Add beakerlib/TMT coverage and fixtures for M4 preprocessing of modular
policy builds: .if to all_interfaces.conf, .te + interfaces to .tmp
(then checkmodule), and .fc to .mod.fc, using live support macros from a
selinux-policy checkout and a snapshotted modular M4 recipe.
Each case is its own rlRun phase in runtest.sh. Covers interface path
validation (including duplicates and broken gen_require), .te arity
edge cases, post-M4 checkmodule failures from bad interface expansion,
.fc path edge cases, M4-to-semodule_package E2E, and .fc content where
labeling validation is deferred to sefcontext_compile.
When SELINUX_POLICY_SRC is unset, clones fedora-selinux/selinux-policy
using a host-detected branch (f$VERSION_ID on Fedora, c${major}s
otherwise), overridable with SELINUX_POLICY_BRANCH.
Signed-off-by: Akhil Kohli <akkohli@redhat.com>
Add a shell harness and fixtures that exercise the M4 preprocessing
stages mirrored from Rules.modular: .if to all_interfaces.conf,
.te + interfaces to .tmp (then checkmodule), and .fc to .mod.fc.
Covers interface path validation (including duplicate names and broken
gen_require at interface build), .te arity edge cases, post-M4
checkmodule failures from bad interface expansion, .fc path edge cases,
Makefile missing-.te on the modular build path, M4-to-semodule_package
E2E, and .fc content where labeling validation is deferred to
sefcontext_compile.
33 test cases (42 harness pass steps) with minimal standalone fixtures.
Run via beakerlib/TMT (runtest.sh). When SELINUX_POLICY_SRC is unset,
clones fedora-selinux/selinux-policy using a host-detected branch
(f$VERSION_ID on Fedora, c${major}s otherwise), overridable with
SELINUX_POLICY_BRANCH.
Signed-off-by: Akhil Kohli <akkohli@redhat.com>
Add beakerlib/TMT test with fixtures for .if, .te+M4, and .fc bad-data
cases before checkmodule. Clones selinux-policy source for M4 macros.
Signed-off-by: Akhil Kohli <akkohli@redhat.com>
The --call-graph dwarf argument requires hardware fetures that may not
be implemented on some platforms (e.g. aarch64 AWS Graviton3 CPUs). Use
just plain -g instead, which will hopefully work anywhere. The stack
trace doesn't really matter that much anyway, as we are just testing
that the tracepoint is available and working.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The selinux-policy commit adding support for bind packages with suffixes
also changes default context for /var/named and adds a few more
explicit entries.
This test update makes an adjustment to the current state.
The bind package now provides executables with suffixes, e.g.
"/usr/bin/named-9.18". That includes the main daemon named, rndc and
other tools. Links to the actual executables are provided using the
alternatives tool.
Subsequently, the named test is now being updated using the readlink command
to get canonical file names.
Recently filed bug reports revealed that SELinux prevents the qat_init.sh
process from the following actions:
* accessing (syscall = newfstatat) the /dev/hugepages directory
* creating (syscall = mkdir) the /dev/hugepages/qat directory
* setting permissions/ownership (syscall = fchownat)
The TC reproduces the situation.
In order to support the qat service functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-211077 and RHEL-211089.
If a process crashes in an nspawn container started either via machinectl start or systemd-nspawn -bD ...
it triggers an AVC denial, even if the container is under /var/lib/machines/.
Tests RHEL-139983
Allow the sys_resource capability to each domain which is allowed to
execute generic programs in system bin directories without domain
transition when the coreutils_bin_sys_resource tunable is on. If the
tunable is off, which is the default state, the capability is
dontaudited instead.
This test was nout counting with dontaudit rule beforehand. No avc will be present if the tunable
is off.
A recently filed bug report revealed that SELinux prevents the
bootupd service and its children processes from talking to SSSD.
The TC reproduces the situation on machines created by bootc.
In order to support this scenario, I believe that SELinux policy
should allow the necessary access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-174888.
Verify that checkpolicy and checkmodule abort cleanly when memory is
exhausted during compilation, rather than producing a potentially
incorrect output binary.
The test constrains the virtual address space of the compiler subprocess
to 8 MB via ulimit -v, which is sufficient for process startup but not
for parsing a full targeted policy binary. Both compilers are exercised
using binary input (checkpolicy -b, checkmodule -b) against the active
policy store. Assertions: non-zero exit status and no output file
produced under OOM.
Tested on RHEL 9, RHEL 10, and RHIVOS 2.0 on x86_64 and aarch64.
VROOM-40721
The original CVE fix has a bug in that it incorrectly checks execmem
permission for the mounter domain. Test for the regression in the test
so that we can verify its fix.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The following exception is raised when the cups* tests are executed
via 'wow --distro ... --case ...':
ERROR Failed to add <Task /CoreOS/selinux-policy/Regression/cups-lpd-and-similar [TC#305784]> due issue with TMT Metadata: Error in processing libraries from {'url': 'https://src.fedoraproject.org/tests/selinux.git', 'ref': 'main', 'name': '/selinux-policy/cups-lpd-and-similar'}. Raised exception was:
ERROR Unable to add one of testcases due to wrong metadata - See `--ignore-invalid` option
The checkpolicy source RPM contains not only checkpolicy sources but
also checkpolicy tests. Purpose of this automated test is to run them
with the current versions of libsepol and checkpolicy components.
