diff --git a/README.md b/README.md deleted file mode 100644 index 31b5c7d..0000000 --- a/README.md +++ /dev/null @@ -1,26 +0,0 @@ -# SELinux tests - -This repository contains set of test for SELinux kernel, userspace and policy. -Tests are written using [beakerlib](https://github.com/beakerlib/beakerlib) with [TMT Metadata Specification](https://tmt.readthedocs.io/en/latest/spec.html). - - -## Gating Guidelines -Test tiers define a test's priority for our **gating process**. - -* **`tier: 1`**: Critical tests that must pass for any code merge. -* **`tier: 2`**: Important but non-critical tests. -* **`tier: 3`**: Non-critical tests. - -All other tier metadata (e.g., `tag:Tier1`) is now deprecated. - -## Plans - - $ tmt plans - Found 5 plans: /plans/ci, /plans/reboot, /plans/tier1, /plans/tier2 and /plans/tier3. - -## Usage - -Run `tier1` on `localhost`: - - # tmt run provision -h local prepare plans -n /plans/tier1 discover execute - # tmt run -l report -h display -v diff --git a/README.rst b/README.rst new file mode 100644 index 0000000..e69de29 diff --git a/checkpolicy/checkmodule/Makefile b/checkpolicy/checkmodule/Makefile index c0b1096..4dca103 100644 --- a/checkpolicy/checkmodule/Makefile +++ b/checkpolicy/checkmodule/Makefile @@ -53,17 +53,12 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: checkpolicy" >> $(METADATA) - @echo "Requires: checkpolicy man grep policycoreutils policycoreutils-devel" >> $(METADATA) + @echo "Requires: checkpolicy man grep mktemp policycoreutils policycoreutils-devel" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 533796" >> $(METADATA) # RHEL-5 - @echo "Bug: 588294" >> $(METADATA) # RHEL-6 - @echo "Bug: 1064603" >> $(METADATA) # RHEL-7 - @echo "Bug: 1329217" >> $(METADATA) # RHEL-7 - @echo "Bug: 1392394" >> $(METADATA) # RHEL-6 rhts-lint $(METADATA) diff --git a/checkpolicy/checkmodule/main.fmf b/checkpolicy/checkmodule/main.fmf index 0c472de..6173448 100644 --- a/checkpolicy/checkmodule/main.fmf +++ b/checkpolicy/checkmodule/main.fmf @@ -1,37 +1 @@ -summary: runs checkmodule with various options to find out if it behaves correctly -description: |+ - This TC runs checkmodule with various options to find out if it behaves correctly. - -contact: Milos Malik -component: - - checkpolicy -test: ./runtest.sh -framework: beakerlib -recommend: - - checkpolicy - - man - - grep - - policycoreutils - - policycoreutils-devel -duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - f31friendly - - f32friendly - - targeted -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533796 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=588294 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064603 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0062301 -extra-summary: /CoreOS/checkpolicy/Sanity/checkmodule -extra-task: /CoreOS/checkpolicy/Sanity/checkmodule +path: /checkpolicy/checkmodule diff --git a/checkpolicy/checkmodule/runtest.sh b/checkpolicy/checkmodule/runtest.sh old mode 100755 new mode 100644 index 0d2eb4a..590a799 --- a/checkpolicy/checkmodule/runtest.sh +++ b/checkpolicy/checkmodule/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="checkpolicy" @@ -40,7 +41,7 @@ rlJournalStart rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/.*checkmodule" rlPhaseEnd - rlPhaseStartTest "bz#533796 + bz#588294" + rlPhaseStartTest rlRun "checkmodule >& ${TEST_FILE}" 1 rlAssertGrep "unable to open policy.conf" ${TEST_FILE} rlRun "checkmodule -b >& ${TEST_FILE}" 1 @@ -65,27 +66,23 @@ rlJournalStart rlRun "checkmodule ${TEST_FILE}" 1 rlRun "checkmodule -b ${TEST_FILE}" 1 if rlIsRHEL 5 ; then - if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then - rlRun "man checkmodule | col -b | grep -- -d" - fi + rlRun "man checkmodule | col -b | grep -- -d" rlRun "checkmodule --help 2>&1 | grep -- -d" fi - if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then - rlRun "man checkmodule | col -b | grep -- -h" - rlRun "man checkmodule | col -b | grep -- -U" - fi + rlRun "man checkmodule | col -b | grep -- -h" + rlRun "man checkmodule | col -b | grep -- -U" rlRun "checkmodule --help 2>&1 | grep -- -h" rlRun "checkmodule --help 2>&1 | grep -- -U" rlPhaseEnd - rlPhaseStartTest "bz#1064603 + bz#1392394" + rlPhaseStartTest for POLICY_KIND in minimum mls targeted ; do rlRun "checkmodule -M -m -b -o testmod.mod /etc/selinux/${POLICY_KIND}/policy/policy.* >& ${TEST_FILE}" 1 rlRun "grep -i \"checkmodule.*-b and -m are incompatible with each other\" ${TEST_FILE}" done rlPhaseEnd - rlPhaseStartTest "bz#1329217" + rlPhaseStartTest INPUT_FILE="mypolicy.te" OUTPUT_FILE="mypolicy.output" rlRun "ls -l ${INPUT_FILE}" @@ -98,24 +95,6 @@ rlJournalStart fi rlPhaseEnd - if ! rlIsRHEL 5 6 ; then # semodule_unpackage is not available on RHEL-5 and RHEL-6 - rlPhaseStartTest "handle unknown classes and perms" - rlRun "rm -f base.pp base.mod" - rlRun "semodule -E base" - rlRun "semodule_unpackage base.pp base.mod" - for ACTION in allow deny reject ; do - rlRun "checkmodule -b -o base.out -M -U ${ACTION} base.mod" - rlRun "echo -e 'u\nq\n' | sedismod base.out | grep -i \"${ACTION} unknown\"" - done - rlRun "checkmodule -m -o mypolicy.out -M -U deny mypolicy.te" - rlRun "ls -l mypolicy.out" - for ACTION in allow reject ; do - rlRun "checkmodule -m -o mypolicy.out -M -U ${ACTION} mypolicy.te 2>&1 | grep -i 'only valid.*base module'" - done - rlRun "rm -f base.pp base.mod base.out mypolicy.out" - rlPhaseEnd - fi - rlPhaseStartCleanup rlRun "rm -rf ${TEST_FILE} ${TEST_DIR} ${OUTPUT_FILE}" rlPhaseEnd diff --git a/checkpolicy/checkpolicy-docs/Makefile b/checkpolicy/checkpolicy-docs/Makefile index d0b165e..ea1a0bc 100644 --- a/checkpolicy/checkpolicy-docs/Makefile +++ b/checkpolicy/checkpolicy-docs/Makefile @@ -1,6 +1,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy-docs +# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy # Description: covers an issue where manpage included an unsupported option. # Author: Milos Malik # @@ -24,7 +24,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy-docs +export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy export TESTVERSION=1.0 BUILT_FILES= diff --git a/checkpolicy/checkpolicy-docs/PURPOSE b/checkpolicy/checkpolicy-docs/PURPOSE index ce7d2cc..bde34d7 100644 --- a/checkpolicy/checkpolicy-docs/PURPOSE +++ b/checkpolicy/checkpolicy-docs/PURPOSE @@ -1,4 +1,4 @@ -PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy-docs +PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy Description: covers an issue where manpage included an unsupported option. diff --git a/checkpolicy/checkpolicy-docs/main.fmf b/checkpolicy/checkpolicy-docs/main.fmf index 58021b7..f303b47 100644 --- a/checkpolicy/checkpolicy-docs/main.fmf +++ b/checkpolicy/checkpolicy-docs/main.fmf @@ -1,37 +1 @@ -summary: covers an issue where manpage included an unsupported option. -description: |+ - Description: covers an issue where manpage included an unsupported option. - - Author: Milos Malik - - -contact: Milos Malik -component: - - setools - - checkpolicy -recommend: - - checkpolicy -duration: 1m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - TIPpass_Security - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#00612804 -extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy-docs -extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy-docs -id: 8e06af12-0434-448a-aa85-9ed5c854daf9 +path: /checkpolicy/checkpolicy-docs diff --git a/checkpolicy/checkpolicy-docs/runtest.sh b/checkpolicy/checkpolicy-docs/runtest.sh old mode 100755 new mode 100644 index fc207c9..83a7079 --- a/checkpolicy/checkpolicy-docs/runtest.sh +++ b/checkpolicy/checkpolicy-docs/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="checkpolicy" diff --git a/checkpolicy/checkpolicy/Makefile b/checkpolicy/checkpolicy/Makefile index 3712630..1ba29a4 100644 --- a/checkpolicy/checkpolicy/Makefile +++ b/checkpolicy/checkpolicy/Makefile @@ -59,10 +59,6 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 533790" >> $(METADATA) # RHEL-5 - @echo "Bug: 739866" >> $(METADATA) # RHEL-6 - @echo "Bug: 1328966" >> $(METADATA) # RHEL-7 - @echo "Bug: 1328979" >> $(METADATA) # RHEL-7 rhts-lint $(METADATA) diff --git a/checkpolicy/checkpolicy/PURPOSE b/checkpolicy/checkpolicy/PURPOSE index 58a2359..c60c59e 100644 --- a/checkpolicy/checkpolicy/PURPOSE +++ b/checkpolicy/checkpolicy/PURPOSE @@ -4,5 +4,4 @@ Description: runs checkpolicy with various options to find out if it behaves cor Author: Milos Malik -This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ). diff --git a/checkpolicy/checkpolicy/main.fmf b/checkpolicy/checkpolicy/main.fmf index 6d24ebe..0436b60 100644 --- a/checkpolicy/checkpolicy/main.fmf +++ b/checkpolicy/checkpolicy/main.fmf @@ -1,41 +1,2 @@ -summary: runs checkpolicy with various options to find out if it behaves correctly -description: |+ - Description: runs checkpolicy with various options to find out if it behaves correctly - - Author: Milos Malik - - This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ). - -contact: Milos Malik -component: - - setools - - checkpolicy -test: ./runtest.sh -framework: beakerlib -recommend: - - checkpolicy - - setools-console - - selinux-policy-minimum - - selinux-policy-mls - - selinux-policy-targeted -duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - f31friendly - - f32friendly - - targeted +path: /checkpolicy/checkpolicy tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0062302 -extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy -extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh old mode 100755 new mode 100644 index 059454f..7bdfbba --- a/checkpolicy/checkpolicy/runtest.sh +++ b/checkpolicy/checkpolicy/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="checkpolicy" @@ -34,11 +35,9 @@ PACKAGE="checkpolicy" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} - if rlIsRHEL "<9" ; then - rlAssertRpm selinux-policy-minimum - fi - rlRun "rpm -qa | grep selinux-policy" - rlRun "rpm -qa | grep kernel" + rlAssertRpm selinux-policy-minimum + rlAssertRpm selinux-policy-mls + rlAssertRpm selinux-policy-targeted rlRun "uname -a" TEST_FILE=`mktemp` TEST_DIR=`mktemp -d` @@ -53,7 +52,7 @@ rlJournalStart if rlIsRHEL 5 6 ; then VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}` else - # some versions are skipped because of BZ#1328979 + # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23" VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23` fi for CUR_VERSION in ${VERSIONS} ; do @@ -68,7 +67,7 @@ rlJournalStart done rlPhaseEnd - rlPhaseStartTest "bz#533790" + rlPhaseStartTest rlRun "checkpolicy >& ${TEST_FILE}" 1 rlAssertGrep "unable to open policy.conf" ${TEST_FILE} rlRun "checkpolicy -b >& ${TEST_FILE}" 1 @@ -99,13 +98,11 @@ rlJournalStart rlRun "checkpolicy -c 0 2>&1 | grep \"value 0 not in range\"" rlRun "checkpolicy -t 2>&1 | grep \"option requires an argument\"" rlRun "checkpolicy -t xyz 2>&1 | grep -i \"unknown target platform\"" - if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then - rlRun "man checkpolicy | col -b | grep -- '-m]'" 1 - fi + rlRun "man checkpolicy | col -b | grep -- '-m]'" 1 rlRun "checkpolicy --help 2>&1 | grep -- '-m]'" 1 rlPhaseEnd - rlPhaseStartTest "bz#739866" + rlPhaseStartTest if rlIsRHEL 5 6 ; then ACTIVE_POLICY="/selinux/policy" else @@ -113,13 +110,8 @@ rlJournalStart fi rlRun "echo -e 'q\n' | checkpolicy -Mdb ${ACTIVE_POLICY} | tee ${OUTPUT_FILE}" rlRun "grep -qi -e error -e ebitmap -e 'not match' ${OUTPUT_FILE}" 1 - if rlIsRHEL "<9" ; then - LIST="minimum mls targeted" - else - LIST="mls targeted" - fi - for POLICY_TYPE in $LIST ; do - if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then + for POLICY_TYPE in minimum mls targeted ; do + if [ ! -e /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then continue fi rlRun "echo -e 'q\n' | checkpolicy -Mdb /etc/selinux/${POLICY_TYPE}/policy/policy.* | tee ${OUTPUT_FILE}" @@ -127,7 +119,7 @@ rlJournalStart done rlPhaseEnd - rlPhaseStartTest "bz#1328966 + bz#1328979" + rlPhaseStartTest if rlIsRHEL 5 6 ; then ACTIVE_POLICY_TREE="/selinux" else # RHEL-7 and above @@ -135,20 +127,11 @@ rlJournalStart fi MIN_VERSION="15" MAX_VERSION=`find /etc/selinux/ -name policy.?? | cut -d / -f 6 | cut -d . -f 2 | head -n 1` - if rlIsRHEL "<9" ; then - LIST="minimum mls targeted" - else - LIST="mls targeted" - fi - for POLICY_TYPE in $LIST ; do - if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then - rlLog "${POLICY_TYPE} policy file is not available, skipping" - continue - fi + for POLICY_TYPE in minimum mls targeted ; do if rlIsRHEL 5 6 ; then VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}` else - # some versions are skipped because of BZ#1328979 + # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23" VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23` fi for CUR_VERSION in ${VERSIONS} ; do @@ -164,75 +147,8 @@ rlJournalStart done rlPhaseEnd - rlPhaseStartTest "handle unknown classes and perms" - for ACTION in allow deny reject ; do - rlRun "rm -f policy.out" - rlWatchdog "checkpolicy -M -U ${ACTION} -o policy.out policy.conf.from.secilc" 15 - if [ -s policy.out ] ; then - rlRun "echo -e 'U\nq\n' | sedispol policy.out 2>&1 | tee ${OUTPUT_FILE}" - rlRun "grep -i \"${ACTION} unknown\" ${OUTPUT_FILE}" - else - rlFail "policy.out is empty or was not created" - fi - done - rlPhaseEnd - - if ! rlIsRHEL '<=8.1'; then - rlPhaseStartTest "sorting ocontexts" - # check -S option in --help - rlRun "checkpolicy --help >$OUTPUT_FILE" 0,1 - rlRun "cat $OUTPUT_FILE" - rlAssertGrep "\[-S\]" $OUTPUT_FILE - - if [ -e "/usr/share/man/man8/checkmodule.8.gz" ];then - # check -S option in man page - rlRun "PAGER=cat man checkpolicy >$OUTPUT_FILE" - rlRun "cat $OUTPUT_FILE" - rlAssertGrep "\[-S\]" $OUTPUT_FILE - fi - - # run checkpolicy with the -S option - rlWatchdog "checkpolicy -S -M -o policy.out policy.conf.from.secilc" 15 - rlRun "seinfo policy.out" - rlPhaseEnd - fi - - rlPhaseStartTest "Test checkpolicy cil option" - # check -C option without input file - rlRun "checkpolicy -C 2>&1 | grep \"unable to open policy.conf\"" - # check -C option with policy.conf file - rlRun "checkpolicy -C -M -o policy.cil policy.conf.from.secilc" - rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil - # check -C option with policy binary file - rlRun "checkpolicy -C -M -o policy.cil2 -b /sys/fs/selinux/policy" - rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil2 - rlPhaseEnd - - if rlIsRHEL '>=9' ; then - rlPhaseStartTest "Test checkpolicy optimize option" - # check -O option without input file - rlRun "checkpolicy -O 2>&1 | grep \"unable to open policy.conf\"" - # Create optimized -O binary with policy.conf file - rlRun "checkpolicy -O -M -o policy.opt policy.conf.from.secilc" - rlRun "seinfo policy.opt" - # Create regular binary with policy.conf file - rlRun "checkpolicy -M -o policy.reg policy.conf.from.secilc" - rlRun "seinfo policy.reg" - # Compare size of optimized and regular binary - OPT1=`stat -c %s policy.opt` - REG1=`stat -c %s policy.reg` - rlAssertGreater "Test if regular file size is higher than optimized file" $REG1 $OPT1 - # Compare allow rule counts between optimized and regular binary - rlRun "seinfo policy.opt > /tmp/optfile" - OPT_CNT=`grep Allow: /tmp/optfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2` - rlRun "seinfo policy.reg > /tmp/regfile" - REG_CNT=`grep Allow: /tmp/regfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2` - rlAssertGreater "Regular file has higher allow rule than optimized file" $REG_CNT $OPT_CNT - rlPhaseEnd - fi - rlPhaseStartCleanup - rm -f ${OUTPUT_FILE} policy.out policy.cil policy.cil2 policy.opt policy.reg /tmp/optfile /tmp/regfile + rm -f ${OUTPUT_FILE} policy.out rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/checkpolicy/internal-tests/main.fmf b/checkpolicy/internal-tests/main.fmf deleted file mode 100644 index 437b964..0000000 --- a/checkpolicy/internal-tests/main.fmf +++ /dev/null @@ -1,28 +0,0 @@ -summary: Run internal checkpolicy tests -contact: Milos Malik -component: - - checkpolicy -require: - - bison - - checkpolicy - - flex - - gcc - - libsepol-devel - - make -recommend: - - libsepol-static -duration: 5m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - avoidImageMode -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the test is not relevant there -extra-nitrate: TC#0620041 -id: 3df4f40d-61a0-4267-b7db-6ff9f5254406 diff --git a/checkpolicy/internal-tests/runtest.sh b/checkpolicy/internal-tests/runtest.sh deleted file mode 100755 index 2977950..0000000 --- a/checkpolicy/internal-tests/runtest.sh +++ /dev/null @@ -1,58 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/checkpolicy/internal-tests -# Description: Run internal checkpolicy tests -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2026 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="checkpolicy" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - if ! rpm -q libsepol-static >& /dev/null ; then - rlRun "dnf install -y libsepol-static --enablerepo '*'" - fi - rlRun "rpm -qa | grep libsepol | sort" - rlPhaseEnd - - rlPhaseStartTest "non-fuzzing tests" - rlRun "dnf download --source ${PACKAGE}" - rlRun "rpm -ivh ${PACKAGE}-*.src.rpm" - rlRun "rm -f ${PACKAGE}-*.src.rpm" - rlRun "tar zxf ~/rpmbuild/SOURCES/${PACKAGE}-*.tar.gz" - rlRun "pushd ${PACKAGE}-*" - rlRun "make test" - rlRun "popd" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf ~/rpmbuild ${PACKAGE}-*" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/checkpolicy/oom-compiler-failure/PURPOSE b/checkpolicy/oom-compiler-failure/PURPOSE deleted file mode 100644 index 2c3a537..0000000 --- a/checkpolicy/oom-compiler-failure/PURPOSE +++ /dev/null @@ -1,21 +0,0 @@ -PURPOSE of /CoreOS/checkpolicy/Regression/oom-compiler-failure -Author: Petr Matyas - -Description: checkpolicy and checkmodule must fail cleanly under OOM conditions - -When a policy compiler (checkpolicy, checkmodule) encounters a memory -allocation failure mid-compilation it must abort and return a non-zero exit -status. It must not write a partial or otherwise incorrect output binary, -which could be silently loaded by semodule and corrupt the running policy. - -The test constrains the virtual address space of the compiler subprocess to -8 MB using "ulimit -v", which is below the minimum required to compile a real -targeted policy binary but above the threshold needed to load shared libraries -and start execution. Two compilers are exercised: - - checkpolicy -b (recompiling the active kernel policy binary) - checkmodule -b (recompiling the base module extracted from the policy store) - -Assertions for each compiler: - 1. Exit status is non-zero. - 2. The output file was not created or is empty. diff --git a/checkpolicy/oom-compiler-failure/main.fmf b/checkpolicy/oom-compiler-failure/main.fmf deleted file mode 100644 index bbc0491..0000000 --- a/checkpolicy/oom-compiler-failure/main.fmf +++ /dev/null @@ -1,18 +0,0 @@ -summary: checkpolicy and checkmodule must fail cleanly under OOM conditions -description: |+ - Simulate an out-of-memory condition by capping the virtual address space of - the compiler subprocess with ulimit -v. Verify that both checkpolicy and - checkmodule exit with a non-zero status and do not produce an output binary - when memory is exhausted during compilation. - -contact: Petr Matyas -component: - - checkpolicy -test: ./runtest.sh -framework: beakerlib -require: - - checkpolicy - - policycoreutils -enabled: true -tier: 2 -id: 4afebe54-b8f3-41d0-b9bc-91d46d436236 diff --git a/checkpolicy/oom-compiler-failure/runtest.sh b/checkpolicy/oom-compiler-failure/runtest.sh deleted file mode 100755 index 46c242e..0000000 --- a/checkpolicy/oom-compiler-failure/runtest.sh +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/checkpolicy/Regression/oom-compiler-failure -# Description: checkpolicy and checkmodule must fail cleanly under OOM -# Author: Petr Matyas -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2026 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="checkpolicy" - -# Virtual memory limit in KB applied to each compiler subprocess. -# 8 MB is below the minimum needed to parse a real targeted policy binary -# but above the minimum for the process to load its shared libraries and -# start executing. Validated against checkpolicy 3.x on RHEL-10. -MEM_LIMIT_KB=8192 - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm policycoreutils - rlAssertExists "/usr/bin/checkpolicy" - rlAssertExists "/usr/bin/checkmodule" - rlAssertExists "/usr/bin/semodule_unpackage" - - # Locate the active compiled policy on disk. - POLICY_BINARY=$(find /etc/selinux/ -name "policy.