Some tests failed when executed on CentOS-stream machines because of
insufficient code conditions. From now on, this problem should not
happen anymore.
Sooner or later, the gnome-remote-desktop service will be confined
by SELinux policy and this automated test should find out if basic
functions of the program/service are affected or not.
The TC covers RHEL-35877.
During the development of the automated test, a new SELinux denial
was identified and reported. The reproducer is already part of this
test.
In order to support various functions of the grdctl program, I believe
that SELinux policy should allow the gnome-remote-desktop-daemon
processes to watch (syscall = inotify_add_watch) the
/etc/gnome-remote-desktop directory. The TC looks for appropriate
policy rules and file context patterns.
The TC covers BZ#2321236.
Recently, debugging of unrelated systemd issue revealed that SELinux
prevents a successful execution of systemd-run inside systemd-run
session. The TC reproduces the situation.
In order to support the above-mentioned scenario, I believe that
SELinux policy should allow the dbus-broker to read/write from/to
UNIX stream socket owned by the systemd session. The TC looks for
appropriate policy rules.
The TC covers RHEL-61928 and RHEL-62185.
Sooner or later, the tlshd service will be confined by SELinux
policy and this automated test should find out if basic functions
of the program/service are affected or not.
The TC covers RHEL-29439 and RHEL-42672.
In Fedora 41+, the timemaster_t type is available only when the
linuxptp-selinux package is installed. It is pulled in by linuxptp if
linuxptp-selinux exists, so linuxptp is a safe requirement working
for older releases, too.
Sooner or later, the pcm-sensor-server will be confined by SELinux
policy and this automated test should find out if basic functions
of the pcm-sensor-server program/service are affected or not.
The TC covers RHEL-52838.
Recently created tests were missing FMF ids and Nitrate ids.
Newly created SELinux types are slightly different from what I expected.
Both issues are solved now.
The test phase covers both BZ#2270895 and RHEL-60837 because they
the same. The test phase should not be executed in environments
where the following SELinux type is not defined:
* secretmem_t
Sooner or later, the power-profiles-daemon will be confined by SELinux
policy and this automated test should find out if basic functions
of the power-profiles-daemon program/service are affected or not.
The TC covers RHEL-61117.
Sooner or later, the switcheroo-control will be confined by SELinux
policy and this automated test should find out if basic functions
of the switcheroo-control program/service are affected or not.
The TC covers RHEL-24268.
Recently, the systemd-mountfsd program/service got confined by SELinux.
Purpose of this automated test is to cover the basic scenarios in
which the daemon is used. The systemd-mountfsd man page was used as
the source of test scenarios/ideas.
Sooner or later, the iio-sensor-proxy will be confined by SELinux
policy and this automated test should find out if basic functions
of the iio-sensor-proxy program/service are affected or not.
The TC covers RHEL-17346.
Several recent BZ reports revealed that SELinux prevents the
systemd-homed processes from reading the /var/cache/systemd/home/
directory. The TC reproduces the situation.
In order to support the expected systemd-homed functionality, I believe
that SELinux policy should allow the action. The TC looks for
appropriate policy rules and file context patterns.
The TC covers BZ#2036108 and its duplicates.
A recent cockpit CI + selinux-policy + FIPS testing revealed that
SELinux prevents the systemd-modules-load processes from reading
files stored in the /run/modprobe.d/ directory. The TC reproduces
the situation.
In order to support the documented locations for modprobe config
files, I believe that SELinux policy should allow the action. The
TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-54591.
A recent systemd + selinux-policy testing revealed that SELinux
prevents the systemd-journal-upload processes from reading the
the /run/systemd/journal-upload.conf.d/ directory. The TC reproduces
the situation.
In order to support the documented locations where systemd-journal-upload
configurations can be located, I believe that SELinux policy should
allow this action. The TC looks for appropriate policy rules and
file context patterns.
The TC covers RHEL-57774.
A recent testing of a documented hostapd + freeradius use case
revealed that SELinux prevents the hostapd processes from writing
to a control socket located in /tmp. The TC reproduces the situation.
In order to support the documented use case, I believe that SELinux
policy should allow the action. The TC looks for appropriate policy
rules and file context patterns.
The TC covers RHEL-59683.
A recent booth + selinux-policy testing revealed that SELinux
prevents the boothd processes from reading the /run/systemd/userdb/
directory and connecting through the io.systemd.DynamicUser socket
stored in it. The TC reproduces the situation.