The original library(foo/bar) syntax was used via RPM Provides
on old RHTS / Beaker infra, and tmt translates it to fetching
libraries from https://github.com/beakerlib/, ie.
https://github.com/beakerlib/selinux-policy
This location then contains a wrapper redirect back to this
repo with tests.
Let's avoid the external Github round-trip and just link to the
library directly via local references.
Also change the epel library link to the modern syntax.
Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
The README on
https://github.com/beakerlib/distribution/tree/master/epel
states that
This is a compatibility layer to overcome a transitional
phase from distribution/epel to epel/epel.
So use epel/epel instead.
Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
This fixes nearly all tmt lint errors, since plans cannot have
'test:' and other test-related keywords.
Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
The fmf metadata keyword is 'tag', so 'tags' did nothing.
To avoid changing the behavior (adding a 'generic' tag to all tests),
I simply removed the keyword.
Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
One of the reported selinux-policy bugs revealed that SELinux
prevents the power-profiles-daemon from watching the /sys/firmware/acpi
directory. The TC only reproduces the situation when the right HW
is available.
In order to support this functionality, I believe that SELinux
policy should allow this access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-105423.
Since systemd v260 [1], support for System V service scripts has been
removed. As a part of this change, systemd-rc-local-generator and
systemd-sysv-generator were also removed.
This commit makes the relevant test parts run only if the generators
executables exist.
[1] https://github.com/systemd/systemd/releases/tag/v260-rc1
After introducing the systemd_nfs_generator_t domain, a bug report was
filed which revealed that SELinux prevents the nfs-server-generator
from creating and controling its UDP sockets. The TC reproduces the
situation.
In order to support all functions of the nfs-server-generator program,
I believe that SELinux policy should allow these actions. The TC looks
for appropriate policy rules and file context patterns.
The TC covers RHEL-111556.
For a successful run of the /selinux-policy/systemd-oomd test we
need the Pressure Stall Information (PSI) to be available.
From now on, the test add the psi=1 parameter to the kernel
command line and reboots the machine. The test should pass after
a reboot.
The /selinux-policy/kernel-confined-exec test intentionally triggers
SELinux denials. TMT framework sees them as a problem unless told
otherwise. From now on, the TMT will expect them.
A recently reported customer case revealed that the restorecond
service occasionally fails to start because of a timeout. The
exact reproducer is unknown, but the TC reproduces a similar
situation (mislabeled /run/restorecond.pid file) which also leads
to timeouts.
In order to fix the problem, the restorecond service is no longer
a forking type of service. It is a single type of service. The TC
checks this parameter too.
The TC covers RHEL-142541 and RHEL-165247.
Recently filed report revealed that certain files are not owned by the selinux-policy package.
This situation is generally described in the following document and should be fixed:
https://docs.fedoraproject.org/en-US/packaging-guidelines/UnownedDirectories/
Purpose of this test is to find out if the issue is fixed or not.
TC coveres: RHEL-141659 + RHEL-157952 + FC-1681
Recent logwatch + selinux-policy testing revealed that SELinux
prevents one of the logwatch scripts from checking files labeled
nsfs_t located under /run/netns directory. The TC reproduces the
situation.
In order to support the 'df' command functionality (executed by
one of the scripts, syscall = newfstatat), I believe that SELinux
policy should allow this access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-160896 and RHEL-160897.
Recent valkey + selinux-policy testing revealed that SELinux prevents
the valkey-server processes from creating and manipulating of RDMA
sockets when the valkey-rdma package is installed. The TC reproduces
the situation.
In order to enable the functions brought by the valkey-rdma package,
I believe that SELinux policy should allow the access. The TC looks
for appropriate policy rules and file context patterns.
The TC covers RHEL-154814 and RHEL-161115.
TC covers RHEL-141858
The issue appears to be caused by the coreutils-single package, which introduces additional
prctl() system calls, that request sys_resource capability, leading to AVC denials.
A CentOS stream 10 user reported that SELinux denials are triggered
when their device with a running iio-sensor-proxy service is rotated.
Further analysis revealed that iio-sensor-proxy cannot perform the
following activities:
* read various character devices - /dev/iio:device*
* create a UDP socket
* write into in_accel_x_en, in_accel_y_en, in_accel_z_en files
stored under /sys
* add a new directory for a HID sensor device connected via PCI
The TC does not reproduce the situation.
In order to support the cooperation of iio-sensor-proxy and various
devices, I believe that SELinux policy should allow these actions.
The TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-110090.
TC covers RHEL-142548 and RHEL-147470
If the setroubleshoot-server package is installed then the SELinux denial appears each time
the setroubleshootd process analyzes any SELinux denial, because the setroubleshootd process
executes the rpm command to find out which package owns some file.
Recent selinux-policy + dhcpcd + systemd-resolved testing revealed
SELinux denials caused by dhcpc hooks running the resolvectl program.
The TC reproduces the situation.
In order to support the dhcpcd service and its hooks fully, I believe
that SELinux policy allow the necessary actions. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-147153 and RHEL-147155.
On Fedora rawhide, the kdump service is no longer brought by
the kexec-tools package. The kdump-utils package is necessary
for a successful run of this test on Fedora rawhide.
Many tests contain test phases called "real scenario". Purpose of
these phases is usually to test a service which belongs to a particular
package. If the service (systemd unit file) is not available for any
reason, it makes no sense to run the test phase - it would fail.
Other test phases may still be worth running.
The original reproducer would break network traffic outside IPv6
localhost- make sure there are default rules for unlabeled traffic so
that the machine doesn't lose network connectivity during test.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