*" -type f | head -1) - rlAssertExists "${POLICY_BINARY}" - rlLog "Using policy binary: ${POLICY_BINARY}" - - # Extract the base module binary so checkmodule can compile it back. - # semodule_unpackage accepts .pp and writes separate .mod and .fc files. - rlRun "semodule -E base" 0 "Extract base.pp from the active policy store" - rlAssertExists "base.pp" - rlRun "semodule_unpackage base.pp base.mod base.fc" 0 "Unpack base.pp into base.mod" - rlAssertExists "base.mod" - rlLog "base.mod size: $(stat -c %s base.mod) bytes" - rlPhaseEnd - - rlPhaseStartTest "checkpolicy fails without producing output under OOM" - rlRun "rm -f policy.oom" - # Run checkpolicy in a child process whose virtual address space is - # capped. exec replaces the shell so ulimit applies only to checkpolicy - # itself, leaving the test harness unaffected. - rlRun -s "bash -c 'ulimit -v ${MEM_LIMIT_KB}; exec checkpolicy -b -M -o policy.oom ${POLICY_BINARY}'" 1-255 \ - "checkpolicy must exit non-zero when memory is exhausted" - rlLog "checkpolicy output: $(cat ${rlRun_LOG})" - rlRun "test ! -s policy.oom" 0 \ - "checkpolicy must not produce an output binary under OOM" - rlPhaseEnd - - rlPhaseStartTest "checkmodule fails without producing output under OOM" - rlRun "rm -f base.oom" - rlRun -s "bash -c 'ulimit -v ${MEM_LIMIT_KB}; exec checkmodule -b -M -o base.oom base.mod'" 1-255 \ - "checkmodule must exit non-zero when memory is exhausted" - rlLog "checkmodule output: $(cat ${rlRun_LOG})" - rlRun "test ! -s base.oom" 0 \ - "checkmodule must not produce an output binary under OOM" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f policy.oom base.oom base.pp base.mod base.fc" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/checkpolicy/sedismod/main.fmf b/checkpolicy/sedismod/main.fmf index a9ad051..05e7b34 100644 --- a/checkpolicy/sedismod/main.fmf +++ b/checkpolicy/sedismod/main.fmf @@ -1,31 +1 @@ -summary: Does sedismod work correctly? -description: |+ - Does sedismod work correctly? - -contact: Milos Malik -component: - - checkpolicy -recommend: - - checkpolicy - - selinux-policy-targeted - - expect - - policycoreutils - - psmisc -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - TierCandidatesPASS - - f31friendly - - f32friendly - - targeted -tier: 2 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0518635 -extra-summary: /CoreOS/checkpolicy/Sanity/sedismod -extra-task: /CoreOS/checkpolicy/Sanity/sedismod +path: /checkpolicy/sedismod diff --git a/checkpolicy/sedismod/runtest.sh b/checkpolicy/sedismod/runtest.sh index 27de54e..8f86e9e 100755 --- a/checkpolicy/sedismod/runtest.sh +++ b/checkpolicy/sedismod/runtest.sh @@ -27,11 +27,12 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="checkpolicy" # TODO: repeat for all policy modules that are installed under /etc/selinux -if rlIsFedora || rlIsCentOS ; then +if rlIsFedora ; then POLICY_FILE="`find /var/lib/selinux/targeted -type d -name base`/hll" elif rlIsRHEL '<7.3' ; then POLICY_FILE=`find /etc/selinux/targeted -type f -name base.pp` @@ -43,7 +44,7 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} OUTPUT_FILE=`mktemp` - if rlIsRHEL '>=7.3' || rlIsCentOS || rlIsFedora ; then + if rlIsRHEL '>=7.3' || rlIsFedora ; then rlRun "semodule -H -E base" else rlRun "cp ${POLICY_FILE} ./base.pp.bz2" @@ -74,18 +75,6 @@ rlJournalStart done rlPhaseEnd - if sedismod --help | grep -q actions ; then - rlPhaseStartTest "test the non-interactive actions" - rlLog "introduced in version 3.6" - for ACTION in 1 2 3 4 5 6 7 8 9 0 a b c u F v ; do - rlRun "sedismod -a ${ACTION} ${POLICY_FILE} > ${ACTION}.txt" - rlRun "ls -l ${ACTION}.txt" - rlRun "test -s ${ACTION}.txt" - rlRun "rm -f ${ACTION}.txt" - done - rlPhaseEnd - fi - rlPhaseStartCleanup rlRun "rm -f ${OUTPUT_FILE} ${POLICY_FILE}" rlPhaseEnd diff --git a/checkpolicy/sedispol/main.fmf b/checkpolicy/sedispol/main.fmf index 829c255..840a2e0 100644 --- a/checkpolicy/sedispol/main.fmf +++ b/checkpolicy/sedispol/main.fmf @@ -1,31 +1 @@ -summary: Does sedispol work correctly? -description: |+ - Does sedispol work correctly? - -contact: Milos Malik -component: - - checkpolicy -recommend: - - checkpolicy - - selinux-policy - - expect -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - f31friendly - - f32friendly - - targeted -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1303696 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1337890 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0518626 -extra-summary: /CoreOS/checkpolicy/Sanity/sedispol -extra-task: /CoreOS/checkpolicy/Sanity/sedispol -id: bbeea40d-d503-4862-91ee-3bb1b71b7baa +path: /checkpolicy/sedispol diff --git a/checkpolicy/sedispol/runtest.sh b/checkpolicy/sedispol/runtest.sh index e785220..5ed441b 100755 --- a/checkpolicy/sedispol/runtest.sh +++ b/checkpolicy/sedispol/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="checkpolicy" @@ -64,23 +65,10 @@ rlJournalStart rlRun "grep AVTAB ${OUTPUT_FILE}" rlRun "grep AVTAG ${OUTPUT_FILE}" 1 rlRun "echo -en 'u\nq\n' | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}" - rlRun "grep permisions ${OUTPUT_FILE}" 1 - rlRun "echo -en 'U\nq\n' | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}" + rlRun "grep permissions ${OUTPUT_FILE}" rlRun "grep permisions ${OUTPUT_FILE}" 1 rlPhaseEnd - if sedispol --help | grep -q actions ; then - rlPhaseStartTest "test the non-interactive actions" - rlLog "introduced in version 3.6" - for ACTION in 1 2 3 4 5 6 8 c b C r t a p u U F ; do - rlRun "sedispol -a ${ACTION} ${POLICY_FILE} > ${ACTION}.txt" - rlRun "ls -l ${ACTION}.txt" - rlRun "test -s ${ACTION}.txt" - rlRun "rm -f ${ACTION}.txt" - done - rlPhaseEnd - fi - rlPhaseStartCleanup rlRun "rm -f ${OUTPUT_FILE}" rlPhaseEnd diff --git a/kernel/CVE-2025-71085/.gitignore b/kernel/CVE-2025-71085/.gitignore deleted file mode 100644 index 6263bf3..0000000 --- a/kernel/CVE-2025-71085/.gitignore +++ /dev/null @@ -1 +0,0 @@ -reproducer diff --git a/kernel/CVE-2025-71085/main.fmf b/kernel/CVE-2025-71085/main.fmf deleted file mode 100644 index 69e25f5..0000000 --- a/kernel/CVE-2025-71085/main.fmf +++ /dev/null @@ -1,35 +0,0 @@ -summary: Test for CVE-2025-71085 -description: | - Runs the reproducer for CVE-2025-71085 (taken from the original commit - message). -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - netlabel_tools - - gcc -duration: 5m -tier: 2 -check: - # The reproducer triggers a kernel BUG when the bug is present, so turn - # on the dmesg check. - - dmesg -enabled: true -link: - - relates: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83 - - verifies: https://issues.redhat.com/browse/RHEL-143531 - - verifies: https://issues.redhat.com/browse/RHEL-143532 - - verifies: https://issues.redhat.com/browse/RHEL-143533 - - verifies: https://issues.redhat.com/browse/RHEL-143534 - - verifies: https://issues.redhat.com/browse/RHEL-143535 - - verifies: https://issues.redhat.com/browse/RHEL-143541 - - verifies: https://issues.redhat.com/browse/RHEL-143542 - - verifies: https://issues.redhat.com/browse/RHEL-143543 - - verifies: https://issues.redhat.com/browse/RHEL-143544 - - verifies: https://issues.redhat.com/browse/RHEL-143545 - - verifies: https://issues.redhat.com/browse/RHEL-143546 - - verifies: https://issues.redhat.com/browse/RHEL-143547 - - verifies: https://issues.redhat.com/browse/RHEL-143548 - - verifies: https://issues.redhat.com/browse/RHEL-143551 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2429026 diff --git a/kernel/CVE-2025-71085/reproducer.c b/kernel/CVE-2025-71085/reproducer.c deleted file mode 100644 index 29f0dae..0000000 --- a/kernel/CVE-2025-71085/reproducer.c +++ /dev/null @@ -1,48 +0,0 @@ -/* SPDX-License-Identifier: GPLv2 */ -/* - * Copyright (c) 2026 Red Hat, Inc. - * Author: Ondrej Mosnacek - * Taken from: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83 - * (Additional copyright/authorship might apply.) - */ - -#include - -#include -#include - -int main(int argc, char **argv) -{ - int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP); - - // setup msghdr - int cmsg_size = 2; - int cmsg_len = 0x60; - struct msghdr msg; - struct sockaddr_in6 dest_addr; - struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr) + cmsg_len); - msg.msg_name = &dest_addr; - msg.msg_namelen = sizeof(dest_addr); - msg.msg_iov = NULL; - msg.msg_iovlen = 0; - msg.msg_control = cmsg; - msg.msg_controllen = cmsg_len; - msg.msg_flags = 0; - - // setup sockaddr - dest_addr.sin6_family = AF_INET6; - dest_addr.sin6_port = htons(31337); - dest_addr.sin6_flowinfo = htonl(31337); - dest_addr.sin6_addr = in6addr_loopback; - dest_addr.sin6_scope_id = 31337; - - // setup cmsghdr - cmsg->cmsg_len = cmsg_len; - cmsg->cmsg_level = IPPROTO_IPV6; - cmsg->cmsg_type = IPV6_HOPOPTS; - char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr); - hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80 - - sendmsg(fd, &msg, 0); - return 0; -} diff --git a/kernel/CVE-2025-71085/runtest.sh b/kernel/CVE-2025-71085/runtest.sh deleted file mode 100755 index 1835976..0000000 --- a/kernel/CVE-2025-71085/runtest.