libselinux and selnux-policy are already required by their -devel
counterparts (and other packages), libsemanage is also not required
directly, and platform-python was only needed on earlier RHEL-8.0 dev
composes where python3 wasn't installable directly (and I suspect that
it wouldn't help there, anyway...).
Note that this also works around:
https://bugzilla.redhat.com/show_bug.cgi?id=1876847
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add another global IPv4 address by creating a dummy GRE interface in
order to activate two extra SCTP tests that require two unique global
IPv4 addresses.
Before (F32):
Files=61, Tests=832, 176 wallclock secs ( 0.59 usr 0.13 sys + 4.92 cusr 6.54 csys = 12.18 CPU)
After (F32):
Files=61, Tests=834, 182 wallclock secs ( 0.66 usr 0.11 sys + 6.28 cusr 7.68 csys = 14.73 CPU)
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recently there were some changes in CKI upstream kernel building and the
old bugginess detection doesn't work any more. Fix it to use adifferent
build program, which is still missing.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
An issue was found in CephFS that caused symlinks to be left unlabeled
upon creation. Extend the test to cover also symlinks, special file
types, and directories.
Upstream fix: https://marc.info/?l=ceph-devel&m=159596407215153&w=2
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Highlights:
- Use native filesystem for FS tests
- Avoid mmap test failures when /dev is mounted noexec
- Add nftables to inet_socket and sctp tests
- Fix overlayfs test false positive on new kernels (previously applied
as a patch)
- Add check for key changes on watch_queue
Several RHEL workarounds were needed, see the diff for details.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
When the boolean name passed to boolSet is an alias, then the current
implementation would always skip setting the boolean. That in turn
causes allow_domain_fd_use to remain unset when it is an alias and the
testsuite fails (because it then doesn't reset the value due to `make`
logic). That can cause AVCs in later tests and so needs to be fixed.
The fix is to just try `getsebool <name>` instead of grepping `getsebool
-a` for the boolean name.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI interprets the "Abort" result as an infra failure and waives the
test in such case. So if "git clone" fails, it's better to abort the
whole test so that a false positive test failure is not reported.
Turns out that Beaker interprets the exit code 127 (possibly other ones,
but this one I'm sure about) as Abort, so we can just do that instead of
relying on the legacy rhts-abort command.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
There is a new permission required to create whiteout nodes, causing the
test to fail on fresh mainline kernels. Apply the patch from Stephen
Smalley to fix that until we pick it up in a rebase.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The CKI kernels are cross-compiled on x86_64, so they generate an
invalid (little-endian) in-kernel BTF on big-endian systems. Work around
this by skipping the BPF test if little-endian BTF is detected on s390x.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Nothing from there seems to be actually used by the testsuite and it's
not even shipped on recent RHELs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The test verifies expected behavior of CephFS security label support
across distros.
Note that for the test to work RHEL, an appropriate Ceph repo must be
installed. A scriptlet that sets this up can be provided via the
INSTALL_SCRIPTLET parameter.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Bump upstream commit to include the new glblub test and drop the patch
that is also included in upstream now.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It turns out that in CKI's kickstart the CRB repo is enabled by default,
but this is not true for the usual beaker install. Thus, try to install
libbpf-devel from the usual CRB repo names. Yes, it's an ugly
workaround, but there's currently no better way.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Replacing kernel version occurences is problematic when different tests
have the same bounding kernel version, as is true for current upstream.
Therefore, replace it with adding "force_tests" list that works
similarly to the existing "exclude_tests" list, but forces execution of
the tests instead of excluding them.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On Beaker the repo has a different name and CRB is enabled there anyway.
This workaround is only useful with the internal 1minutetip tool, so
it's not worth keeping it here.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On RHEL and non-x86_64 Fedora kernels, the kernel.unprivileged_bpf_disabled
sysctl is enabled by default (and at least on RHEL/ARK it cannot be
changed). Instead of trying to disable the BPF subtest completely on
these kernels (which is incomplete since CKI tests ARK kernels on
Fedora), add the sys_admin capability to the BPF test domains to make
the test work on these kernels as well.
We also need to install libbpf-devel separately from CRB on RHEL, since
it's not shipped in BaseOS.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The "conmakehash" program is not shipped on recent Fedora kernels (and
who knows where else). Switch to "unifdef", which seems to be everywhere
(and always an ELF executable).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The only significant change that this pulls in is 7fd02b152f9f
("tests/prlimit: avoid invalid limit combinations"), which fixes false
test failures in some environments.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This helps when debugging unexpected AVCs. This was formerly done by the
selinux-policy/common library, which the test doesn't use any more, so
let's add this useful feature back with just four simple commands.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI RHEL-8 builds are cross-compiled badly, so disable module_load also
when the kernel-devel built helper programs are unusable.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The RPM is not important, what is important is the running kernel (and
that can't be missing, obviously) and its version is already shown
elsewhere.
Moe importantly, in Fedora CI the 'kernel' RPM may not even be there, so
the test would warn about it, causing failures.
Reported-by: Lukas Vrabec <lvrabec@redhat.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...because tier 1 tests are ran for all SELinux components, which is
alittle too often for this not-so-lightweight test.
Suggested-by: Petr Lautrbach <plautrba@redhat.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI mainline kernel packages don't currently provide the files necessary
to build kernel modules. Work around it by disabling the module_load
subtest when the files are missing.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
There are several places in the testuite that set timeouts for network
operations. They use different values in different places and
particularly for the SCTP test the value is too small on some machines
and often leads to false-positive test failures.
Since the right value depends on the environment, rather than proposing
to change the value to some guessed number upstream, let's just tweak
the number from the wrapper and suggest updating the numbers upstream
once we find a "proven" good value.
I'm setting the default to 4 secs - 1 second higher than the old value
in the inet_socket test, where we also (very) sporadically get failures.
The most problematic SCTP subtest had 2 seconds timeout before.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It is usually already installed so this hasn't been spotted before,
however on Fedora CI the missing requirement causes a failure.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
