Recent testing revealed, that systemd-timesyncd service wants to
use the inotify_add_watch syscall on the root directory during boot.
Unfortunately, SELinux policy denies that access.
I believe that the access is harmless and should be allowed.
The TC looks for appropriate policy rule.
The TC covers BZ#1949315.
It doesn't have a bugzilla, but better to have a regression test for it.
It's a very low-effort test, but still better than nothing :)
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Some tests are not relevant for certain versions of RHEL.
Their execution leads to failures there. After this change,
they will exit quickly and print a short message explaining why.
Add a sanity test suite which verifies but 1838257. The fix evaluates
the rpm scripts for components libsepol, libsemanage and libselinux.
It looks for obsolete commands like telinit.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
According to several BZ reports, the systemd-modules-load program
wants to read /sys/firmware/efi/efivars/SecureBoot-* files.
Unfortunately, SELinux policy denies that access.
The TC reproduces the issue on machines where the EFI variable FS
is mounted (the /sys/firmware/efi/efivars/ directory exists).
I believe the access is needed for correct function of the
systemd-modules-load service. The TC looks for appropriate
policy rule.
The TC covers BZ#1819161 and its duplicates.
...to pull in two fixes for the userfaultfd test so it builds
sucessfully on RHEL-7 and remove the associated workaround from the
wrapper.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add an semanage case to file-contexts test suite which verifies bug
1822100. The fix checks for the broken pipe error generated by the
'semanage fcontext -l | egrep ..' command.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Many changes were done in downstream SELinux beakerlib library and
they were not propagated to upstream. Now, it's fixed.
The audit daemon is restarted everytime the SELinux beakerlib library
is loaded, which usually happens once at the beginning of each test.
This change is necessary because the audit daemon sometimes dies and
gathering of SELinux denials via ausearch relies on fact that audit
daemon is running and logging them. Without a running audit daemon
many tests can pass (false positive) because no SELinux denials were
found.
This feature is required for proper support of virtiofs with SELinux.
Add a trivial test that verifies that this feature works via a dummy
SELinux module and ramfs mount.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The fapolicyd test causes that dnf/yum hangs, which blocks the whole
gating process for 4 hours.
The test will be temporarily disabled so that new selinux-policy
builds could go through gating.
Hibernation which uses a swap partition instead of a swap file fails
because SELinux prevents systemd-sleep from getattr operation on the
swap partition. This is a common configuration, which means that
SELinux policy should allow it.
The TC does not reproduce the scenario, it only looks for appropriate
policy rules.
The TC covers BZ#1928539, BZ#1912385, BZ#1926536.
On RHEL-7 (and other old kernels), __NR_userfaultfd may not be defined
on some arches, so add a kernel version check for now to exclude
userfaultfd test when it would be skipped anyway.
I'll fix this more nicely in upstream, this is just a temporary solution
until that gets merged.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The rng-tools component is used in various versions of RHEL and Fedora,
so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repository.
Highlights:
- fixed lockdown and perf_event tests to work with latest Fedora policy
- userfaultfd test added
- removed dependency on `which`
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The boltd service is available in various Fedoras and RHELs,
so it makes sense to run the TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The journalctl command is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The fwupd service is available in various Fedoras and RHELs,
so it makes sense to run the TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The colord service is available in various Fedoras and RHELs,
so it makes sense to run the TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The numad component is used in various versions of RHEL and Fedora,
so it makes sense to run this TC in upstream testing too.
Moving the downstream TC to upstream repository.
There are some minor changes when comparing the upstream and downstream
versions of the TC.
There are no s390x machines with enough cores to run this test in RH's
Beaker and likely won't be available in any CI system in the near
future. Thus, exclude the test from this arch so that testing doesn't
fail due to lack of matching hardware.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The dmidecode component is also used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repository.
One of the testcase failed due to absence of chkconfig and initrc
related files. Make existing code compatible with higher versions of
Fedora and fix the failures.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
SELinux prevents the rtkit-daemon process from setting nice value.
I believe this access is harmless from security point-of-view and
should be allowed. The TC is not able to reproduce the issue, but it
looks for an appropriate SELinux policy rule.
The TC covers BZ#1750024, BZ#1910507 and other duplicates.
The test reproduces scenarios described in 2 different bugs. One of
them is BZ#1823672. If this scenario should succeed, a newly introduced
boolean called logging_syslogd_append_public_content needs to be enabled.
The scenario also requires that the target log file exists before
the rsyslogd process tries to append to it.
Because the test uses a custom policy module, there will always
be at least 2 USER_AVC messages reported (received policyload notice
caused by insertion and removal of the policy module). The ausearch
calls should only care about AVC messages.
The test also uses the semanage command, which is not required in Makefile.
Both issues are now fixed.
Since the testsuite now loads more policy modules, the `semodule -r
test_policy` command is not enough for a full cleanup. Do `make -C
policy unload instead`.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Based on several runs in Beaker, these seem to be the best conditions
for distinguishing the bug. Currently, legacy Beaker HW filters are used
in the metadata. Once TMT introduces support for generic HW
requirements, they will need to be converted to the new format.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On fast systems with a lot of cores the 10s synflood run produces too
large perf.data (> 1 GiB), so reduce it to 5s and also increase the
test's time limit to 1h to make sure that it has enough time to process
such a large file.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It turns out there is too much variability in the percent values across
arches/machines, so give up on the general approach (checking that all
SELinux functions are below some hard limit) and instead focus only on
selinux_peerlbl_enabled() and compare its position with other functions.
In case selinux_peerlbl_enabled() is not found in /proc/kallsyms, it is
inlined into other functions, so we need to check selinux_ip_postroute()
instead of selinux_peerlbl_enabled().
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The file can get really huge and it compresses well, so it's better to
compress it with xz before doing rlFileSubmit.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This is needed for running tests using TMT. Since all tests here use
beakerlib, let's just make it a global default.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The generated perf.data can be quite big and uploading it takes a long
time in some cases, so raise the time to 20 minutes.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Repeated run of the TC in the same location revealed 2 issues:
the test user (toor) and the base.cil (modified policy module) file
were not deleted, which lead to unnecessary failures.
Both issues should be fixed now.
- use spaces instead of tabs
- update copyright date
- cover more cases with correct behavior
usepasswd=False
- Standard users should not trigger a policy change
- SELinux users with home in / shoud not trigger a policy change
- Other SELinux users should trigger a policy change
usepasswd=True
- Standard users with home in /home should not trigger a policy change
- Standard users with home in directory like /var/home should trigger a policy change
- Standard users with home in / shoud not trigger a policy change
- SELinux users with home in / shoud not trigger a policy change
- Other SELinux users should trigger a policy change