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2026 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print kernel version" - - rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer" - - rlRun "netlabelctl calipso add pass doi:7" 0 "Set up CALIPSO" - rlRun "netlabelctl map del default" 0 "Delete default netlabel map" - rlRun "netlabelctl map add default address:0.0.0.0/0 protocol:unlbl" 0 \ - "Set unlabeled traffic by default" - rlRun "netlabelctl map add default address:::/0 protocol:unlbl" 0 \ - "Set unlabeled traffic by default" - rlRun "netlabelctl map add default address:0::1/128 protocol:calipso,7" 0 \ - "Set up CALIPSO for localhost only" - rlPhaseEnd - - rlPhaseStartTest - # Will trigger a kernel BUG in dmesg or panic when vulnerable - rlRun "./reproducer" 0 "Run the reproducer" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "netlabelctl map del default" 0 "Delete the CALIPSO map" - rlRun "netlabelctl calipso del doi:7" 0 "Unsetup CALIPSO" - rlRun "netlabelctl map add default protocol:unlbl" 0 "Re-add default netlabel map" - - rlRun "rm -f reproducer" 0 "Delete the reproducer binary" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/avc_corrupted_context/main.fmf b/kernel/avc_corrupted_context/main.fmf deleted file mode 100644 index 85fdb4e..0000000 --- a/kernel/avc_corrupted_context/main.fmf +++ /dev/null @@ -1,18 +0,0 @@ -summary: Test SELinux labeling before initial policy load -description: | - Regression test for a bug where SELinux may have printed uninitialized - kernel memory instead of a valid source/target context in AVC denials. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - memcached - - policycoreutils -duration: 5m -tier: 2 -enabled: true -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1758086 -environment: - AVC_ERROR: +no_avc_check diff --git a/kernel/avc_corrupted_context/runtest.sh b/kernel/avc_corrupted_context/runtest.sh deleted file mode 100755 index 51bf7ee..0000000 --- a/kernel/avc_corrupted_context/runtest.sh +++ /dev/null @@ -1,35 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print running kernel version" - rlServiceStart memcached - rlPhaseEnd - - rlPhaseStartTest - rlRun "semodule -d memcached" 0 - rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 0 \ - "The service should be unlabeled now" - rlRun "load_policy" 0 - rlRun "semodule -e memcached" 0 - rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 1 \ - "The service shouldn't stay unlabeled" - rlRun "ps -Zp \$(pidof memcached) | grep system_r:memcached_t:s0" 0 \ - "The service should have the correct label" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "setenforce 0" 0 # service may be unlabeled - rlServiceStop memcached - rlRun "setenforce 1" 0 - rlServiceRestore memcached - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/avc_log_actual_context_if_invalid/main.fmf b/kernel/avc_log_actual_context_if_invalid/main.fmf deleted file mode 100644 index 222785b..0000000 --- a/kernel/avc_log_actual_context_if_invalid/main.fmf +++ /dev/null @@ -1,32 +0,0 @@ -summary: Test logging of actual context in AVCs if it is invalid -description: | - Verify that SELinux logs the actual source/target context in a separate - AVC record field in case it is invalid. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy - - attr - - audit - - libselinux-utils - - policycoreutils - - selinux-policy -duration: 15m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-8.1 - because: RHEL-8.0 and below is not expected to support this -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1670039 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719666 -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail diff --git a/kernel/avc_log_actual_context_if_invalid/runtest.sh b/kernel/avc_log_actual_context_if_invalid/runtest.sh deleted file mode 100755 index 4ae5531..0000000 --- a/kernel/avc_log_actual_context_if_invalid/runtest.sh +++ /dev/null @@ -1,101 +0,0 @@ -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -EXE4="reproducer4" -EXE6="reproducer6" -PORT=8000 - -UNLABELED_CONTEXT="system_u:object_r:unlabeled_t:s0" -INVALID_TCONTEXT="system_u:object_r:banana_t:s0" -INVALID_SCONTEXT="system_u:system_r:tor_t:s0" -INVALID_SCONTEXT_MODULE="tor" - -GARBAGE_TCONTEXT="kuřecí řízek" -GARBAGE_TCONTEXT_AUDIT="6B75C5996563C3AD20C599C3AD7A656B" - -rlJournalStart - rlPhaseStartSetup - rlImport "selinux-policy/common" # for audit daemon handling - - rlRun "uname -r" 0 "Print running kernel version" - - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - old_enforce=$(getenforce) - rlLog "Backing up SELinux status: $old_enforce" - rlRun "setenforce 0" 0 "Switching to permissive" - rlPhaseEnd - - # helper function for subtests: - function check_avcs() { - local field_main="$1" - local field_raw="$2" - local invalid_ctx="$3" - - rlRun "LANG=en_US ausearch --input-logs -ts $audit_ts --raw -m AVC | \ - grep -E '^type=AVC .* $field_main=$UNLABELED_CONTEXT' \ - >tmpavcs" 0 "Collect AVCs" - - unlabeled_avcs=$(cat tmpavcs | wc -l) - unlabeled_avcs_with_rawcon=$(cat tmpavcs | \ - grep " $field_raw=$invalid_ctx" | wc -l) - rlAssertEquals "Check that all AVCs with $field_main=unlabeled have $field_raw= with the correct label" \ - $unlabeled_avcs $unlabeled_avcs_with_rawcon - rlRun "cat tmpavcs" 0 "Print checked AVCs" - } - - rlPhaseStartTest "trawcon" - rlRun "touch foo" 0 "Creating the foo test file" - rlRun "setfattr -n security.selinux -v $INVALID_TCONTEXT foo" 0 \ - "Setting SELinux xattr of foo to an invalid value" - - audit_ts="$(date +'%x %T')"; sleep 1.1 - rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \ - "Generating AVCs with invalid tcontext" - check_avcs tcontext trawcon "\"$INVALID_TCONTEXT\"" - rlPhaseEnd - - rlPhaseStartTest "trawcon-garbage" - rlRun "touch foo" 0 "Creating the foo test file" - rlRun "setfattr -n security.selinux -v '$GARBAGE_TCONTEXT' foo" 0 \ - "Setting SELinux xattr of foo to a garbage value" - - sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1 - rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \ - "Generating AVCs with invalid tcontext" - check_avcs tcontext trawcon "$GARBAGE_TCONTEXT_AUDIT" - rlPhaseEnd - - rlPhaseStartTest "srawcon" - function gen_scontext_unlabeled_avc() { - local fifo="$1" - - # Start bash with tor label, then make it invalid, - # and try to do something under the invalid label: - runcon "$INVALID_SCONTEXT" \ - bash -c "cat $fifo > /dev/null; /dev/null" & - semodule -d "$INVALID_SCONTEXT_MODULE" - echo go! >$fifo - wait %1 - semodule -e "$INVALID_SCONTEXT_MODULE" - } - - sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1 - rlRun "mkfifo tmpfifo" 0 - rlRun "gen_scontext_unlabeled_avc tmpfifo" 0 \ - "Generating AVCs with invalid scontext" - check_avcs scontext srawcon "\"$INVALID_SCONTEXT\"" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "setenforce $old_enforce" 0 "Restoring SELinux status" - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/avc_tracepoint/Makefile b/kernel/avc_tracepoint/Makefile deleted file mode 100644 index e266c68..0000000 --- a/kernel/avc_tracepoint/Makefile +++ /dev/null @@ -1,7 +0,0 @@ -# Minimal Makefile for standard-test-roles-beakerlib - -R="RhtsRequires: perf" - -run: - chmod +x runtest.sh - ./runtest.sh diff --git a/kernel/avc_tracepoint/main.fmf b/kernel/avc_tracepoint/main.fmf deleted file mode 100644 index e0794c8..0000000 --- a/kernel/avc_tracepoint/main.fmf +++ /dev/null @@ -1,30 +0,0 @@ -summary: Basic test for SELinux AVC tracepoint support -description: | - Tests basic functionality of the built-in kernel tracepoint for audited - SELinux denials that has been introduced in kernel v5.10. - - See also: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd8166212d9a2eca3181567c953d5687aea4d7dc -contact: Ondrej Mosnacek -component: -- kernel -framework: beakerlib -require: -- perf -duration: 5m -tier: 2 -enabled: true -adjust+: -- enabled: false - when: distro < rhel-8.5 - because: RHEL-8.5 and below are not expected to support this -- enabled: false - when: distro < fedora-35 - because: This feature may not be available in kernels in F34 and below -link: -- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954024 -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail diff --git a/kernel/avc_tracepoint/runtest.sh b/kernel/avc_tracepoint/runtest.sh deleted file mode 100755 index 2700548..0000000 --- a/kernel/avc_tracepoint/runtest.sh +++ /dev/null @@ -1,29 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2021 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" - rlPhaseEnd - - rlPhaseStartTest - rlAssertExists /sys/kernel/tracing/events/avc/selinux_audited/enable - rlRun "perf list | grep avc:selinux_audited" - rlRun "perf record -o perf.data -e avc:selinux_audited -g \ - runcon system_u:system_r:kernel_t:s0 echo" 0-255 - rlRun "perf script -i perf.data" - rlAssertGreater "'perf script' output should have more than 0 lines" \ - "$(perf script -i perf.data | wc -l)" "0" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f perf.data" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf b/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf deleted file mode 100644 index 1d3922d..0000000 --- a/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf +++ /dev/null @@ -1,22 +0,0 @@ -summary: Regression test for bogus WARNING in SELinux -description: | - Verify that selinux_ima_measure_state() doesn't trigger a bogus - lock-related WARN_ON() when the mutex is held by another task. -contact: Ondrej Mosnacek -component: -- kernel -framework: beakerlib -require: -- policycoreutils -duration: 5m -tier: 2 -enabled: true -adjust+: -- enabled: false - when: distro < fedora-36 - because: some kernels on Fedora 35 and below don't have the fix -- enabled: false - when: distro < rhel-9.1 - because: not expected to be fixed earlier than RHEL-9.1 -link: -- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2050966 diff --git a/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh b/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh deleted file mode 100755 index 061b9c7..0000000 --- a/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -function trigger_the_bug() { - while true; do echo 0 > /sys/fs/selinux/checkreqprot; done & - while true; do load_policy; done & - - sleep 15s - - kill $(jobs -p) - wait $(jobs -p) - return 0 -} - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Show the running kernel version" - rlPhaseEnd - - rlPhaseStartTest - rlRun "trigger_the_bug" 0 "Run the reproducer" - rlRun "dmesg | grep -E 'WARNING:.