When kernel-uk-virt is installed, the rpm query returns more than one
result, leading to (non-fatal) errors in the Setup phase. Query for the
kernel image path instead to avoid this.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Fedora ELN / RHEL-10 has disabled CONFIG_NET_KEY, so apply a patch that
allows the testsuite to succeed by skipping the key_socket test when it
is not supported.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Do it the same way as in commit 3e8824e0aa ("kernel/selinux-testsuite:
fix kernel pkg name detection").
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The detection of this flag is broken with DNF5, because it now only
appears under `dnf install --help`. Also, DNF5 now implements the logic
we want (skipping packages that are not available, rather than "broken")
under a new --skip-unavailable flag.
Therefore, detect both using `dnf install --help` and also check for
--skip-unavailable first.
Without this fix the tests try to install each package one by one with
DNF5, which is suboptimal.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
When NetLabel is configured to send unlabeled traffic, it should fully
remove CIPSO options from the IP packets. This test verifies that they
are indeed removed (and not just replaced with IPOPT_NOP or IPOPT_END).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
I can't believe I got it wrong AGAIN... I missed the ! operator.... Now
it should be correct, as was finally able to test it.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The version comparison is wrong. Fix it.
Fixes: 485e8279b7 ("kernel/selinux-testsuite: remove install_t references on RHEL6")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The directory may also be owned by <name>-modules-core rather than
<name>-core in some cases. Use the "config" file as the reference
instead.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The install_t workaround for rpm-ostree doesn't work on RHEL-6, so make
it conditional on /run/ostree-booted, so that it is only applied when
necessary.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
There is no /lib/modules/.../vmlinuz file on RHEL-7 kernels, so just use
the parent directory, which should be owned by the same package.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Instead of relying on the existing kernel package naming and versioning
conventions, which are subject to change in RHEL, determine the main
kernel package name via `rpm -qf "/lib/modules/$(uname -r)/vmlinuz"` and
derive the rest from that.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This mainly pulls in the new inet_socket/mptcp subtest that provides
coverage for the MPTCP protocol.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
- ensure the current booted kernel is set as default
(fixes the case where a newer kernel package has been installed since
boot)
- add Beaker compat workaround
- add descriptions to most rlRun asserts
- run zipl also after the cleanup `dracut -f` invocation
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Notable changes:
- fixed DH prime format in 'keys' test
- native quota support now used for ext4 when available
- needs special exception on RHEL-7 where it is broken
- fixed stderr noise from 'yes' command
- fixed SIGIO tests to work under CONFIG_LEGACY_TIOCSTI=n
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Effective changes:
- fix the policy to allow the new user_namespace::create permission
where needed
- fix the code to build without warnings with latest SELinux userspace
The rest is various cleanups or changes not affecting Fedora/RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Otheriwse older kernel entries would still have our injected scripts in
the initramfs after test execution.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Forward-port of downstream kernel tests that haven't been upstreamed
yet, manually converted to TMT.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
ramfs is now treated as an xattr-supporting filesystem and has the
fs_use_trans directive in the base policy. Thus switch to vfat, which is
still genfs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Replace the current soft fallback to raw GIT_BRANCH when a required PR
or Patchwork patch fails to merge/apply with a hoard failure, similar to
what we do when cloning the repo fails.
The main motivation is to not have CKI treat this situation as a
failure, but it also a good practice to ensure we either run the
intended version of the test or no test at all.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The only effective difference is that the broken SCTP ASCONF tests will
now be skipped, see:
3e93ece73d
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add AVC_ERROR=+no_avc_check into test environment to disable Beaker's
AVC check, as this test produces s lot of expected AVC denials.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The test doesn't detect the presence of the performance issue reliably
across machines and architectures, so disable it for now.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The ioctl number is not consistent across arches. The fix adds the
numbers for other arches to make the test work on all arches again.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Running in paths containing ':' or in /tmp doesn't work, so make sure
that the testsuite is run in /root.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...and remove some workarounds that are no longer needed. Also add code
to enable/disable SCTP client peeloff tests based on where SCTP client
peeloff is currently fixed in RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It seems none of the attempts to synchronize before connecting are good
enough - add some extra sleep time to the beginning of open_assoc().
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
In case of a bug/error, the server may end up hanging, so make sure it
terminates in some reasonable time.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This test reproduces a bug that may cause an AVC with sctp_socket,
association, unlabeled_t, unlabeled_t (and also another bug related to
SCTP peeloff on the client side).
SCTP code taken and modified from selinux-testsuite's sctp subtest.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add a variant of the selinux-testsuite test that adds a patch adding
coverage for SCTP client peeloff so that we can conveniently verify
related bugs until the fix and testsuite coverage are merged upstream.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Only at most 2-CPU s390x machines are available in Beaker and the bug is
not reproducible on them, so just disable the test on s390x.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recently GitHub has deprecated the git:// protocol and cloning now fails
with this message:
```
fatal: remote error:
The unauthenticated git protocol on port 9418 is no longer supported.
Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information.
```
The only reason that git:// was being used instead of https:// was
allowing the test to run on RHEL-5, which has problems with accessing
GitHub via HTTPS due to protocol disparity. By now it should be okay to
throw RHEL-5 under the bus and use the https:// URL.
Since we are definitely making this test unable to run on RHEL-5, also
remove all RHEL-5-specific hacks from the code.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Pull in a fix that allows the testsuite to succeed on kernels with
CONFIG_IP_TABLES=n (e.g. Fedora ELN kernels; future RHEL 10+ kernels).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
