The numad component is used in various versions of RHEL and Fedora,
so it makes sense to run this TC in upstream testing too.
Moving the downstream TC to upstream repository.
There are some minor changes when comparing the upstream and downstream
versions of the TC.
One of the testcase failed due to absence of chkconfig and initrc
related files. Make existing code compatible with higher versions of
Fedora and fix the failures.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
SELinux prevents the rtkit-daemon process from setting nice value.
I believe this access is harmless from security point-of-view and
should be allowed. The TC is not able to reproduce the issue, but it
looks for an appropriate SELinux policy rule.
The TC covers BZ#1750024, BZ#1910507 and other duplicates.
The test reproduces scenarios described in 2 different bugs. One of
them is BZ#1823672. If this scenario should succeed, a newly introduced
boolean called logging_syslogd_append_public_content needs to be enabled.
The scenario also requires that the target log file exists before
the rsyslogd process tries to append to it.
Because the test uses a custom policy module, there will always
be at least 2 USER_AVC messages reported (received policyload notice
caused by insertion and removal of the policy module). The ausearch
calls should only care about AVC messages.
The test also uses the semanage command, which is not required in Makefile.
Both issues are now fixed.
Since the testsuite now loads more policy modules, the `semodule -r
test_policy` command is not enough for a full cleanup. Do `make -C
policy unload instead`.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Based on several runs in Beaker, these seem to be the best conditions
for distinguishing the bug. Currently, legacy Beaker HW filters are used
in the metadata. Once TMT introduces support for generic HW
requirements, they will need to be converted to the new format.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On fast systems with a lot of cores the 10s synflood run produces too
large perf.data (> 1 GiB), so reduce it to 5s and also increase the
test's time limit to 1h to make sure that it has enough time to process
such a large file.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It turns out there is too much variability in the percent values across
arches/machines, so give up on the general approach (checking that all
SELinux functions are below some hard limit) and instead focus only on
selinux_peerlbl_enabled() and compare its position with other functions.
In case selinux_peerlbl_enabled() is not found in /proc/kallsyms, it is
inlined into other functions, so we need to check selinux_ip_postroute()
instead of selinux_peerlbl_enabled().
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The file can get really huge and it compresses well, so it's better to
compress it with xz before doing rlFileSubmit.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This is needed for running tests using TMT. Since all tests here use
beakerlib, let's just make it a global default.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The generated perf.data can be quite big and uploading it takes a long
time in some cases, so raise the time to 20 minutes.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Repeated run of the TC in the same location revealed 2 issues:
the test user (toor) and the base.cil (modified policy module) file
were not deleted, which lead to unnecessary failures.
Both issues should be fixed now.
- use spaces instead of tabs
- update copyright date
- cover more cases with correct behavior
usepasswd=False
- Standard users should not trigger a policy change
- SELinux users with home in / shoud not trigger a policy change
- Other SELinux users should trigger a policy change
usepasswd=True
- Standard users with home in /home should not trigger a policy change
- Standard users with home in directory like /var/home should trigger a policy change
- Standard users with home in / shoud not trigger a policy change
- SELinux users with home in / shoud not trigger a policy change
- Other SELinux users should trigger a policy change
Rather than enumerating RHEL versions, use comparison against
"known-good" version to make the expressions easier to read and
understand.
Also convert users of '~<' to '<', as '~<' compares only minor versions
within the same major.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Relevancy changes are made based on recommendations from:
tmt test lint --fix
Some packages are available for Fedoras only and are not available
for RHELs at all.
Some packages are available for latest RHEL major versions only.
When the root user runs dhclient, SELinux denials related to chronyc
are triggered, because SELinux policy does not allow dhclient-script
to find and execute chronyc.
I believe that SELinux policy should define a transition from dhcpc_t
to chronyc_t, which allows the chronyc program to run under the correct
context and do actions which are expected.
The TC covers BZ#1897388. The TC reproduces the issue described above
and it also looks for appropriate policy rules.
Basic automated test which runs the dhclient program and looks for
any SELinux denials which appear during the run. The dhclient tool
is known to run other network related programs, which can trigger
various SELinux denials.