*selinux_ima_measure_state'" 1 \ - "Check that dmesg doesn't contain relevant WARNING lines" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/connect_AF_UNSPEC/main.fmf b/kernel/connect_AF_UNSPEC/main.fmf deleted file mode 100644 index 6cc8d77..0000000 --- a/kernel/connect_AF_UNSPEC/main.fmf +++ /dev/null @@ -1,25 +0,0 @@ -summary: Test connect(AF_UNSPEC) behavior -description: | - Ensure that connect(AF_UNSPEC) (should disconnect a connected socket) - works correctly under SELinux. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - gcc - - nc - - strace -duration: 5m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro ~< rhel-8.1 - because: RHEL-8.0 is not expected to have the bug fixed - - enabled: false - when: distro ~< rhel-7.9 - because: RHEL-7.8 and below are not expected to have the bug fixed -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1707828 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1886305 diff --git a/kernel/connect_AF_UNSPEC/reproducer4.c b/kernel/connect_AF_UNSPEC/reproducer4.c deleted file mode 100644 index def3f57..0000000 --- a/kernel/connect_AF_UNSPEC/reproducer4.c +++ /dev/null @@ -1,46 +0,0 @@ -#include -#include - -#include - -#include -#include -#include -#include - -int main(int argc, char **argv) -{ - int fd; - struct sockaddr_in addr; - struct sockaddr addr_unspec; - - if (argc < 2) - return 2; - - fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); - if (fd < 0) { - perror(argv[0]); - return 1; - } - - addr.sin_family = AF_INET; - addr.sin_port = htons(atoi(argv[1])); - addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); - - if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { - perror(argv[0]); - close(fd); - return 1; - } - - memset(&addr_unspec, 0, sizeof(addr_unspec)); - addr_unspec.sa_family = AF_UNSPEC; - if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) { - perror(argv[0]); - close(fd); - return 1; - } - - close(fd); - return 0; -} diff --git a/kernel/connect_AF_UNSPEC/reproducer6.c b/kernel/connect_AF_UNSPEC/reproducer6.c deleted file mode 100644 index 169ed52..0000000 --- a/kernel/connect_AF_UNSPEC/reproducer6.c +++ /dev/null @@ -1,47 +0,0 @@ -#include -#include - -#include - -#include -#include -#include -#include - -int main(int argc, char **argv) -{ - int fd; - struct sockaddr_in6 addr; - struct sockaddr addr_unspec; - - if (argc < 2) - return 2; - - fd = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP); - if (fd < 0) { - perror(argv[0]); - return 1; - } - - memset(&addr, 0, sizeof(addr)); - addr.sin6_family = AF_INET6; - addr.sin6_port = htons(atoi(argv[1])); - addr.sin6_addr = (struct in6_addr)IN6ADDR_LOOPBACK_INIT; - - if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { - perror(argv[0]); - close(fd); - return 1; - } - - memset(&addr_unspec, 0, sizeof(addr_unspec)); - addr_unspec.sa_family = AF_UNSPEC; - if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) { - perror(argv[0]); - close(fd); - return 1; - } - - close(fd); - return 0; -} diff --git a/kernel/connect_AF_UNSPEC/runtest.sh b/kernel/connect_AF_UNSPEC/runtest.sh deleted file mode 100755 index 99f4ed2..0000000 --- a/kernel/connect_AF_UNSPEC/runtest.sh +++ /dev/null @@ -1,39 +0,0 @@ -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -EXE4="reproducer4" -EXE6="reproducer6" -PORT=8000 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print running kernel version" - - rlRun "gcc -o $EXE4 reproducer4.c" 0 "Compile the IPv4 reproducer" - rlRun "gcc -o $EXE6 reproducer6.c" 0 "Compile the IPv6 reproducer" - rlRun "nc -4lk $PORT &" 0 "Start IPv4 server" - rlRun "nc -6lk $PORT &" 0 "Start IPv6 server" - rlPhaseEnd - - rlPhaseStartTest "IPv4" - rlRun "strace ./$EXE4 $PORT" 0 "Run the IPv4 reproducer" - rlPhaseEnd - - rlPhaseStartTest "IPv6" - rlRun "strace ./$EXE6 $PORT" 0 "Run the IPv6 reproducer" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f $EXE4" 0 "Removing the IPv4 reproducer binary" - rlRun "rm -f $EXE6" 0 "Removing the IPv6 reproducer binary" - rlRun "kill %1" 0 "Kill the IPv4 server" - rlRun "kill %2" 0 "Kill the IPv6 server" - rlRun "wait $(jobs -p | tr '\n' ' ')" 0,143 "Wait for the servers to terminate" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/fanotify-mark-anon-pipe/.gitignore b/kernel/fanotify-mark-anon-pipe/.gitignore deleted file mode 100644 index 6263bf3..0000000 --- a/kernel/fanotify-mark-anon-pipe/.gitignore +++ /dev/null @@ -1 +0,0 @@ -reproducer diff --git a/kernel/fanotify-mark-anon-pipe/main.fmf b/kernel/fanotify-mark-anon-pipe/main.fmf deleted file mode 100644 index da7a540..0000000 --- a/kernel/fanotify-mark-anon-pipe/main.fmf +++ /dev/null @@ -1,21 +0,0 @@ -summary: Verify no invalid denials for fanotify_mark() on an anonymous pipe -description: | - Verify that calling fanotify_mark() on an anonymous pipe just fails - with EINVAL and doesn't fail on SELinux checks earlier. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - gcc -duration: 5m -tier: 2 -check: - - how: avc -enabled: true -adjust+: - - enabled: false - when: distro < rhel-9 - because: On RHEL-8 fanotify mark is allowed on anonymous pipes. -link: - - verifies: https://issues.redhat.com/browse/RHEL-53850 diff --git a/kernel/fanotify-mark-anon-pipe/reproducer.c b/kernel/fanotify-mark-anon-pipe/reproducer.c deleted file mode 100644 index c55b17d..0000000 --- a/kernel/fanotify-mark-anon-pipe/reproducer.c +++ /dev/null @@ -1,66 +0,0 @@ -/* SPDX-License-Identifier: GPLv2 */ -/* Copyright (c) 2026 Red Hat, Inc. */ -/* Author: Ondrej Mosnacek */ - -#define _GNU_SOURCE - -#include -#include -#include - -#include -#include - -#include - -int main(int argc, char **argv) -{ - int ffd, ret, rc, pfd[2]; - - ret = pipe2(pfd, O_CLOEXEC); - if (ret == -1) { - perror("pipe2"); - rc = 2; - goto exit; - } - - ffd = fanotify_init(FAN_CLASS_NOTIF, O_RDONLY); - if (ffd == -1) { - perror("fanotify_init"); - rc = 2; - goto exit_close_pipes; - } - - rc = 0; - - ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MOUNT, FAN_ACCESS, - pfd[0], NULL); - if (ret == 0) { - printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT succeeded\n"); - rc = 1; - } else if (errno == EINVAL) { - printf("PASS: fanotify_mark() with FAN_MARK_MOUNT failed with EINVAL as expected\n"); - } else { - printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT failed with %s\n", strerror(errno)); - rc = 1; - } - - ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_FILESYSTEM, FAN_ACCESS, - pfd[0], NULL); - if (ret == 0) { - printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM succeeded\n"); - rc = 1; - } else if (errno == EINVAL) { - printf("PASS: fanotify_mark() with FAN_MARK_FILESYSTEM failed with EINVAL as expected\n"); - } else { - printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM failed with %s\n", strerror(errno)); - rc = 1; - } - - close(ffd); -exit_close_pipes: - close(pfd[0]); - close(pfd[1]); -exit: - return rc; -} diff --git a/kernel/fanotify-mark-anon-pipe/runtest.sh b/kernel/fanotify-mark-anon-pipe/runtest.sh deleted file mode 100755 index 16075eb..0000000 --- a/kernel/fanotify-mark-anon-pipe/runtest.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2026 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print kernel version" - - rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer" - rlPhaseEnd - - rlPhaseStartTest - rlRun "./reproducer" 0 "Run the reproducer" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f reproducer" 0 "Delete the reproducer binary" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/genfs_fallback/Makefile b/kernel/genfs_fallback/Makefile deleted file mode 100644 index 7abf97c..0000000 --- a/kernel/genfs_fallback/Makefile +++ /dev/null @@ -1,7 +0,0 @@ -# Minimal Makefile for standard-test-roles-beakerlib - -R="RhtsRequires: policycoreutils" - -run: - chmod +x runtest.sh - ./runtest.sh diff --git a/kernel/genfs_fallback/main.fmf b/kernel/genfs_fallback/main.fmf deleted file mode 100644 index c83e5a9..0000000 --- a/kernel/genfs_fallback/main.fmf +++ /dev/null @@ -1,29 +0,0 @@ -summary: Test genfscon fallback for fs_use_xattr when no xattr support -description: | - Test that a fs_use_xattr filesystem mount falls back to genfscon when it - doesn't have xattr support. - - See also: - https://lore.kernel.org/selinux/CAFqZXNsGabHBfV36nNAVLJgEzjkBev-O3YZ1vnmXyVoaDdjiHQ@mail.gmail.com/T/ - https://lore.kernel.org/selinux/20210113123802.63563-1-omosnace@redhat.com/ -contact: Ondrej Mosnacek -component: -- kernel -framework: beakerlib -require: -- policycoreutils -- dosfstools -duration: 5m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-8.5 - because: RHEL-8.5 and below are not expected to support this - - enabled: false - when: distro < fedora-35 - because: This feature may not be supported on kernels in F34 and below -link: -- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1899703 -- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915825 -- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1937297 diff --git a/kernel/genfs_fallback/runtest.sh b/kernel/genfs_fallback/runtest.sh deleted file mode 100755 index 3b9372a..0000000 --- a/kernel/genfs_fallback/runtest.