp)
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        for BACKEND in podman docker ; do
+            rlRun "$BACKEND run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+            rlRun "$BACKEND ps | grep test"
+            CONT_ID=$($BACKEND ps | grep test | cut -d ' ' -f 1)
+            rlRun "udica -i $CONT_ID my_container"
+            rlRun "mv my_container.cil my_cont_$BACKEND.cil"
+            rlRun "$BACKEND stop test"
+            rlRun "$BACKEND rm test"
+        done
+
+        rlRun "sed -i '/capability/d' my_cont_podman.cil"
+        rlRun "diff -b -B my_cont_podman.cil my_cont_docker.cil"
+
+        rlRun "rm my_cont_podman.cil my_cont_docker.cil"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f $OUTPUT_FILE"
+        rlRun "rlServiceRestore docker"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

tests/sanity/runtest.sh

@@ -0,0 +1,129 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Description: Test basic functionality of udica
+#   Author: Jan Zarsky <jzarsky@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2019 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="udica"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm "udica"
+        rlAssertRpm "policycoreutils"
+        rlAssertRpm "podman"
+        OUTPUT_FILE=$(mktemp)
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "udica --help"
+        rlRun "PAGER=cat man udica"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test basic scenario"
+        rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+        rlRun "podman ps | grep test"
+        rlRun "ps -efZ | grep bash"
+        rlRun "ps -efZ | grep bash | grep container_t"
+
+        rlRun "podman exec test ls /home" 1,2
+        rlRun "podman exec test touch /var/spool/test" 1
+        rlRun "podman exec test dnf install nmap-ncat -y" 0
+        rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3
+
+        CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
+        rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE"
+        rlRun "podman stop test"
+        rlRun "podman rm --force test"
+
+        rlRun "cat $OUTPUT_FILE"
+        rlAssertExists "my_container.cil"
+        SEMODULE=$(cat $OUTPUT_FILE | grep "semodule -i" | cut -d '#' -f 2)
+        rlRun "$SEMODULE"
+
+        PODMAN_OPT=$(cat $OUTPUT_FILE | grep "security-opt" | cut -d '"' -f 2)
+        rlRun "podman run -dit --name test2 $PODMAN_OPT -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+        rlRun "podman ps | grep test2"
+        rlRun "ps -efZ | grep bash"
+        rlRun "ps -efZ | grep bash | grep my_container.process"
+
+        rlRun "podman exec test2 ls /home" 0
+        rlRun "podman exec test2 touch /var/spool/test" 0
+        rlRun "podman exec test2 dnf install nmap-ncat -y" 0
+        rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 2" 3
+
+        rlRun "podman stop test2"
+        rlRun "podman rm --force test2"
+
+        rlRun "semodule -r my_container base_container net_container home_container"
+        rlRun "rm my_container.cil"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Compare different ways of obtaining policy"
+        rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+        rlRun "podman ps | grep test"
+
+        CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
+        rlRun "podman inspect $CONT_ID | udica my_container >pipe.result"
+
+        rlRun "podman inspect $CONT_ID >container.json"
+        rlRun "udica -j container.json my_container >json.result"
+
+        rlRun "udica -i $CONT_ID my_container >id.result"
+
+        rlRun "diff pipe.result json.result"
+        rlRun "diff pipe.result id.result"
+
+        rlRun "rm -f pipe.result json.result id.result container.json"
+        rlRun "podman stop test"
+        rlRun "podman rm test"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test loading modules"
+        rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+        rlRun "podman ps | grep test"
+
+        CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
+        rlRun "podman inspect $CONT_ID | udica -l my_container"
+
+        rlRun "podman stop test"
+        rlRun "podman rm test"
+
+        rlRun "semodule -l >$OUTPUT_FILE"
+        rlAssertGrep "my_container" $OUTPUT_FILE
+        rlAssertGrep "base_container" $OUTPUT_FILE
+        rlAssertGrep "net_container" $OUTPUT_FILE
+        rlAssertGrep "home_container" $OUTPUT_FILE
+
+        rlRun "semodule -r my_container base_container net_container home_container"
+        rlRun "rm my_container.cil"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f $OUTPUT_FILE"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

tests/tests.yml

@@ -0,0 +1,25 @@
+- hosts: localhost
+  tags:
+  - classic
+  - container
+  roles:
+  - role: standard-test-source
+
+  - role: standard-test-basic
+    required_packages:
+    - python3
+    tests:
+    - smoke:
+        dir: ./source
+        run: python3 -m unittest -v tests/test_unit.py
+    - smoke2:
+        dir: ./source
+        run: python3 tests/test_integration.py
+
+  - role: standard-test-beakerlib
+    tags:
+        - classic
+    tests:
+        - sanity
+    required_packages:
+        - podman

udica.spec

@@ -1,7 +1,7 @@
 Summary: A tool for generating SELinux security policies for containers
 Name: udica
-Version: 0.1.3
-Release: 3%{?dist}
+Version: 0.2.1
+Release: 1%{?dist}
 Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz
 License: GPLv3+
 BuildArch: noarch
@@ -44,7 +44,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8
 %{_mandir}/man8/udica.8*
 %{_bindir}/udica
 %dir %{_datadir}/udica
+%dir %{_datadir}/udica/ansible
 %dir %{_datadir}/udica/templates
+%{_datadir}/udica/ansible/*
 %{_datadir}/udica/templates/*
 
 %if 0%{?fedora} || 0%{?rhel} > 7
@@ -58,6 +60,46 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8
 %endif
 
 %changelog
+* Fri Oct 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.1-1
+- New rebase https://github.com/containers/udica/releases/tag/v0.2.1
+
+* Wed Sep 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.0-1
+- New rebase https://github.com/containers/udica/releases/tag/v0.2.0
+
+* Wed Aug 28 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.9-1
+- Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2
+- New rebase https://github.com/containers/udica/releases/tag/v0.1.9
+
+* Thu Jul 11 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.8-1
+- New rebase https://github.com/containers/udica/releases/tag/v0.1.8
+
+* Wed Jun 12 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.7-1
+- New rebase with upstream adding new param --ansible, to generate ansible playbook for deploying policies. https://github.com/containers/udica/releases/tag/v0.1.7
+
+* Thu May 16 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.6-1
+- New rebase with upstream adding new tests
+
+* Tue Apr 30 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.5-2
+- Add allow rules for container_runtime_t to base_container.cil, Podman version 1.2.0 requires new allow rules.
+* Fri Apr 19 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.5-1
+- Create mock selinux and semanage module
+- Update testing section in README
+- Add travis file for Travis CI
+- Grammar fixes in the udica.8 manpage file
+- Support port ranges (Resolves: #16)
+- Test port ranges
+
+* Mon Mar 11 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.4-1
+- Fix minor problems reported by pylint #11
+- Catch FileNotFoundError when inspecting containers #12
+- Create basic tests #13
+- Restore working directory #14
+- udica cannot use the container ID once it is provided #10
+
+* Mon Feb 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-4
+- Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8
+- Add check if runtimes are installed on the system
+
 * Sun Feb 17 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-3
 - Improve capability parsing for docker containers
 - Update small changes in manpage, like issue with mandatory option '-c' for docker containers