If the scenario, where confined root user tries to run the perf tool,
should work, the root user must be able to log in via SSH. This
access is disabled by default. The TC will temporarily enable it.
Not only unconfined root (unconfined_t) should be able to run the
perf tool, but also the confined root (sysadm_t) should be able to
do that.
The TC now contains a new test phase which tests the scenario.
The kernel already recognizes the perf_event class and its permissions.
Current SELinux policy does not, but it will.
To avoid possible issues, we need to test some basic scenarios which
take advantage of the perf_event class. For example: the perf tool
executed by root/unconfined_t user.
The TC covers BZ#1901957.
Some checks in the automated tests require an unmounted SELinux
file-system. This way is used to pretend that SELinux is disabled.
Sometimes the file-system cannot be unmounted because of
umount: /sys/fs/selinux: target is busy.
To work around this issue, umount with --lazy option will be used.
If umount --lazy still complains, the problematic checks will be
skipped, because it still make sense to run the other parts of the
automated tests.
Additional SELinux denials were found during systemd-sleep testing
process. Unfortunately, SELinux policy rules which fix these denials
were not tested in this TC. Now, they are.
The automated TC contains a phase where services systemd-hybrid-sleep
and systemd-hibernate are started for testing purposes. Unfortunately,
running these services had real consequences on machines in certain
environments where the TC was executed (for example: machines became
unresponsive).
To have some control of the situation, a new environment variable was
introduced. It is called REAL_SCENARIOS and it can avoid the situation
when set to false. Default value of the variable is true which means
that above-mentioned services will be executed.
Recent testing of the new policy for the system-sleep program revealed,
that the program wants the sys_ptrace capability and it also wants to
write to /sys/power directory. Unfortunately, these actions are prevented
by SELinux because SELinux policy does not contain appropriate allow
rules.
This automated TC checks for appropriate SELinux policy rules and it
also reproduces the issue.
This TC covers BZ#1850177.
When 'rpmdb --help' is executed in console, there is no output
displayed because of SELinux denials. This issue should be fixed
in SELinux policy via appropriate allow rules.
When 'rpmdb --exportdb' is executed, SELinux denials appear again,
but this time they are related to communication with SSSD and D-bus
daemon. This issue should be fixed in SELinux policy via dontaudit
rules because the access to D-bus and SSSD processes is not necessary
for successful run of rpmdb.
The TC covers BZ#1899548 and its duplicates.
The rsyslog test suite, at present provides coverage for bugs 1823669
and 1823672. Later more cases will be added from downstream. Bz1823669
highlights the avc issues related rsyslog "imfile" module, which cannot
read parent directories of the file to process. Bz1823672 is also about
AVCs related to browsing the parent directories when rsyslog is
configured to write logs to a custom file.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Based on SELinux policy rules, the root/unconfined_t user is expected
to run the rpmdb program. A new test phase tests if such a scenario
works successfully or not. Of course, the rpmdb program recognizes
a lot of options, only the basic ones will be tested here.
The rpmdb process executed by the rpmdb-rebuild service wants to
read the /etc/resolv.conf symlink, but SELinux denies that access,
because SELinux policy does not allow that. This TC is able to
reproduce the issue.
I believe this issue should be fixed in selinux-policy component
via appropriate allow rule.
The TC covers BZ#1898298.
Recent SELinux policy brought new types like rpmdb_exec_t and rpmdb_t,
which are assigned to the rpmdb program and to the rpmdb process.
Because we don't have any test coverage for these types, I wrote a basic
test which runs the rpmdb-rebuild service in default configuration and
looks for any SELinux denials.
The main highlight is that filesystems tests are now run for all
supported filesystems, instead of just the one that is native to the
platform.
Also, the testsuite no longer (directly) requires Python, so drop the
dependency and a related workaround.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It makes no sense to run this TC on RHEL-8.x or lower RHELs, because
the systemd-userdbd service is not available there. As soon as the
service becomes available in these environments, the TC can be enabled.