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2021 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" - - rlRun "dd if=/dev/zero of=diskfile bs=4M count=1" - rlRun "mkfs.vfat diskfile" - DEVICE="$(losetup -f)" - rlRun "losetup $DEVICE diskfile" - - rlRun "echo '(fsuse xattr vfat (system_u object_r fs_t ((s0) (s0))))' >vfat_xattr.cil" - rlRun "semodule -i vfat_xattr.cil" - rlRun "mkdir /mnt/test-vfat" - rlPhaseEnd - - rlPhaseStartTest - rlRun "mount -t vfat $DEVICE /mnt/test-vfat" - rlRun "[ \"\$(secon -t -f /mnt/test-vfat)\" = dosfs_t ]" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "umount /mnt/test-vfat" 0-1 - rlRun "rmdir /mnt/test-vfat" - rlRun "semodule -r vfat_xattr" 0-1 - rlRun "rm -f vfat_xattr.cil" - - rlRun "losetup -d $DEVICE" 0-1 - rlRun "rm -f diskfile" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/getxattr_read_out_of_bounds/main.fmf b/kernel/getxattr_read_out_of_bounds/main.fmf deleted file mode 100644 index 0a807f2..0000000 --- a/kernel/getxattr_read_out_of_bounds/main.fmf +++ /dev/null @@ -1,26 +0,0 @@ -summary: Reproducer for an out-of-bounds read on getxattr(2) -description: | - Verifies that it is not possible to trigger an out-of-bounds read by - setting the security.selinux xattr to a value containing a null character - and then trying to read back the xattr. - - See also: https://git.kernel.org/torvalds/c/efe3de79e0b5 -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - coreutils - - policycoreutils - - attr -duration: 5m -tier: 2 -enabled: true -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1584307 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1595706 -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail diff --git a/kernel/getxattr_read_out_of_bounds/runtest.sh b/kernel/getxattr_read_out_of_bounds/runtest.sh deleted file mode 100755 index 8ae46c1..0000000 --- a/kernel/getxattr_read_out_of_bounds/runtest.sh +++ /dev/null @@ -1,36 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2018-2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print running kernel version" - rlRun "touch testfile" - reset_enforcing=0 - if [ "$(getenforce)" = "Enforcing" ]; then - rlRun "setenforce 0" 0 "Switch to permissive" - reset_enforcing=1 - fi - rlPhaseEnd - - rlPhaseStartTest - rlRun "setfattr -n security.selinux -v 'a\\0aaaaaaaaaaaaaaaa' testfile" 0 \ - "Try to set a label with a null char in it" - rlRun "getfattr -e hex -n security.selinux testfile" - rlRun "getfattr -e hex -n security.selinux testfile | grep -E '0x6100[0-9a-f]+'" 1 \ - "Check for junk in the output of getfattr" - rlPhaseEnd - - rlPhaseStartCleanup - if [ "$reset_enforcing" -eq 1 ]; then - rlRun "setenforce 1" 0 "Switch back to enforcing" - fi - rlRun "rm -f testfile" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/journald_performance/main.fmf b/kernel/journald_performance/main.fmf deleted file mode 100644 index 310c826..0000000 --- a/kernel/journald_performance/main.fmf +++ /dev/null @@ -1,26 +0,0 @@ -summary: Test journald performance under SELinux -description: | - Regression test for a bug where systemd-journald suffered a terrible - performance overhead due to SELinux. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - perf - - util-linux - - coreutils - - perl-interpreter - - perl-open - - git-core -duration: 30m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-8.3 - because: RHEL-8.2 and below are not expected to have the bug fixed -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1733259 -tag: - - failinfedora diff --git a/kernel/journald_performance/runtest.sh b/kernel/journald_performance/runtest.sh deleted file mode 100755 index a207d54..0000000 --- a/kernel/journald_performance/runtest.sh +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -# Set this parameter to 1 to also generate a flamegraph. -GENERATE_FLAMEGRAPH="${GENERATE_FLAMEGRAPH:-0}" - -FG_URL="https://github.com/brendangregg/FlameGraph" -FG_DIR="FlameGraph" - -TARGET_SYMBOL="security_secid_to_secctx" -LIMIT="10.00%" - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print running kernel version" - - if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then - rlRun "git clone $FG_URL $FG_DIR" - fi - rlPhaseEnd - - rlPhaseStartTest - JOURNALD_PID=$(pidof systemd-journald) - rlLog "PID of systemd-journald is $JOURNALD_PID" - - rlRun "cat /dev/urandom | base64 | logger &" 0 \ - "Flood systemd-journald with data" - rlRun "timeout 30s perf record -o perf.data -p $(pidof systemd-journald) -g --call-graph dwarf" 124 \ - "Capture perf data on systemd-journald" - rlRun "kill %1" - - if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then - rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" - fi - - rlRun "perf report -i perf.data -g none --pretty raw | grep $TARGET_SYMBOL" - PERCENT="$(perf report -g none --pretty raw | grep $TARGET_SYMBOL | \ - grep -Eo '[0-9]+\.[0-9]+%' | head -n 1)" - rlLog "Detected that $TARGET_SYMBOL took up $PERCENT of time (limit $LIMIT)." - rlRun "{ echo \$PERCENT; echo \$LIMIT; } | sort -n | tail -n 1 | grep \$LIMIT" 0 \ - "Check that time usage is within limit" - rlPhaseEnd - - rlPhaseStartCleanup - rlFileSubmit "perf.data" - if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then - rlFileSubmit "flamegraph.svg" - - rlRun "rm -rf $FG_DIR flamegraph.svg" - fi - rlRun "rm -f perf.data" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/keycreate_empty_value/main.fmf b/kernel/keycreate_empty_value/main.fmf deleted file mode 100644 index d0d90da..0000000 --- a/kernel/keycreate_empty_value/main.fmf +++ /dev/null @@ -1,20 +0,0 @@ -summary: Test writing empty value into /proc/self/attr/keycreate -description: | - Verifies that writing an empty value into /proc//attr/keycreate - is allowed. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - policycoreutils - - gcc -duration: 5m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-8.1 - because: RHEL-8.0 and below are not expected to have the bug fixed -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719067 diff --git a/kernel/keycreate_empty_value/reproducer.c b/kernel/keycreate_empty_value/reproducer.c deleted file mode 100644 index fa09608..0000000 --- a/kernel/keycreate_empty_value/reproducer.c +++ /dev/null @@ -1,22 +0,0 @@ -#include -#include -#include -#include -#include - -int main(void) -{ - int fd, r; - - fd = open("/proc/self/attr/keycreate", O_WRONLY); - if (fd < 0) { - perror("open"); - } - - r = write(fd, "", 0); - if (r < 0) { - perror("write"); - } - - return !!r; -} diff --git a/kernel/keycreate_empty_value/runtest.sh b/kernel/keycreate_empty_value/runtest.sh deleted file mode 100755 index d8a0034..0000000 --- a/kernel/keycreate_empty_value/runtest.sh +++ /dev/null @@ -1,37 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -EXE="reproducer" - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print running kernel version" - - enable_container=0 - if semodule -l | grep -q container; then - rlRun "semodule -d container" 0 "Disable the container module" - enable_container=1 - fi - - rlRun "gcc -o $EXE reproducer.c" 0 "Compile the reproducer" - rlPhaseEnd - - rlPhaseStartTest - rlRun "./$EXE" 0 "Run the reproducer" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f $EXE" 0 "Remove the reproducer binary" - - if [ "$enable_container" -eq 1 ]; then - rlRun "semodule -e container" 0 "Re-enable the container module" - fi - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/labeled-cephfs/main.fmf b/kernel/labeled-cephfs/main.fmf index 371ab50..3d3c68e 100644 --- a/kernel/labeled-cephfs/main.fmf +++ b/kernel/labeled-cephfs/main.fmf @@ -5,9 +5,6 @@ description: | This TC verifies that CephFS security label support works as expected. duration: 30m tier: 2 -tag: - - failinfedora - - avoidImageMode -adjust+: +adjust: - enabled: false when: distro < rhel-8 diff --git a/kernel/labeling_before_policy_load/labeldump-expected.txt b/kernel/labeling_before_policy_load/labeldump-expected.txt deleted file mode 100644 index da985b5..0000000 --- a/kernel/labeling_before_policy_load/labeldump-expected.txt +++ /dev/null @@ -1,3 +0,0 @@ -system_u:object_r:etc_t:s0 - -system_u:object_r:etc_t:s0 diff --git a/kernel/labeling_before_policy_load/main.fmf b/kernel/labeling_before_policy_load/main.fmf deleted file mode 100644 index a0b5c9f..0000000 --- a/kernel/labeling_before_policy_load/main.fmf +++ /dev/null @@ -1,29 +0,0 @@ -summary: Test SELinux labeling before initial policy load -description: | - Verifies that reading/writing SELinux labels works before the first policy - load. - - See also: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e3e24b42043eceb97ed834102c2d094dfd7aaa6 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c8e222616c7e98305bdc861db3ccac520bc29921 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9530a3e00459cd6eabf050133205e0e8fecbdfc7 -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - dracut - - coreutils - - policycoreutils - - attr -duration: 30m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-8.3 - because: RHEL-8.2 and below are not expected to support this -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1777525 -tag: - - reboot diff --git a/kernel/labeling_before_policy_load/module-setup.sh b/kernel/labeling_before_policy_load/module-setup.sh deleted file mode 100644 index d76aa67..0000000 --- a/kernel/labeling_before_policy_load/module-setup.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/bash - -# called by dracut -check() { - return 0 -} - -# called by dracut -depends() { - return 0 -} - -# called by dracut -install() { - inst_hook pre-pivot 50 "$moddir/relabel.sh" - inst_multiple setfiles getfattr -} diff --git a/kernel/labeling_before_policy_load/relabel.sh b/kernel/labeling_before_policy_load/relabel.sh deleted file mode 100644 index 18c0cc6..0000000 --- a/kernel/labeling_before_policy_load/relabel.