Unfortunately, the test was merged even if some metadata was missing.
Additionally, the description and summary contains characters which
are not allowed based on the output of: tmt tests lint.
Both problems should be fixed now.
A recently reported customer case revealed that the restorecon
program produces error messages even if it was executed with
the '-i' option. In such case no error messages should appear
when the inspected filesystem objects are missing.
The TC reproduces the situation when old libselinux/policycoreutils
packages are installed.
The TC covers RHEL-110181 and RHEL-123884.
A recent dhcpcd + selinux-policy testing revealed that SELinux
prevents the running dhcpcd-run-hooks script from writing into
/etc/chrony.conf file on s390x machines. The TC reproduces the
situation, which is accompanied by the following error message:
dhcpcd[...]: /usr/libexec/dhcpcd-run-hooks: line 132: /etc/chrony.conf: Permission denied
In order to support the intended dhcpcd-run-hooks function and
to avoid such errors in the journal, I believe that SELinux
policy should allow the access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-113937 and RHEL-113941.
Recently, a regular kernel + stress-ng testing revealed that SELinux
prevents the stress-ng program from writing (syscall = ftruncate)
and reading (syscall = mmap) the /secretmem anon inodes. The TC
reproduces the situation.
In order to enable various stress-ng functions, I believe that SELinux
policy should allow the actions mentioned above. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-116154 and RHELTEST-2022.
The automated test runs the following command which produces an error:
# targetctl clear
Traceback (most recent call last):
File "/usr/bin/targetctl", line 7, in <module>
sys.exit(main())
~~~~^^
File "/usr/lib/python3.14/site-packages/rtslib/targetctl.py", line 79, in main
funcs[sys.argv[1]](savefile)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^
TypeError: clear() takes 0 positional arguments but 1 was given
# echo $?
1
#
Even though SELinux is not the cause, the test fails because of the error.
To work around that problem, the expected exit code is between 0 and 255 now.
On rhel9 there is a another type with this name so it is colliding,
so my_test_file_t will be used in this test futher.
Signed-off-byt: jan janasek <jjanasek@redhat.com>
Unknown permissions are now handled as errors in CIL.
With selinux >= 3.0: a CIL module, which contains unknown permissions,
cannot be inserted via semodule -i. Error messages appear.
Signed-off-by: jan janasek <janjanasek@redhat.com>
Whenever a key is defined in the tmt hierarchy and some child also
defines that key, the child's will overwrite the previous one. The "+"
changes the operation to "append", so the content of key+ in the child
is added to the existing key.
Meaning that any "adjust" statement in a test plan using a test that
defines it's own "adjust:" is ignored.
Since we are expecting other statements to be appended to the "adjust"
sections, the content of each section needs to be a single list item as
opposed to a set of key-value pairs (first line needs to start with a
hyphen).
- Replace all "adjust:" sections with "adjust+:" in order to honor any
adjustments further up the tree (parent tests, or test plans).
- Fix malformed "adjust" sections (sets of key-value pairs)
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
The preload scripts cause all tests to take significantly longer than
usual, often triggering timeouts with current time limits.
Increase the time limit to 1500%.
https://issues.redhat.com/browse/VROOM-29315
Usage:
tmt -c rhivos_preload=true run
or
context:
rhivos_preload: true
A syntax error appears when the following test is executed:
* policycoreutils/semodule-rebuild-if-modules-changed
The problem is a missing "then" word in the test code.
Tests which are not suitable (various reasons) for image mode
testing will get the avoidImageMode tag. If their conditions improve,
the tag can be removed.
The newly added image-mode plan runs all relevant tests except for
those which:
* are broken
* require multiple hosts
* do reboots
* are not suitable for image mode environments
The image-mode test plan does not recognize tiers. That may change
in the future.
Some tests intentionally trigger SELinux denials during their run
and there is no need to fail because of them. The default value
of avc check is not suitable for these tests.
Currently, the SELinux denial shown in RHEL-77071 is not reproducible
on RHEL-9 or CentOS stream 9. It makes no sense to check the SELinux
policy rule existence there. The test code relevancy was updated.
Recent systemd-machined + selinux-policy testing revealed that
SELinux prevents the systemd-machined processes from creating
and removing the following directories and files:
* /run/systemd/nspawn/
* /run/systemd/nspawn/locks/
* /run/systemd/nspawn/locks/inode-*
In order to support various systemd-machined and machinectl functions,
I believe that SELinux policy should allow above-mentioned actions.
The TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-105966 and RHEL-108849.
Adds documentation to the README file to explain the test tiering system and its role in our gating process.
This clarifies the meaning of 'tier: 1/2/3' metadata and explains that older tags (e.g., tag:Tier1) have been deprecated.
Signed-off-by: Jan Janasek <jjanasek@redhat.com>
Removed redundant tags (e.g., Tier2/Tier3 and Tier2se/Tier3se) from all tests
with "tier: 2" and "tier: 3" metadata. The "tier" metadata is used instead.
Signed-off-by: Jan Janasek <jjanasek@redhat.com>
all tests with CI-Tier-1 tag should have "tier: 1" in their metadata,
also removing tags Tier1 and Tier1se and lastly tests with "tier: 2"
and "tier: 3" should not have CI-Tier-1 tag.
