Add an semanage case to file-contexts test suite which verifies bug
1822100. The fix checks for the broken pipe error generated by the
'semanage fcontext -l | egrep ..' command.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Rather than enumerating RHEL versions, use comparison against
"known-good" version to make the expressions easier to read and
understand.
Also convert users of '~<' to '<', as '~<' compares only minor versions
within the same major.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Relevancy changes are made based on recommendations from:
tmt test lint --fix
Some packages are available for Fedoras only and are not available
for RHELs at all.
Some packages are available for latest RHEL major versions only.
Some checks in the automated tests require an unmounted SELinux
file-system. This way is used to pretend that SELinux is disabled.
Sometimes the file-system cannot be unmounted because of
umount: /sys/fs/selinux: target is busy.
To work around this issue, umount with --lazy option will be used.
If umount --lazy still complains, the problematic checks will be
skipped, because it still make sense to run the other parts of the
automated tests.
The selinux-autorelabel service is available in various Fedoras
and RHELs, so it makes sense to run the TC in upstream testing.
There are no changes in the TC functionality, only moving the
downstream TC to the upstream repo.
The testcase verifies HTML page generated by "sepolicy manpage"
and ensures links to generated man page exists.
Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1854639
Signed-off-by: Amith Kumar <apeetham@redhat.com>
They are important as source of Requirements for tests. The original idea that
requirements should be part of tests.yml currently doesn't scale through
different projects with different tests.yml
This test creates mislabeled files and runs restorecond repeatedly to test
for an issue caused by overwriting program variable with memory address.
The issue caused restorecond to write status messages (that appeared
as "blob data" because of \r character) to journal.
Since the memory address mentioned above is effectively random data,
this test may result in SUCESS even if the issue being tested is present!
- userapp_t didn't have permission to write into temporary file which
caused failure of the test even when sctp_test worked properly
- Fix context of sctp_test during clean-up
- Add listing of the new portcons to check they have been properly added
Fixes: https://src.fedoraproject.org/tests/selinux/issue/21
libsemanage had to be changed together with policycoreutils in order to
implement support for 'sctp' and 'dccp' in `semanage port`. It's probably a good
idea to cover libsemanage by this test as well.
This test simulates a use case where a user wants to confine a
client-server application communicating over SCTP protocol.
A custom policy module is used to introduce a new port type, domain type
for the application and an executable file type for the application
executable as well as a minimal set of allow rules for sctp_test to work
properly.
"semanage port" is then used to define SCTP contexts for ports 1025 and
1026.
Lastly sctp_test is executed in client-server configuration.
We need to check whether a new policy is loaded after 'semanage port -a ...'.
The best way to do it is to check whether kernel reported MAC_POLICY_LOAD.
The original check was error prone.
Fixes:
[ PASS ] :: Command 'ausearch -m user_avc -ts 03/13/2019 08:10:47 > /tmp/tmp.3RAR6INhvL' (Expected 0,1, got 0)
[ BEGIN ] :: Running 'cat /tmp/tmp.3RAR6INhvL'
----
time->Wed Mar 13 08:10:53 2019
type=USER_AVC msg=audit(1552479053.819:1407): pid=698 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: received policyload notice (seqno=65) exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
[ FAIL ] :: number of lines in /tmp/tmp.3RAR6INhvL should be 0 (Assert: expected 0, got 3)
Tests tagged as "generic" is supposed to be used on a generic system like Fedora
or Red Hat Enterprise Linux, while tests with "fedora" tag is for Fedora only.
Usage:
List only "generic" tests:
$ fmf show --filter "tier: 1 | component: policycoreutils & tags: generic"
List all "generic" and "fedora" tests:
$ fmf show --filter "tier: 1 | component: policycoreutils & tags: generic, fedora"
Since commit a456db2c59e43b331184ceda5a1bd5d51ddd2d2d ("Move tests to /tests
directory and rename to new naming scheme") linux-system-roles selinux tests use
tests/ directory and renamed test playbooks to tests_*.yml.
Fixes:
[ FAIL ] :: Command 'cd selinux/test' (Expected 0, got 1)
check_contexts was checking contexts in a loop and there was no warning
when there were no files to check (because of invalid parameter). Fix
this by counting the files to be checked.
Fix also one invalid call to check_contexts.
Commit 769880f7 added path meta data into .fmf files. As path's didn't have /
at the beginning test were not created correctly.
Fixes:
fatal: [fedora29]: FAILED! => {
"msg": [
"Tests failed: True",
"Tests msg: FAIL selinuxselinux-policy/policy-rpm-macros",
"FAIL selinuxcheckpolicy/checkpolicy",
"FAIL selinuxlibsepol/sepol_check_context",
"FAIL selinuxlibsemanage/verify-options-in-semanage-conf",
...
$ cat artifacts/FAIL_selinuxcheckpolicy-checkpolicy.log
FAIL test selinuxcheckpolicy/checkpolicy does not appear to be a file or directory
Commit 769880f7 added path meta data into .fmf files. As path's didn't have /
at the beginning test were not created correctly.
Fixes:
fatal: [fedora29]: FAILED! => {
"msg": [
"Tests failed: True",
"Tests msg: FAIL selinuxselinux-policy/policy-rpm-macros",
"FAIL selinuxcheckpolicy/checkpolicy",
"FAIL selinuxlibsepol/sepol_check_context",
"FAIL selinuxlibsemanage/verify-options-in-semanage-conf",
...
$ cat artifacts/FAIL_selinuxcheckpolicy-checkpolicy.log
FAIL test selinuxcheckpolicy/checkpolicy does not appear to be a file or directory
The test compiles a TE module, loads it via semodule, and checks that
the rules are enforced. The same is done with a CIL module. Module
overriding using priorities and module disabling is also tested.
This test requires policycoreutils and selinux-policy-devel packages.
This adds an initial set of test metadata using the Flexible Metadata
Format for experimenting. This should allow us to more easily execute
relevant test coverage for all selinux-related components. Example:
fmf --key test --filter 'tags:Tier1'
fmf --key test --filter 'component:libselinux'
fmf --key test --filter 'component:libselinux | tags:Tier1'
See https://github.com/psss/fmf for more details about the FMF format.