In order to support the intended boothd functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-57104 and RHEL-58060.
A recently filed issue revealed that SELinux prevents the
systemd-sysctl from reading the files stored under the /run/sysctl.d/
directory. The TC reproduces the situation.
In order to support this documented sysctl specific location,
I believe that SELinux policy should allow the action. The TC
looks for SELinux denials that may appear when reproducing the
scenario.
The TC covers RHEL-56988 and RHEL-58380.
Because the ISC dhcp is no longer maintained by upstream, the dhcpcd
package is used as a replacement. Unfortunately, SELinux prevents
a new dhcpcd instance from communicating to and terminating the old one.
The TC does not reproduce the situation.
In order to support the intented dhcpcd functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-33081 and RHEL-43417.
Recently, the automated test started failing because the following
file was not present: /etc/firewalld/lockdown-whitelist.xml.
From now on, the test should not fail because of this.
When kernel-uk-virt is installed, the rpm query returns more than one
result, leading to (non-fatal) errors in the Setup phase. Query for the
kernel image path instead to avoid this.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recently, the boothd program got confined by SELinux. Purpose of
this automated test is to find out if basic scenarios work as
expected under the current SELinux policy.
The TC covers RHEL-45907.
Fedora ELN / RHEL-10 has disabled CONFIG_NET_KEY, so apply a patch that
allows the testsuite to succeed by skipping the key_socket test when it
is not supported.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Commit ab42eb93 added the change to another test by mistake.
Fixes:
# cd libselinux/setfiles-in-chroot-env
# 1minutetip 1MT-CentOS-Stream-9
# ./runtest.sh
yum -y install filesystem libselinux libselinux-utils python3-libselinux policycoreutils --installroot=/tmp/tmp.WhKcf2BrOe --skip-broken'
Unable to detect release version (use '--releasever' to specify release version)
Error: Failed to download metadata for repo 'epel': Cannot prepare internal mirrorlist: Status code: 404
[ FAIL ]
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
A recent cups + selinux-policy testing revealed that SELinux prevents
the cups-browsed processes from accessing the /root/.cups/lpoptions
file. The TC reproduces the situation.
In order to support the cups-browsed ability to access the lpoptions
file, I believe that SELinux policy should allow the access. Either
file context patterns need to change or an appropriate policy rule
need to be added. The TC looks for these changes.
The TC covers RHEL-47401.
Recent changes (BPF code that is involved in the queue_track
backend) in the stalld component trigger SELinux denials because
SELinux policy does not expect such a behavior. The TC reproduces
the situation.
In order to support this new feature, I believe that SELinux policy
should allow the necessary actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-50356.
Instead of checking Fedora or CentOS or RHEL version, the decision
to adapt should be made according to the defined SELinux policy types
or attributes.
The TC also covers RHEL-40834.
If required packages are not installed, the tests will try to install
them (only 1 attempt per test will be done).
Certain test phases may not be relevant if:
* required SELinux types/attributes are not defined
* required programs/files are not installed
* required packages are not available
Recent cockpit + systemd + selinux-policy testing revealed that
SELinux prevents the systemd-machined process (started by the
machinectl command) from doing the following actions:
* creating the /run/systemd/machine directory
* creating the /run/systemd/machine/io.systemd.Machine socket
* unlinking the /run/systemd/machine/io.systemd.Machine socket
The TC reproduces the situation.
In order to support the basic machinectl functions, I believe that
SELinux policy allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-49567.
A recent cockpit + selinux-policy testing revealed that SELinux
prevents libvirt-dbus processes from connecting to virtqemud
processes. The TC reproduces the situation.
The libvirt-dbus service is confined by SELinux now. The TC covers
basic scenarios in which the service is used. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-46893.
Package installations via yum can fail for many reasons. For example:
* unsatisfied package dependencies
* repository availability problems
* unrecognized command line options
Hopefully, this change helps the yum command to run successfully
when such issues occur.
Make sure the upstream and downstream version of the rlSETranslateBoolean
function is the same. Otherwise, differences can cause problems
when running tests which use the function.
A recent anaconda testing on Fedora rawhide machines revealed a
regression in the libselinux code which leads to segfaults. The TC
reproduces the situation.
The TC uses 2 reproducers (python code, binary command) to find out
if the problem is present or not. Both of them should pass when the
problem is fixed.
The TC covers BZ#2295428 and RHEL-46558.
