Since the testsuite now loads more policy modules, the `semodule -r
test_policy` command is not enough for a full cleanup. Do `make -C
policy unload instead`.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Based on several runs in Beaker, these seem to be the best conditions
for distinguishing the bug. Currently, legacy Beaker HW filters are used
in the metadata. Once TMT introduces support for generic HW
requirements, they will need to be converted to the new format.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On fast systems with a lot of cores the 10s synflood run produces too
large perf.data (> 1 GiB), so reduce it to 5s and also increase the
test's time limit to 1h to make sure that it has enough time to process
such a large file.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It turns out there is too much variability in the percent values across
arches/machines, so give up on the general approach (checking that all
SELinux functions are below some hard limit) and instead focus only on
selinux_peerlbl_enabled() and compare its position with other functions.
In case selinux_peerlbl_enabled() is not found in /proc/kallsyms, it is
inlined into other functions, so we need to check selinux_ip_postroute()
instead of selinux_peerlbl_enabled().
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The file can get really huge and it compresses well, so it's better to
compress it with xz before doing rlFileSubmit.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The generated perf.data can be quite big and uploading it takes a long
time in some cases, so raise the time to 20 minutes.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Rather than enumerating RHEL versions, use comparison against
"known-good" version to make the expressions easier to read and
understand.
Also convert users of '~<' to '<', as '~<' compares only minor versions
within the same major.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Relevancy changes are made based on recommendations from:
tmt test lint --fix
Some packages are available for Fedoras only and are not available
for RHELs at all.
Some packages are available for latest RHEL major versions only.
The main highlight is that filesystems tests are now run for all
supported filesystems, instead of just the one that is native to the
platform.
Also, the testsuite no longer (directly) requires Python, so drop the
dependency and a related workaround.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Fix compilation of SCTP test programs and disable SCTP ASCONF tests on
RHEL-8.1 kernels that don't have certain SCTP commits from upstream.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Put all the RHEL-specific checks/workarounds under one common rlIsRHEL
conditional to make it clear that they apply to RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
In the last upstream ref bump, I failed to notice that one of the new
commits causes the test to fail on RHEL-7 because of a missing interface
in the policy. Temporarily apply the patch I sent upstream to fix it.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Highlights:
- SCTP tests have been refactored and extended
- the "keys" subtest has been fixed to not fail when Intel QAT driver
is used for DH acceleration
- the GRE interface for a second IP address is now created
automatically by the testsuite
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
libselinux and selnux-policy are already required by their -devel
counterparts (and other packages), libsemanage is also not required
directly, and platform-python was only needed on earlier RHEL-8.0 dev
composes where python3 wasn't installable directly (and I suspect that
it wouldn't help there, anyway...).
Note that this also works around:
https://bugzilla.redhat.com/show_bug.cgi?id=1876847
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add another global IPv4 address by creating a dummy GRE interface in
order to activate two extra SCTP tests that require two unique global
IPv4 addresses.
Before (F32):
Files=61, Tests=832, 176 wallclock secs ( 0.59 usr 0.13 sys + 4.92 cusr 6.54 csys = 12.18 CPU)
After (F32):
Files=61, Tests=834, 182 wallclock secs ( 0.66 usr 0.11 sys + 6.28 cusr 7.68 csys = 14.73 CPU)
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recently there were some changes in CKI upstream kernel building and the
old bugginess detection doesn't work any more. Fix it to use adifferent
build program, which is still missing.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
An issue was found in CephFS that caused symlinks to be left unlabeled
upon creation. Extend the test to cover also symlinks, special file
types, and directories.
Upstream fix: https://marc.info/?l=ceph-devel&m=159596407215153&w=2
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Highlights:
- Use native filesystem for FS tests
- Avoid mmap test failures when /dev is mounted noexec
- Add nftables to inet_socket and sctp tests
- Fix overlayfs test false positive on new kernels (previously applied
as a patch)
- Add check for key changes on watch_queue
Several RHEL workarounds were needed, see the diff for details.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
When the boolean name passed to boolSet is an alias, then the current
implementation would always skip setting the boolean. That in turn
causes allow_domain_fd_use to remain unset when it is an alias and the
testsuite fails (because it then doesn't reset the value due to `make`
logic). That can cause AVCs in later tests and so needs to be fixed.
The fix is to just try `getsebool <name>` instead of grepping `getsebool
-a` for the boolean name.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI interprets the "Abort" result as an infra failure and waives the
test in such case. So if "git clone" fails, it's better to abort the
whole test so that a false positive test failure is not reported.
Turns out that Beaker interprets the exit code 127 (possibly other ones,
but this one I'm sure about) as Abort, so we can just do that instead of
relying on the legacy rhts-abort command.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
There is a new permission required to create whiteout nodes, causing the
test to fail on fresh mainline kernels. Apply the patch from Stephen
Smalley to fix that until we pick it up in a rebase.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The CKI kernels are cross-compiled on x86_64, so they generate an
invalid (little-endian) in-kernel BTF on big-endian systems. Work around
this by skipping the BPF test if little-endian BTF is detected on s390x.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Nothing from there seems to be actually used by the testsuite and it's
not even shipped on recent RHELs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The test verifies expected behavior of CephFS security label support
across distros.
Note that for the test to work RHEL, an appropriate Ceph repo must be
installed. A scriptlet that sets this up can be provided via the
INSTALL_SCRIPTLET parameter.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Bump upstream commit to include the new glblub test and drop the patch
that is also included in upstream now.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It turns out that in CKI's kickstart the CRB repo is enabled by default,
but this is not true for the usual beaker install. Thus, try to install
libbpf-devel from the usual CRB repo names. Yes, it's an ugly
workaround, but there's currently no better way.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Replacing kernel version occurences is problematic when different tests
have the same bounding kernel version, as is true for current upstream.
Therefore, replace it with adding "force_tests" list that works
similarly to the existing "exclude_tests" list, but forces execution of
the tests instead of excluding them.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On Beaker the repo has a different name and CRB is enabled there anyway.
This workaround is only useful with the internal 1minutetip tool, so
it's not worth keeping it here.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On RHEL and non-x86_64 Fedora kernels, the kernel.unprivileged_bpf_disabled
sysctl is enabled by default (and at least on RHEL/ARK it cannot be
changed). Instead of trying to disable the BPF subtest completely on
these kernels (which is incomplete since CKI tests ARK kernels on
Fedora), add the sys_admin capability to the BPF test domains to make
the test work on these kernels as well.
We also need to install libbpf-devel separately from CRB on RHEL, since
it's not shipped in BaseOS.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The "conmakehash" program is not shipped on recent Fedora kernels (and
who knows where else). Switch to "unifdef", which seems to be everywhere
(and always an ELF executable).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The only significant change that this pulls in is 7fd02b152f9f
("tests/prlimit: avoid invalid limit combinations"), which fixes false
test failures in some environments.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This helps when debugging unexpected AVCs. This was formerly done by the
selinux-policy/common library, which the test doesn't use any more, so
let's add this useful feature back with just four simple commands.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI RHEL-8 builds are cross-compiled badly, so disable module_load also
when the kernel-devel built helper programs are unusable.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The RPM is not important, what is important is the running kernel (and
that can't be missing, obviously) and its version is already shown
elsewhere.
Moe importantly, in Fedora CI the 'kernel' RPM may not even be there, so
the test would warn about it, causing failures.
Reported-by: Lukas Vrabec <lvrabec@redhat.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...because tier 1 tests are ran for all SELinux components, which is
alittle too often for this not-so-lightweight test.
Suggested-by: Petr Lautrbach <plautrba@redhat.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
