Notable changes:
- fixed DH prime format in 'keys' test
- native quota support now used for ext4 when available
- needs special exception on RHEL-7 where it is broken
- fixed stderr noise from 'yes' command
- fixed SIGIO tests to work under CONFIG_LEGACY_TIOCSTI=n
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Effective changes:
- fix the policy to allow the new user_namespace::create permission
where needed
- fix the code to build without warnings with latest SELinux userspace
The rest is various cleanups or changes not affecting Fedora/RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Otheriwse older kernel entries would still have our injected scripts in
the initramfs after test execution.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Forward-port of downstream kernel tests that haven't been upstreamed
yet, manually converted to TMT.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
ramfs is now treated as an xattr-supporting filesystem and has the
fs_use_trans directive in the base policy. Thus switch to vfat, which is
still genfs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Replace the current soft fallback to raw GIT_BRANCH when a required PR
or Patchwork patch fails to merge/apply with a hoard failure, similar to
what we do when cloning the repo fails.
The main motivation is to not have CKI treat this situation as a
failure, but it also a good practice to ensure we either run the
intended version of the test or no test at all.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The only effective difference is that the broken SCTP ASCONF tests will
now be skipped, see:
3e93ece73d
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add AVC_ERROR=+no_avc_check into test environment to disable Beaker's
AVC check, as this test produces s lot of expected AVC denials.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The test doesn't detect the presence of the performance issue reliably
across machines and architectures, so disable it for now.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The ioctl number is not consistent across arches. The fix adds the
numbers for other arches to make the test work on all arches again.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Running in paths containing ':' or in /tmp doesn't work, so make sure
that the testsuite is run in /root.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...and remove some workarounds that are no longer needed. Also add code
to enable/disable SCTP client peeloff tests based on where SCTP client
peeloff is currently fixed in RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It seems none of the attempts to synchronize before connecting are good
enough - add some extra sleep time to the beginning of open_assoc().
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
In case of a bug/error, the server may end up hanging, so make sure it
terminates in some reasonable time.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This test reproduces a bug that may cause an AVC with sctp_socket,
association, unlabeled_t, unlabeled_t (and also another bug related to
SCTP peeloff on the client side).
SCTP code taken and modified from selinux-testsuite's sctp subtest.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add a variant of the selinux-testsuite test that adds a patch adding
coverage for SCTP client peeloff so that we can conveniently verify
related bugs until the fix and testsuite coverage are merged upstream.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Only at most 2-CPU s390x machines are available in Beaker and the bug is
not reproducible on them, so just disable the test on s390x.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recently GitHub has deprecated the git:// protocol and cloning now fails
with this message:
```
fatal: remote error:
The unauthenticated git protocol on port 9418 is no longer supported.
Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information.
```
The only reason that git:// was being used instead of https:// was
allowing the test to run on RHEL-5, which has problems with accessing
GitHub via HTTPS due to protocol disparity. By now it should be okay to
throw RHEL-5 under the bus and use the https:// URL.
Since we are definitely making this test unable to run on RHEL-5, also
remove all RHEL-5-specific hacks from the code.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Pull in a fix that allows the testsuite to succeed on kernels with
CONFIG_IP_TABLES=n (e.g. Fedora ELN kernels; future RHEL 10+ kernels).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This pulls in the lockdown test removal, which will be needed for
successful testing of new kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
When this test in run via restraint (e.g. on Beaker), it inherits some
file descriptors originating from it, labeled unconfined_service_t. This
leads to a huge amount of denials when test programs are exectuted.
To work around this, add a rule to the policy that allows the test
domains to inherit these descriptors from unconfined_service_t.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Kernels before 4.18.0-314.el8 lack the bugfix that is required for this
test to pass, so exclude it on these kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On RHEL-7.2, also the vsock_socket class is missing from the policy -
update the patch to v2, which also checks for the presence of the class.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
I missed that the new vsock_socket subtest fails to build on RHEL-7.
Apply a patch that excludes it when the necessary header/definition is
not available.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI is running the testsuite also on clang-built kernels, which need the
modules to be built using clang, too. Apply pending patches from
upstream to make the testsuite work on these kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The capable_sys test is failing on F35 without his patch, because BTRFS
doesn't support the FIBMAP ioctl.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...to allow switching the TCMS entry to refer directly here via a FMF
link. Note: I'm not adding the tags, as most of those is
RHEL/RH-specific and they can be maintained just in TCMS.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It actually doesn't work (and doesn't get excluded automatically) on
RHEL-7 either, so change the condition to rhel < 9.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The bugfix has been backported in RHEL-8.4, so we can now replace this
with a kernel version check, increasing the coverage on RHEL-8.4 and
above.
Verified that the testsuite still passes on RHEL-8.3, 8.4, and RHEL-9.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The relevant config option is now enabled on RHEL-9, so we can skip it
on RHEL-8 only to get coverage on RHEL-9 and above.
Tested on latest RHEL-9 VM image.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Set AVC_ERROR=+no_avc_check in environment to disable restraint's
built-in AVC check so that it doesn't interpret the (expected) AVCs as
failure.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It doesn't have a bugzilla, but better to have a regression test for it.
It's a very low-effort test, but still better than nothing :)
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...to pull in two fixes for the userfaultfd test so it builds
sucessfully on RHEL-7 and remove the associated workaround from the
wrapper.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This feature is required for proper support of virtiofs with SELinux.
Add a trivial test that verifies that this feature works via a dummy
SELinux module and ramfs mount.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On RHEL-7 (and other old kernels), __NR_userfaultfd may not be defined
on some arches, so add a kernel version check for now to exclude
userfaultfd test when it would be skipped anyway.
I'll fix this more nicely in upstream, this is just a temporary solution
until that gets merged.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Highlights:
- fixed lockdown and perf_event tests to work with latest Fedora policy
- userfaultfd test added
- removed dependency on `which`
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
