The /policycoreutils/setfiles_binary test: the --downloaddir option
is not recognized by the latest version of DNF. The option is removed
now.
The /other/update-packages test: the --skip-broken option is not
recognized by the latest version of DNF. The option is removed now.
The /selinux-policy/install-uninstall-dsp-packages test: let's not
run this test together with other tests, because it often finds
a problem that brakes the environment for the following tests.
Some components/packages are not available on CentOS-stream-10,
which leads to conclusion not to run the affected tests/phases there.
The /var and /run directories very often contain mislabeled files
and directories. In order to find discrepancies between file context
patterns and type_transition rules defined in the SELinux policy,
the restorecon command is needed.
The semanage command from older policycoreutils versions (<= 3.6-1.el9)
behaves in a certain way when a duplicated port context pattern is added.
It does not add the pattern but produces the following message:
ValueError: Port <protocol>/<number> already defined
The semanage command from new policycoreutils versions (>= 3.6-2.el9)
behaves differently when a duplicated port context pattern is added.
It adds the pattern and produces the following message:
Port <protocol>/<number> already defined, modifying instead
Above-mentioned differences in behavior have some consequences for the
automated test when removing a duplicated port context pattern. If the
automated test should pass, it needs to anticipate both possibilities.
Apparently, the first attempt to adjust the relevancy was not
complete. So here is another one.
Certain tests should not be executed on centos-stream 8 or 9 at all,
because packages required by those tests are not available there.
Certain tests need to reflect the fact that SELinux policies which
confine the tested programs are not present on all versions of RHEL,
CentOS or Fedora.
The abrt* packages are not available on RHEL-9, which means that
one of the test phases would fail if this change was not done.
The test phase dedicated to /usr/sbin/abrtd will be executed only
if the file is present.
Restore the restorecond service to its original state.
The restorecond service should not stay running if it was not
running before execution of the test.
Rework the conditional so that the new part of the test runs everywhere
except specified old version cases. Before this it wouldn't be run on
Fedora, CentOS, or RHEL>=10.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The bulk of the logic is implemented inside libsemanage, so add to the
component list, so that the test is run also on changes in libsemanage.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Not all packages required by the tests were installed. The issue
should be fixed now.
Relevancy of certain tests was set incorrectly. The issue should
be fixed now.
At least 1 test runs longer than its specified duration. The issue
should be fixed now.
A new test phase was added. Purpose of the test phase is to find
out whether the `sepolicy manpage` command can generate man pages
for all SELinux domains without triggering an error or traceback.
The TC covers BZ#1416372.
The sepolicy tool can generate man pages for specific SELinux domains.
When the sepolicy tool was instructed to generate man pages in HTML
form (--web), the generated HTML files were very incomplete. The TC
reproduces the situation.
The newly added TC checks if the sepolicy manpage command works
correctly. The checks related to the sepolicy manpage command
were removed from the sepolicy-generate TC.
The TC covers BZ#1989840.
Add test to policycoreutils/Regression suite which verifies bug 2128976
and ensures that irrelevant python scripts are not given precedence over
tools like semanage.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Extend the test to verify correct behavior when a boolean setting
override is injected. Also add auto-detection of the --refresh /
--rebuild-if-modules-changed command-line option support, which
indicates the expected level of functionality. (And we also need to
ensure that --refresh is used when supported because the other option
may be removed in the future.)
Additionally, we need to work around the fact that the exact binary
policy content can now be different depending on if the optimized code
path has been taken. Do this by toggling a boolean before introducing
injected customizations, thus obtaining the expected policy content for
the case after `semodule --refresh`.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Some CI frameworks still use STI which depends on existence of the
Makefile. In order to run this TC successfully in such frameworks,
the Makefile was added. Test description was also improved.
Recent testing revealed that `semanage import` cannot import
SELinux port definitions correctly if `port -D` is present
among them. The TC reproduces the situation.
The TC covers BZ#2063353 and BZ#2108174.
The semanage tool refuses (for some time already) fcontext patterns
which contain spaces. The TC checks if other whitespace characters
are treated the same way.
The TC covers BZ#1893545.
SELinux user-space version 3.3 and higher does not support loading
of empty CIL modules. If such version is installed, one of the test
phases will be skipped. This commit changes existing code to using
rlTestVersion.
Automated tests executed via TMT/FMF are failing due to absence of relevant packages.
Fix the main.fmf file to match the list of required packages/programs in `Makefile`.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
SELinux user-space of version 3.3 and higher does not support loading
of empty CIL modules. If such version is installed, one of the test
phases will be skipped.
Sometimes ansible is not available as rpm in repositories, but it should
be possible to install ansible using pip3
Fixes:
[ FAIL ] :: Checking for the presence of ansible rpm
[ FAIL ] :: Command 'ansible-playbook -i localhost, -c local -v tests_all_purge.yml' (Expected 0, got 127)
setfiles didn't allow using "-c" parameter (binary policy) when path was
specified. Verify that setfiles now gives the same results regardless of
weather binary policy was provided.
The TC covers BZ#1973754
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
The TC expected that all SELinux policies are installed before the
TC is executed. If some of them is not installed, one of the test
phases failed.
Now, the test phase checks if particular policy is installed before
calling the D-bus interface on it.
Add an semanage case to file-contexts test suite which verifies bug
1822100. The fix checks for the broken pipe error generated by the
'semanage fcontext -l | egrep ..' command.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Rather than enumerating RHEL versions, use comparison against
"known-good" version to make the expressions easier to read and
understand.
Also convert users of '~<' to '<', as '~<' compares only minor versions
within the same major.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Relevancy changes are made based on recommendations from:
tmt test lint --fix
Some packages are available for Fedoras only and are not available
for RHELs at all.
Some packages are available for latest RHEL major versions only.
Some checks in the automated tests require an unmounted SELinux
file-system. This way is used to pretend that SELinux is disabled.
Sometimes the file-system cannot be unmounted because of
umount: /sys/fs/selinux: target is busy.
To work around this issue, umount with --lazy option will be used.
If umount --lazy still complains, the problematic checks will be
skipped, because it still make sense to run the other parts of the
automated tests.
The selinux-autorelabel service is available in various Fedoras
and RHELs, so it makes sense to run the TC in upstream testing.
There are no changes in the TC functionality, only moving the
downstream TC to the upstream repo.
The testcase verifies HTML page generated by "sepolicy manpage"
and ensures links to generated man page exists.
Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1854639
Signed-off-by: Amith Kumar <apeetham@redhat.com>