Signed-off-by: Jan Janasek <jjanasek@redhat.com>
Several automated tests were updated, because they were failing on
RHEL-10 machines. The list of reasons follows:
* incorrect test relevancy
* unimportant SELinux denials
* newly defined SELinux labels
* missing metadata
A combined fapolicyd + systemd-machined + selinux-policy testing
revealed that SELinux prevents the fapolicyd processes from connecting
to the systemd-machined process via its UNIX socket located at:
/run/systemd/userdb/io.systemd.Machine. The TC reproduces the situation.
In order to support this behavior dictated by the nsswitch configuration,
I believe that SELinux policy should allow this action. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-77071.
The valkey component is a replacement for the redis component. The
automated test covers basic functions of the valkey* services.
The TC covers RHEL-102631.
Do not check the type of /proc/pressure with matchpathcon because
the type is assigned using genfscon which is not recognised by
userspace tools.
Ensure that the /etc/systemd/system/-.slice.d and
/etc/systemd/system/user@.service.d directories exist before
creating files in them.
Recent selinux-policy testing revealed that policies for various systemd
generators are not complete. For example:
* SELinux prevented the vsftpd-generator program from executing commands
like mkdir, ls, ln, gawk etc.
* SELinux prevented systemd-cryptsetup-generator from creating files like
/run/systemd/generator/systemd-cryptsetup@luks*.service
In order to support the functionality of various systemd generators,
I believe that SELinux policy allow the actions mentioned above. The TC
looks for appropriate policy rules and file context patterns.
The TC covers RHEL-98656, RHEL-100415 and RHEL-100721.
Several recent bug reports revealed that SELinux prevents the tuned-ppd
processes from using the inotify_add_watch syscall on the following
directories:
* /sys/devices/system/cpu/intel_pstate (permission: watch)
* /sys/firmware/acpi (permission: watch_reads)
In order to support the expected tuned-ppd behavior, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-101686, RHEL-101687, BZ#2358952 and their duplicates.
A recently reported bug revealed that SELinux prevents the
power-profiles-daemon processes from writing to the following file:
* /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference
The TC does not reproduce the situation usually.
In order to support the intentional behavior of the daemon when
power cable gets unplugged/plugged, I believe that SELinux policy
should allow the action. The TC looks for appropriate policy rules
and file context patterns.
The TC covers RHEL-100718.
To avoid running code from untrusted repositories, make the generation
of flamegraphs optional (via a test parameter) and disabled by default.
The test parameter should only be set to 1 as needed when running the
test manually and kept disabled in automated test runs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
A recent libvirt testing of mediated devices revealed that SELinux
prevents the mdevctl process (executed by the virtnodedevd service)
from creating directories under /etc/mdevctl.d/. The TC reproduces
the situation.
In order to enable the expected mdevctl behavior, I believe that
SELinux policy should allow this action. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-98559.
test if virtqemud can reset PCI devices
Recently, an experimental libvirt + selinux-policy testing that
SELinux prevents the rpc-virtqemud process from writing (syscall =
openat) into /sys/bus/pci/devices/0000:00:00.0/config file. The TC
reproduces the situation.
In order to support the nodedev-reset function and to avoid unnecessary
SELinux denials, I believe that SELinux policy should allow this
action. The TC looks for appropriate policy rules and file context
patterns.
The TC covers RHEL-101417.
The following tests are not relevant for RHEL-10 because the required
packages are not available for RHEL-10:
* /selinux-policy/caddy-and-similar
* /selinux-policy/cups-pdf-and-similar
* /selinux-policy/ntpsec-and-similar
Recently, exploratory systemd-importd + selinux-policy testing revealed
that SELinux prevents the systemd-importd service from creating and
deleting the /run/systemd/io.systemd.Import socket. The TC reproduces
the situation.
In order to support the systemd-importd service start with the default
configuration, I believe that SELinux policy should allow the actions
listed above. The TC looks for appropriate policy rules and file
context patterns.
The TC covers RHEL-98490.
The only important commit is 72e60b601832 ("policy/test_secretmem.te:
add anon_inode perms required in Linux v6.16-rc5"), which fixes the
testsuite to work on 6.16-rc5+ kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Check if all tests tagged with rhel9_broken or rhel10_broken are
really broken. If not, remove the tag. If there are other broken
tests not yet tagged, assign them the relevant broken tag.
bootc-e2e tests requires specific environment related to image mode. The
image is prepared using buildah and later booted. This is not supported
in this test suite (yet)
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
The rlSELibraryLoaded() now makes sure that the /etc directory and
its subdirectories are labeled correctly. If they are mislabeled,
a lot executed tests can trigger unnecessary SELinux denials.
Mainly to pull "tests/inet_socket: properly detect IPSEC support", which
makes the testsuite run successfully on automotive RHEL again.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Even though the RHEL-2616 bug was investigated on RHEL-9.x, it's
not fixed and it got auto-closed. Until a solution is found or the
bug is escalated, the automated test will skip the particular test
phase.
The upstream selinux-policy/deny-rules test suite failed during its run
on rhel-9. Cause of failure is an AVC denial triggered by modprobe
command while executing module_load. Fix the test code to address the
AVC & test failure.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