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash - -function dumpcon() { - getfattr --only-values -n security.selinux "$@" | tr -d '\000' - echo -} - -mount -o remount,rw /sysroot -dumpcon /sysroot/etc >/sysroot/etc/labeldump -echo test > /sysroot/etc/testfile -dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump -setfiles -vF -r /sysroot \ - /sysroot/etc/selinux/targeted/contexts/files/file_contexts \ - /sysroot/etc -dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump diff --git a/kernel/labeling_before_policy_load/runtest.sh b/kernel/labeling_before_policy_load/runtest.sh deleted file mode 100755 index a9ec1a5..0000000 --- a/kernel/labeling_before_policy_load/runtest.sh +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -# Beaker compat -if [ -n "$JOBID" ] && [ -n "$TESTID" ]; then - function tmt-reboot() { rstrnt-reboot; } - TMT_REBOOT_COUNT="$REBOOTCOUNT" -fi - -rlJournalStart -if [ $TMT_REBOOT_COUNT -lt 1 ]; then - rlPhaseStartSetup "Setup" - rlRun "uname -r" 0 "Kernel version before reboot" - - rlRun "install -d /usr/lib/dracut/modules.d/97bz1777525" 0 \ - "Install dracut plugin directory for testing" - rlRun "install module-setup.sh relabel.sh /usr/lib/dracut/modules.d/97bz1777525" 0 \ - "Install dracut plugin for testing" - rlRun "dracut -f" 0 "Rebuild the initramfs" - rlRun "grubby --set-default /boot/vmlinuz-$(uname -r)" 0 \ - "Ensure the current booted kernel is the default" - if command -v zipl >/dev/null; then - rlRun "zipl" 0 "Run zipl" - fi - rlPhaseEnd - - rlPhaseStartSetup "Reboot" - tmt-reboot -fi - rlRun "uname -r" 0 "Kernel version after reboot" - rlPhaseEnd - - rlPhaseStartTest "Test" - rlLog "Test writing labels (BZ 1777525)" - rlRun "ls -lZ /etc/testfile" - rlRun "ls -lZ /etc/testfile | grep -qF ':etc_t:'" 0 \ - "Test that /etc/testfile is labeled correctly" - - rlLog "Test reading labels (BZ 1839819)" - rlRun "cat /etc/labeldump" - rlAssertNotDiffer "/etc/labeldump" labeldump-expected.txt - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f /etc/labeldump /etc/testfile" 0 "Remove test files" - rlRun "rm -rf /usr/lib/dracut/modules.d/97bz1777525" 0 \ - "Remove the dracut plugin" - rlRun "dracut -f" 0 "Rebuild the initramfs again" - if command -v zipl >/dev/null; then - rlRun "zipl" 0 "Run zipl" - fi - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/mount-options-memleak/main.fmf b/kernel/mount-options-memleak/main.fmf deleted file mode 100644 index 08dfec9..0000000 --- a/kernel/mount-options-memleak/main.fmf +++ /dev/null @@ -1,19 +0,0 @@ -summary: Mount options memory leak test -description: | - Test that mounting with SELinux mount options doesn't leave behind - memory leaks. -contact: Ondrej Mosnacek -component: -- kernel -framework: beakerlib -duration: 1h -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-7 - because: RHEL-6 and below are not worth supporting by this test -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187402 -tag: - - reboot diff --git a/kernel/mount-options-memleak/runtest.sh b/kernel/mount-options-memleak/runtest.sh deleted file mode 100755 index 8d21797..0000000 --- a/kernel/mount-options-memleak/runtest.sh +++ /dev/null @@ -1,115 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2023 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -# Beaker compat -if [ -n "$JOBID" ] && [ -n "$TESTID" ]; then - function tmt-reboot() { rstrnt-reboot; } - TMT_REBOOT_COUNT="$REBOOTCOUNT" -fi - -function installDepsYum() { - local yum="$1"; shift - - if "$yum" install --help | grep -q -- --skip-unavailable; then - "$yum" install -y --skip-unavailable $* - elif "$yum" install --help | grep -q -- --skip-broken; then - "$yum" install -y --skip-broken $* - else - for req in $*; do - if ! rpm -q --quiet --whatprovides "$req"; then - "$yum" install -y "$req" || true - fi - done - fi -} - -function installDeps() { - if type yum >/dev/null; then - installDepsYum yum "$@" - elif type dnf >/dev/null; then - installDepsYum dnf "$@" - fi -} - -rlJournalStart -if [ $TMT_REBOOT_COUNT -lt 1 ]; then - rlPhaseStartSetup - rlRun "uname -r" 0 "Print initial running kernel version" - - uname="$(uname -r)" - raw_uname="${uname%+*}" - debug_uname="${raw_uname}+debug" - echo "$uname" >"$BEAKERLIB_DIR/orig_uname" - echo "$debug_uname" >"$BEAKERLIB_DIR/debug_uname" - if [ "$uname" = "$debug_uname" ]; then - rlLog "Already running the debug kernel, nice!" - else - rlLog "Install and boot the debug kernel" - - rlRun "installDeps kernel-debug-$raw_uname" - rlRun "grubby --set-default /boot/vmlinuz-$debug_uname" - fi - - rlRun "grubby --update-kernel /boot/vmlinuz-$debug_uname --args kmemleak=on" 0 \ - "Enable kmemleak on the debug kernel" - if command -v zipl >/dev/null; then - rlRun "zipl" 0 "Run zipl" - fi - tmt-reboot -fi -if [ $TMT_REBOOT_COUNT -lt 2 ]; then - rlRun "uname -r" 0 "Print running kernel version after reboot" - rlRun "cat /proc/cmdline" 0 "Print kernel cmdline after reboot" - - rlRun "mkdir -p /mnt/test_mount" 0 \ - "Create a directory for the test mount" - rlPhaseEnd - - rlPhaseStartTest - rlRun "echo clear > /sys/kernel/debug/kmemleak" 0 \ - "Clear the kmemleak buffer" - - rlRun "mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0 tmpfs /mnt/test_mount" 0 \ - "Do a context mount" - rlRun "umount /mnt/test_mount" 0 \ - "Unmount the context mount" - - # For whatever reason this needs to be run twice... - rlRun "echo scan > /sys/kernel/debug/kmemleak" 0 \ - "Trigger a kmemleak scan" - rlRun "cat /sys/kernel/debug/kmemleak >/dev/null" 0 \ - "Dump the kmemleak buffer once" - rlRun "echo scan > /sys/kernel/debug/kmemleak" 0 \ - "Trigger a second kmemleak scan" - - rlLog "Check that /sys/kernel/debug/kmemleak is empty" - rlAssertNotDiffer /sys/kernel/debug/kmemleak /dev/null - rlRun "cat /sys/kernel/debug/kmemleak" 0 \ - "Dump the kmemleak buffer" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rmdir /mnt/test_mount" 0 \ - "Remove the directory for the test mount" - uname="$(cat "$BEAKERLIB_DIR/orig_uname")" - debug_uname="$(cat "$BEAKERLIB_DIR/debug_uname")" - rlRun "grubby --update-kernel /boot/vmlinuz-$debug_uname --remove-args kmemleak=on" 0 \ - "Undo kmemleak enabling" - rlRun "grubby --set-default /boot/vmlinuz-$uname" 0 \ - "Switch the default back to the initial kernel version" - if command -v zipl >/dev/null; then - rlRun "zipl" 0 "Run zipl" - fi - tmt-reboot -fi - rlRun "uname -r" 0 \ - "Print running kernel version after cleanup reboot" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/netlabel-leaves-nops-in-packets/main.fmf b/kernel/netlabel-leaves-nops-in-packets/main.fmf deleted file mode 100644 index 7d13bb0..0000000 --- a/kernel/netlabel-leaves-nops-in-packets/main.fmf +++ /dev/null @@ -1,21 +0,0 @@ -summary: Netlabel shouldn't leave NOPs in IP options when removing the CIPSO option -description: | - Test that seeting netlabel to unlabeled doesn't just overwrite CIPSO - options with NOPs, but actually removes them. Some routers may drop - packets with IP options, so this is important. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -duration: 15m -tier: 2 -require: - - gcc - - netlabel_tools -enabled: true -adjust+: - - enabled: false - when: distro < rhel-7 - because: RHEL-6 and below are not worth supporting by this test -link: - - verifies: https://issues.redhat.com/browse/RHEL-30904 diff --git a/kernel/netlabel-leaves-nops-in-packets/reproducer.c b/kernel/netlabel-leaves-nops-in-packets/reproducer.c deleted file mode 100644 index f3ecb69..0000000 --- a/kernel/netlabel-leaves-nops-in-packets/reproducer.c +++ /dev/null @@ -1,179 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 -/* - * A reproducer that checks that CIPSO options are cleared properly - * by NetLabel when it is configured to send unabeled traffic. - * - * Copyright (c) 2024 Red Hat, Inc. - * Author: Ondrej Mosnacek - */ -#include -#include -#include - -#include -#include -#include - -int run_test(int csock, int ssock, const struct addrinfo *clientinfo, - int tnum, size_t expected_opt_length) -{ - char byte; - struct iovec iov; - struct msghdr msg; - struct cmsghdr *cmsg; - union { - struct cmsghdr cmsghdr; - char buf[CMSG_SPACE(256)]; - } control; - int ret, i, result; - - printf("TEST #%i\n", tnum); - - byte = 0; - ret = sendto(csock, &byte, 1, 0, clientinfo->ai_addr, clientinfo->ai_addrlen); - if (ret < 0) { - perror("sendto"); - exit(2); - } - - memset(&iov, 0, sizeof(iov)); - iov.iov_base = &byte; - iov.iov_len = 1; - memset(&msg, 0, sizeof(msg)); - msg.msg_iov = &iov; - msg.msg_iovlen = 1; - msg.msg_control = &control; - msg.msg_controllen = sizeof(control); - ret = recvmsg(ssock, &msg, 0); - if (ret < 0) { - perror("recvmsg"); - exit(2); - } - for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; - cmsg = CMSG_NXTHDR(&msg, cmsg)) { - if (cmsg->cmsg_level != SOL_IP || - cmsg->cmsg_type != IP_RECVOPTS) - continue; - - if (cmsg->cmsg_len - sizeof(struct cmsghdr) > 0) { - printf(" options: "); - for (i = 0; i < cmsg->cmsg_len - sizeof(struct cmsghdr); i++) { - printf("%02x ", (unsigned)(CMSG_DATA(cmsg)[i])); - } - printf("\n"); - result = expected_opt_length == cmsg->cmsg_len - sizeof(struct cmsghdr); - goto done; - } - } - printf(" no IP options\n"); - result = expected_opt_length == 0; - -done: - if (result) - printf(" PASS\n"); - else - printf(" FAIL\n"); - return result; -} - -int main(int argc, char **argv) -{ - static const unsigned char TEST_OPTION[] = { - 1, // NOP - 158, // option type - Experimental - 5, // option length - 0x12, 0x34, 0x56, // dummy data - 1, // NOP - 134, // option type - CIPSO - 11, // option length - 0, 0, 0, 16, // DOI - 1, // tag type 1 - 5, // tag length - 0, // alignment octet - 1, // sensitivity - 0xff, // bitmap of categories - 1, // NOP - 158, // option type - Experimental - 5, // option length - 0x12, 0x34, 0x56, // dummy data - }; - static const size_t TEST_OPTION_CIPSO_OFF = 7; - static const size_t TEST_OPTION_CIPSO_LEN = 11; - - int ret, result, csock, ssock, on = 1; - struct addrinfo hints, *serverinfo, *clientinfo; - - if (argc != 3) { - fprintf(stderr, "need 2 arguments!