The README on
https://github.com/beakerlib/distribution/tree/master/epel
states that
This is a compatibility layer to overcome a transitional
phase from distribution/epel to epel/epel.
So use epel/epel instead.
Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
The original reproducer would break network traffic outside IPv6
localhost- make sure there are default rules for unlabeled traffic so
that the machine doesn't lose network connectivity during test.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Whenever a key is defined in the tmt hierarchy and some child also
defines that key, the child's will overwrite the previous one. The "+"
changes the operation to "append", so the content of key+ in the child
is added to the existing key.
Meaning that any "adjust" statement in a test plan using a test that
defines it's own "adjust:" is ignored.
Since we are expecting other statements to be appended to the "adjust"
sections, the content of each section needs to be a single list item as
opposed to a set of key-value pairs (first line needs to start with a
hyphen).
- Replace all "adjust:" sections with "adjust+:" in order to honor any
adjustments further up the tree (parent tests, or test plans).
- Fix malformed "adjust" sections (sets of key-value pairs)
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
Tests which are not suitable (various reasons) for image mode
testing will get the avoidImageMode tag. If their conditions improve,
the tag can be removed.
Some tests intentionally trigger SELinux denials during their run
and there is no need to fail because of them. The default value
of avc check is not suitable for these tests.
To avoid running code from untrusted repositories, make the generation
of flamegraphs optional (via a test parameter) and disabled by default.
The test parameter should only be set to 1 as needed when running the
test manually and kept disabled in automated test runs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The only important commit is 72e60b601832 ("policy/test_secretmem.te:
add anon_inode perms required in Linux v6.16-rc5"), which fixes the
testsuite to work on 6.16-rc5+ kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Mainly to pull "tests/inet_socket: properly detect IPSEC support", which
makes the testsuite run successfully on automotive RHEL again.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
We need to ensure that at least one cap2_userns permission has test
coverage to check a formal box somewhere. Apply an upstream patch series
that adds this coverage.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Apply the failinfedora tag to the tests which fail on Fedora rawhide.
Add a special test plan for regular runs of these failing tests.
Make sure that the no-tier test plan contains tests which succeed on
Fedora rawhide.
When kernel-uk-virt is installed, the rpm query returns more than one
result, leading to (non-fatal) errors in the Setup phase. Query for the
kernel image path instead to avoid this.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Fedora ELN / RHEL-10 has disabled CONFIG_NET_KEY, so apply a patch that
allows the testsuite to succeed by skipping the key_socket test when it
is not supported.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Do it the same way as in commit 3e8824e0aa ("kernel/selinux-testsuite:
fix kernel pkg name detection").
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The detection of this flag is broken with DNF5, because it now only
appears under `dnf install --help`. Also, DNF5 now implements the logic
we want (skipping packages that are not available, rather than "broken")
under a new --skip-unavailable flag.
Therefore, detect both using `dnf install --help` and also check for
--skip-unavailable first.
Without this fix the tests try to install each package one by one with
DNF5, which is suboptimal.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
When NetLabel is configured to send unlabeled traffic, it should fully
remove CIPSO options from the IP packets. This test verifies that they
are indeed removed (and not just replaced with IPOPT_NOP or IPOPT_END).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
I can't believe I got it wrong AGAIN... I missed the ! operator.... Now
it should be correct, as was finally able to test it.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The version comparison is wrong. Fix it.
Fixes: 485e8279b7 ("kernel/selinux-testsuite: remove install_t references on RHEL6")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The directory may also be owned by <name>-modules-core rather than
<name>-core in some cases. Use the "config" file as the reference
instead.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The install_t workaround for rpm-ostree doesn't work on RHEL-6, so make
it conditional on /run/ostree-booted, so that it is only applied when
necessary.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
There is no /lib/modules/.../vmlinuz file on RHEL-7 kernels, so just use
the parent directory, which should be owned by the same package.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Instead of relying on the existing kernel package naming and versioning
conventions, which are subject to change in RHEL, determine the main
kernel package name via `rpm -qf "/lib/modules/$(uname -r)/vmlinuz"` and
derive the rest from that.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This mainly pulls in the new inet_socket/mptcp subtest that provides
coverage for the MPTCP protocol.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
- ensure the current booted kernel is set as default
(fixes the case where a newer kernel package has been installed since
boot)
- add Beaker compat workaround
- add descriptions to most rlRun asserts
- run zipl also after the cleanup `dracut -f` invocation
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Notable changes:
- fixed DH prime format in 'keys' test
- native quota support now used for ext4 when available
- needs special exception on RHEL-7 where it is broken
- fixed stderr noise from 'yes' command
- fixed SIGIO tests to work under CONFIG_LEGACY_TIOCSTI=n
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Effective changes:
- fix the policy to allow the new user_namespace::create permission
where needed
- fix the code to build without warnings with latest SELinux userspace
The rest is various cleanups or changes not affecting Fedora/RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Otheriwse older kernel entries would still have our injected scripts in
the initramfs after test execution.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Forward-port of downstream kernel tests that haven't been upstreamed
yet, manually converted to TMT.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
ramfs is now treated as an xattr-supporting filesystem and has the
fs_use_trans directive in the base policy. Thus switch to vfat, which is
still genfs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Replace the current soft fallback to raw GIT_BRANCH when a required PR
or Patchwork patch fails to merge/apply with a hoard failure, similar to
what we do when cloning the repo fails.
The main motivation is to not have CKI treat this situation as a
failure, but it also a good practice to ensure we either run the
intended version of the test or no test at all.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
