tests/selinux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

semodule-rebuild-if-modules-changed: test changing booleans

Browse source 
Extend the test to verify correct behavior when a boolean setting
override is injected. Also add auto-detection of the --refresh /
--rebuild-if-modules-changed command-line option support, which
indicates the expected level of functionality. (And we also need to
ensure that --refresh is used when supported because the other option
may be removed in the future.)

Additionally, we need to work around the fact that the exact binary
policy content can now be different depending on if the optimized code
path has been taken. Do this by toggling a boolean before introducing
injected customizations, thus obtaining the expected policy content for
the case after `semodule --refresh`.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This commit is contained in:
Ondrej Mosnacek 2022-05-24 16:04:37 +02:00
commit c3dd00f4bc
No known key found for this signature in database
GPG key ID: BDE08B7A0C57B343
1 changed files with 58 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

74
policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
View file

@ -11,7 +11,11 @@ STORE_ROOT=/var/lib/selinux
STORE_TYPE=targeted
MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules"
STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern"
STORE_BOOLS="$STORE_ROOT/$STORE_TYPE/active/booleans.local"
TEST_MODULE_DIR="$MODULES_ROOT/400/test_module"
TEST_BOOLEAN="xguest_exec_content"
TEST_BOOLEAN_VALUE="0"
TEST_BOOLEAN_VALUE_TEXT="false"
CHECKSUM_CMD=sha256sum
@ -31,27 +35,46 @@ rlJournalStart
if [ "$policyvers" -lt "$policyvers_kernel" ]; then
policyvers="$policyvers_kernel"
fi
rlRun "semodule -N -B" 0 \
"Make sure policy store is in a consistent state initially"
refresh_opt=""
for opt in --refresh --rebuild-if-modules-changed; do
if semodule --help | grep -q -- "$opt"; then
refresh_opt="$opt"
rlLog "$opt command-line option detected for semodule"
break
fi
done
rlPhaseEnd
rlPhaseStartTest
if semodule --help | grep -q -- --rebuild-if-modules-changed; then
rlRun "semodule -N -B" 0 \
"Make sure policy store is in a consistent state initially"
if [ -n "$refresh_opt" ]; then
rlPhaseStartTest "No change behavior"
# The resulting binary policy will be different (albeit
# equivalent) after a full rebuild vs. when only local
# changes are applied to existing policy.linked file, so
# toggle a boolean twice to get the expected binary form.
rlRun "setsebool -P xguest_exec_content $TEST_BOOLEAN_VALUE"
rlRun "setsebool -P xguest_exec_content $(( ! $TEST_BOOLEAN_VALUE ))"
checksum_before="$(policy_checksum "$policyvers")"
rlRun "semodule -N --rebuild-if-modules-changed"
rlRun "semodule -N $refresh_opt"
checksum_after="$(policy_checksum "$policyvers")"
rlAssertEquals "Binary policy must not change after rebuild" \
"$checksum_before" "$checksum_after"
# Make sure policy is restored regardless of any previous failures
rlRun "semodule -N -B" 0 \
"Make sure policy store is in a consistent state initially"
"Force a rebuild to clean things up"
rlPhaseEnd
rlPhaseStartTest "Module injected"
rlLog "Inject a new module into the store"
rlRun "mkdir -p '$TEST_MODULE_DIR'"
rlRun "echo -n cil >'$TEST_MODULE_DIR/lang_ext'"
rlRun "echo '(type test_module_type_t)' >'$TEST_MODULE_DIR/cil'"
rlRun "semodule -N --rebuild-if-modules-changed" 0 \
rlRun "semodule -N $refresh_opt" 0 \
"Do a conditional rebuild"
rlRun "semodule -l | grep test_module" 0 \
"Verify that the module has been picked up"
@ -60,7 +83,7 @@ rlJournalStart
rlLog "Now remove the module"
rlRun "rm -rf '$TEST_MODULE_DIR'"
rlRun "semodule -N --rebuild-if-modules-changed"
rlRun "semodule -N $refresh_opt"
rlRun "semodule -l | grep test_module" 1 \
"Verify that the module has been removed"
rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 1 \
@ -69,14 +92,33 @@ rlJournalStart
# Make sure policy is restored regardless of any previous failures
rlRun "semodule -N -B" 0 \
"Force a rebuild to clean things up"
#rlRun "setsebool -NP daemons_use_tty=on"
# TODO test changing booleans (persistently)
else
rlLog "--rebuild-if-modules-changed command-line option not supported; skipping tests..."
fi
rlPhaseEnd
rlPhaseEnd
rlPhaseStartCleanup
rlPhaseEnd
# --refresh option implies fixed boolean/etc. behavior
if [ "$refresh_opt" = "--refresh" ]; then
rlPhaseStartTest "Boolean setting injected"
rlLog "Inject a boolean setting into the store"
rlRun "echo '$TEST_BOOLEAN=$TEST_BOOLEAN_VALUE' >'$STORE_BOOLS'"
rlRun "semodule -N $refresh_opt" 0 \
"Do a conditional rebuild"
rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 0 \
"Verify that the boolean setting has been picked up"
rlLog "Now remove the setting"
rlRun "rm -f '$STORE_BOOLS'"
rlRun "semodule -N $refresh_opt"
rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 1 \
"Verify that the boolean setting has been reset back"
# Make sure policy is restored regardless of any previous failures
rlRun "semodule -N -B" 0 \
"Force a rebuild to clean things up"
rlPhaseEnd
fi
else
rlPhaseStartTest "Test skipped"
rlLog "--rebuild-if-modules-changed/--refresh command-line option not supported; skipping tests..."
rlPhaseEnd
fi
rlJournalPrintText
rlJournalEnd