tests/selinux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update test for virtualization daemons

Browse source 
Since Fedora 40, virt policy has been split into 2 modules.
There are new types for hypervisor drivers in the main policy module and
also new types for secondary drivers in the virt_supplementary module.
This commit is contained in:
Zdenek Pytela 2023-10-16 12:25:46 +02:00
commit ba723f4941
1 changed files with 31 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
selinux-policy/virtualization-daemons/runtest.sh
View file

@ -32,6 +32,22 @@
PACKAGE="selinux-policy"
ROOT_PASSWORD="redhat"
SERVICE_NAMES="libvirtd virtinterfaced virtlockd virtlogd virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd virtxend"
if rlIsFedora > "39"; then
ALL_TUPLES="libvirtd:libvirtd:virtd_t \
virtinterfaced:virtinterfaced:virtinterfaced_t \
virtlockd:virtlockd:virtlogd_t \
virtlogd:virtlogd:virtlogd_t \
virtlxcd:virtlxcd:virtd_lxc_t \
virtnetworkd:virtnetworkd:virtnetworkd_t \
virtnodedevd:virtnodedevd:virtnodedevd_t \
virtnwfilterd:virtnwfilterd:virtnwfilterd_t \
virtproxyd:virtproxyd:virtproxyd_t \
virtqemud:virtqemud:virtqemud_t \
virtsecretd:virtsecretd:virtsecretd_t \
virtstoraged:virtstoraged:virtstoraged_t \
virtvboxd:virtvboxd:virtvboxd_t"
# virtxend:virtxend:virtxend_t"
else
ALL_TUPLES="libvirtd:libvirtd:virtd_t \
virtinterfaced:virtinterfaced:virtd_t \
virtlockd:virtlockd:virtlogd_t \
@ -46,6 +62,7 @@ ALL_TUPLES="libvirtd:libvirtd:virtd_t \
virtstoraged:virtstoraged:virtd_t \
virtvboxd:virtvboxd:virtd_t"
# virtxend:virtxend:virtd_t
fi
rlJournalStart
rlPhaseStartSetup
@ -69,6 +86,19 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "SELinux contexts and rules"
if rlIsFedora > "39"; then
rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtinterfaced_exec_t"
rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_lxc_exec_t"
rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtnetworkd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtnodedevd" "virtnodedevd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtnwfilterd" "virtnwfilterd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtproxyd" "virtproxyd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtqemud" "virtqemud_exec_t"
rlSEMatchPathCon "/usr/sbin/virtsecretd" "virtsecretd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtstoraged" "virtstoraged_exec_t"
rlSEMatchPathCon "/usr/sbin/virtvboxd" "virtvboxd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtxend" "virtxend_exec_t"
else
rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtd_exec_t"
@ -80,6 +110,7 @@ rlJournalStart
rlSEMatchPathCon "/usr/sbin/virtstoraged" "virtd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtvboxd" "virtd_exec_t"
rlSEMatchPathCon "/usr/sbin/virtxend" "virtd_exec_t"
fi
rlPhaseEnd
rlPhaseStartTest "real scenario -- standalone service"