Effective changes:
- fix the policy to allow the new user_namespace::create permission
where needed
- fix the code to build without warnings with latest SELinux userspace
The rest is various cleanups or changes not affecting Fedora/RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Otheriwse older kernel entries would still have our injected scripts in
the initramfs after test execution.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Forward-port of downstream kernel tests that haven't been upstreamed
yet, manually converted to TMT.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
ramfs is now treated as an xattr-supporting filesystem and has the
fs_use_trans directive in the base policy. Thus switch to vfat, which is
still genfs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Replace the current soft fallback to raw GIT_BRANCH when a required PR
or Patchwork patch fails to merge/apply with a hoard failure, similar to
what we do when cloning the repo fails.
The main motivation is to not have CKI treat this situation as a
failure, but it also a good practice to ensure we either run the
intended version of the test or no test at all.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The only effective difference is that the broken SCTP ASCONF tests will
now be skipped, see:
3e93ece73d
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add AVC_ERROR=+no_avc_check into test environment to disable Beaker's
AVC check, as this test produces s lot of expected AVC denials.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The test doesn't detect the presence of the performance issue reliably
across machines and architectures, so disable it for now.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The ioctl number is not consistent across arches. The fix adds the
numbers for other arches to make the test work on all arches again.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Running in paths containing ':' or in /tmp doesn't work, so make sure
that the testsuite is run in /root.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...and remove some workarounds that are no longer needed. Also add code
to enable/disable SCTP client peeloff tests based on where SCTP client
peeloff is currently fixed in RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It seems none of the attempts to synchronize before connecting are good
enough - add some extra sleep time to the beginning of open_assoc().
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
In case of a bug/error, the server may end up hanging, so make sure it
terminates in some reasonable time.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This test reproduces a bug that may cause an AVC with sctp_socket,
association, unlabeled_t, unlabeled_t (and also another bug related to
SCTP peeloff on the client side).
SCTP code taken and modified from selinux-testsuite's sctp subtest.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add a variant of the selinux-testsuite test that adds a patch adding
coverage for SCTP client peeloff so that we can conveniently verify
related bugs until the fix and testsuite coverage are merged upstream.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Only at most 2-CPU s390x machines are available in Beaker and the bug is
not reproducible on them, so just disable the test on s390x.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recently GitHub has deprecated the git:// protocol and cloning now fails
with this message:
```
fatal: remote error:
The unauthenticated git protocol on port 9418 is no longer supported.
Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information.
```
The only reason that git:// was being used instead of https:// was
allowing the test to run on RHEL-5, which has problems with accessing
GitHub via HTTPS due to protocol disparity. By now it should be okay to
throw RHEL-5 under the bus and use the https:// URL.
Since we are definitely making this test unable to run on RHEL-5, also
remove all RHEL-5-specific hacks from the code.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Pull in a fix that allows the testsuite to succeed on kernels with
CONFIG_IP_TABLES=n (e.g. Fedora ELN kernels; future RHEL 10+ kernels).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This pulls in the lockdown test removal, which will be needed for
successful testing of new kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
When this test in run via restraint (e.g. on Beaker), it inherits some
file descriptors originating from it, labeled unconfined_service_t. This
leads to a huge amount of denials when test programs are exectuted.
To work around this, add a rule to the policy that allows the test
domains to inherit these descriptors from unconfined_service_t.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Kernels before 4.18.0-314.el8 lack the bugfix that is required for this
test to pass, so exclude it on these kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On RHEL-7.2, also the vsock_socket class is missing from the policy -
update the patch to v2, which also checks for the presence of the class.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
I missed that the new vsock_socket subtest fails to build on RHEL-7.
Apply a patch that excludes it when the necessary header/definition is
not available.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI is running the testsuite also on clang-built kernels, which need the
modules to be built using clang, too. Apply pending patches from
upstream to make the testsuite work on these kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The capable_sys test is failing on F35 without his patch, because BTRFS
doesn't support the FIBMAP ioctl.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...to allow switching the TCMS entry to refer directly here via a FMF
link. Note: I'm not adding the tags, as most of those is
RHEL/RH-specific and they can be maintained just in TCMS.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It actually doesn't work (and doesn't get excluded automatically) on
RHEL-7 either, so change the condition to rhel < 9.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The bugfix has been backported in RHEL-8.4, so we can now replace this
with a kernel version check, increasing the coverage on RHEL-8.4 and
above.
Verified that the testsuite still passes on RHEL-8.3, 8.4, and RHEL-9.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The relevant config option is now enabled on RHEL-9, so we can skip it
on RHEL-8 only to get coverage on RHEL-9 and above.
Tested on latest RHEL-9 VM image.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Set AVC_ERROR=+no_avc_check in environment to disable restraint's
built-in AVC check so that it doesn't interpret the (expected) AVCs as
failure.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It doesn't have a bugzilla, but better to have a regression test for it.
It's a very low-effort test, but still better than nothing :)
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...to pull in two fixes for the userfaultfd test so it builds
sucessfully on RHEL-7 and remove the associated workaround from the
wrapper.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This feature is required for proper support of virtiofs with SELinux.
Add a trivial test that verifies that this feature works via a dummy
SELinux module and ramfs mount.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On RHEL-7 (and other old kernels), __NR_userfaultfd may not be defined
on some arches, so add a kernel version check for now to exclude
userfaultfd test when it would be skipped anyway.
I'll fix this more nicely in upstream, this is just a temporary solution
until that gets merged.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Highlights:
- fixed lockdown and perf_event tests to work with latest Fedora policy
- userfaultfd test added
- removed dependency on `which`
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
There are no s390x machines with enough cores to run this test in RH's
Beaker and likely won't be available in any CI system in the near
future. Thus, exclude the test from this arch so that testing doesn't
fail due to lack of matching hardware.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
