From 08dcaa35346d7d80301a9bb026207f8d70ea2ebe Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 22 Sep 2021 22:00:04 +0200 Subject: [PATCH] kernel/selinux-testsuite: patch the policy for restraint When this test in run via restraint (e.g. on Beaker), it inherits some file descriptors originating from it, labeled unconfined_service_t. This leads to a huge amount of denials when test programs are exectuted. To work around this, add a rule to the policy that allows the test domains to inherit these descriptors from unconfined_service_t. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index b12338c..188c240 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -304,6 +304,10 @@ rlJournalStart } | rlRun "tee -a tests/tun_tap/tun_common.h" 0 \ "Harden tun_tap test against missing defs" + # needed to avoid a flood of AVCs when run via restraint + rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0 + rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0 + exclude_tests="" force_tests="" for file in ./tests/nnp*/execnnp.c; do