\n"); - exit(2); - } - - memset(&hints, 0, sizeof(struct addrinfo)); - - hints.ai_family = AF_INET; - hints.ai_socktype = SOCK_DGRAM; - hints.ai_protocol = IPPROTO_UDP; - - ret = getaddrinfo(argv[1], argv[2], &hints, &clientinfo); - if (ret < 0) { - fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret)); - exit(2); - } - - ret = getaddrinfo(NULL, argv[2], &hints, &serverinfo); - if (ret < 0) { - fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret)); - exit(2); - } - - csock = socket(clientinfo->ai_family, clientinfo->ai_socktype, - IPPROTO_UDP); - if (csock < 0) { - perror("client socket"); - exit(2); - } - - ssock = socket(serverinfo->ai_family, serverinfo->ai_socktype, - IPPROTO_UDP); - if (ssock < 0) { - perror("server socket"); - exit(2); - } - - ret = setsockopt(ssock, SOL_IP, IP_RECVOPTS, &on, sizeof(on)); - if (ret < 0) { - perror("server setsockopt: IP_RECVOPTS"); - exit(2); - } - - if (bind(ssock, serverinfo->ai_addr, serverinfo->ai_addrlen) < 0) { - perror("server bind"); - exit(2); - } - - result = 1; - - /* TEST 1 - only CIPSO */ - ret = setsockopt(csock, SOL_IP, IP_OPTIONS, - TEST_OPTION + TEST_OPTION_CIPSO_OFF, - TEST_OPTION_CIPSO_LEN); - if (ret < 0) { - perror("client setsockopt: IP_OPTIONS"); - exit(2); - } - if (!run_test(csock, ssock, clientinfo, 1, 0)) - result = 0; - - /* TEST 2 - CIPSO surrounded by other options */ - ret = setsockopt(csock, SOL_IP, IP_OPTIONS, - TEST_OPTION, sizeof(TEST_OPTION)); - if (ret < 0) { - perror("client setsockopt: IP_OPTIONS"); - exit(2); - } - if (!run_test(csock, ssock, clientinfo, 2, - (sizeof(TEST_OPTION) - TEST_OPTION_CIPSO_LEN) + 3) & 3) - result = 0; - - return result ? 0 : 1; -} diff --git a/kernel/netlabel-leaves-nops-in-packets/runtest.sh b/kernel/netlabel-leaves-nops-in-packets/runtest.sh deleted file mode 100755 index 8a25ff8..0000000 --- a/kernel/netlabel-leaves-nops-in-packets/runtest.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPL-2.0 -# Copyright (c) 2024 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "gcc -o reproducer reproducer.c" 0 "Build the reproducer" - - rlRun "netlabelctl cipsov4 add pass doi:16 tags:1" 0 - rlRun "netlabelctl map del default" 0 - rlRun "netlabelctl map add default address:0.0.0.0/0 protocol:unlbl" 0 - rlRun "netlabelctl map add default address:::/0 protocol:unlbl" 0 - rlPhaseEnd - - rlPhaseStartTest - rlRun "./reproducer 127.0.0.1 9999" 0 "Run the reproducer" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f reproducer" 0 "Remove the reproducer binary" - - rlRun "netlabelctl map del default" 0 - rlRun "netlabelctl cipsov4 del doi:16" 0 - rlRun "netlabelctl map add default protocol:unlbl" 0 - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/netlabel_many_ifaces/main.fmf b/kernel/netlabel_many_ifaces/main.fmf index cfb456e..4fbbffe 100644 --- a/kernel/netlabel_many_ifaces/main.fmf +++ b/kernel/netlabel_many_ifaces/main.fmf @@ -12,7 +12,7 @@ require: duration: 5m tier: 2 enabled: true -adjust+: - - enabled: false - when: distro < rhel-8.4 - because: not fixed below RHEL 8.4... +adjust: + enabled: false + when: distro < rhel-7 + because: RHEL-6 and below is too old... diff --git a/kernel/ocontext-race/Makefile b/kernel/ocontext-race/Makefile deleted file mode 100644 index 966ae43..0000000 --- a/kernel/ocontext-race/Makefile +++ /dev/null @@ -1,6 +0,0 @@ -# Minimal Makefile for standard-test-roles-beakerlib - -R="RhtsRequires: attr" -run: - chmod +x runtest.sh - ./runtest.sh diff --git a/kernel/ocontext-race/main.fmf b/kernel/ocontext-race/main.fmf deleted file mode 100644 index 93b7423..0000000 --- a/kernel/ocontext-race/main.fmf +++ /dev/null @@ -1,27 +0,0 @@ -summary: Regression test for ocontext kernel structure race condition -description: | - Test that a race condition around the kernel's ocontext structures - doesn't cause an incorrect label to be assigned to files/mounts. -contact: Ondrej Mosnacek -component: -- kernel -framework: beakerlib -require: -- attr -duration: 15m -tier: 2 -enabled: true -adjust+: -- enabled: false - when: distro < rhel-7 - because: RHEL-6 and below are not worth supporting by this test -- enabled: false - when: arch = s390x - because: No machines likely available with required HW configuration -extra-hardware: | - keyvalue = PROCESSORS >= 4 -link: -- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1969344 -- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2040196 -tag: - - avoidImageMode diff --git a/kernel/ocontext-race/runtest.sh b/kernel/ocontext-race/runtest.sh deleted file mode 100755 index b7f49ca..0000000 --- a/kernel/ocontext-race/runtest.sh +++ /dev/null @@ -1,74 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PREFIX=/tmp/repro- -NTHREADS=8 -TRIALS=20 - -function get_file_con() { - getfattr -h --absolute-names --only-values -n security.selinux "$1" | tr -d '\000' -} - -function strip_mls() { - # strip the MLS -- mcstrans might be running, leading to different MLS - # fields than expected - sed 's/\([^:]*:[^:]*:[^:]*\):.*$/\1/g' -} - -function check_file_con() { - rlAssertEquals "Check expected context of $1" \ - "$(get_file_con "$1" | strip_mls)" \ - "$(echo "$2" | strip_mls)" -} - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" - - rlRun "test \$(nproc) -ge 4" 0 "Test needs an SMP machine, otherwise it may pass regardless of the bug" - - rlRun "tmpdir=\$(mktemp -d)" 0 "Create a temporary directory" - - prefix="$tmpdir/repro-" - - for (( i = 0; i < $NTHREADS; i++ )); do - rlRun "mkdir -p \"\${PREFIX}$i\"" 0 "Create subdirectory #$i" - done - rlPhaseEnd - -for (( k = 0; k < $TRIALS; k++ )); do - rlPhaseStartTest "Trial #$k" - rlRun "load_policy" 0 "Reload SELinux policy to reset internal state" - - # NOTE: this must be ran in a single rlRun, otherwise beakerlib - # overhead decreases the chance of a race condition - rlRun " - for (( i = 0; i < $NTHREADS; i++)); do - mount -t tmpfs tmpfs \"\${PREFIX}\$i\" & - done - wait - " 0 "Create $NTHREADS tmpfs mounts at once" - - for (( i = 0; i < $NTHREADS; i++)); do - rlRun "touch \"\${PREFIX}$i/file\"" 0 "Create a file in dir #$i" - check_file_con "$PREFIX$i" "unconfined_u:object_r:user_tmp_t" - check_file_con "$PREFIX$i/file" "unconfined_u:object_r:user_tmp_t" - done - - for (( i = 0; i < $NTHREADS; i++)); do - rlRun "umount \"\${PREFIX}$i\" &" 0 "Unmount dir #$i" - done - rlPhaseEnd -done - - rlPhaseStartCleanup - rlRun "rm -rf \$tmpdir" 0 "Clean up the temporary directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/overlayfs-mmap-bugs/main.fmf b/kernel/overlayfs-mmap-bugs/main.fmf deleted file mode 100644 index 8ff2402..0000000 --- a/kernel/overlayfs-mmap-bugs/main.fmf +++ /dev/null @@ -1,27 +0,0 @@ -summary: Regression test for overlayfs mmap/mprotect bugs -description: | - Tests various scenarios with overlayfs and mmap/mprotect syscalls. - This also covers CVE-2026-46054. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - selinux-policy-devel - - gcc -duration: 5m -tier: 2 -enabled: true -link: - - verifies: https://redhat.atlassian.net/browse/RHEL-127505 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-46054 - - verifies: https://redhat.atlassian.net/browse/RHEL-185115 - - verifies: https://redhat.atlassian.net/browse/RHEL-185117 - - verifies: https://redhat.atlassian.net/browse/RHEL-185118 -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail -extra-nitrate: TC#0620043 -id: 2ee56bc8-01f3-4b77-8cdb-494ad9a12451 diff --git a/kernel/overlayfs-mmap-bugs/map_access.c b/kernel/overlayfs-mmap-bugs/map_access.c deleted file mode 100644 index 0bd4530..0000000 --- a/kernel/overlayfs-mmap-bugs/map_access.c +++ /dev/null @@ -1,75 +0,0 @@ -#include -#include - -#include - -#include -#include -#include - -int main(int argc, const char **argv) -{ - const char *file, *context; - void *ptr; - int rdonly, execmem, flags, prot, fd, ctxfd, ret; - - if (argc < 4 || argc > 5 || - (strcmp(argv[2], "RDONLY") && strcmp(argv[2], "RDWR")) || - (strcmp(argv[3], "SHARED") && strcmp(argv[3], "PRIVATE")) - ) { - fprintf(stderr, "Usage %s RDONLY|RDWR\n", argv[0]); - return EINVAL; - } - - file = argv[1]; - rdonly = strcmp(argv[2], "RDONLY") == 0; - execmem = strcmp(argv[3], "PRIVATE") == 0; - flags = strcmp(argv[3], "PRIVATE") == 0 ? MAP_PRIVATE : MAP_SHARED; - prot = PROT_READ | (!rdonly || execmem ? PROT_WRITE : 0) | (execmem ? PROT_EXEC : 0); - context = argc >= 5 ? argv[4] : NULL; - - fd = open(file, rdonly ? O_RDONLY : O_RDWR); - if (fd == -1) { - perror("open"); - return 2; - } - - /* try direct mmap */ - ptr = mmap(NULL, 1, prot, flags, fd, 0); - if (ptr == MAP_FAILED) { - perror("mmap"); - return 3; - } - munmap(ptr, 1); - - /* try mmap with PROT_NONE followed by mprotect with full access */ - ptr = mmap(NULL, 1, PROT_NONE, flags, fd, 0); - if (ptr == MAP_FAILED) { - perror("mmap PROT_NONE"); - return 4; - } - - if (context) { - ctxfd = open("/proc/self/attr/current", O_RDWR); - if (ctxfd == -1) { - perror("open"); - return 6; - } - ret = write(ctxfd, context, strlen(context)); - if (ret == -1) { - perror("write"); - return 7; - } - close(ctxfd); - } - - ret = mprotect(ptr, 1, prot); - if (ret == -1) { - perror("mprotect"); - return 5; - } - - munmap(ptr, 1); - close(fd); - return 0; -} diff --git a/kernel/overlayfs-mmap-bugs/runtest.sh b/kernel/overlayfs-mmap-bugs/runtest.sh deleted file mode 100755 index 1cb3ab0..0000000 --- a/kernel/overlayfs-mmap-bugs/runtest.sh +++ /dev/null @@ -1,83 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPL-2.0 -# Copyright (c) 2025 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print current running kernel version" - - SE_USER="$(secon -u --pid $$)" - SE_ROLE="$(secon -r --pid $$)" - SE_TYPE="$(secon -t --pid $$)" - SE_MLS="$(secon -m --pid $$)" - - OVERLAYCON="$SE_USER:object_r:test_mountedfile_t:s0" - DYNTRANSCON="$SE_USER:$SE_ROLE:test_access_exploit_t:$SE_MLS" - - rlRun "gcc -o map_access map_access.c" 0 \ - "Build the test program" - rlRun "chcon -t bin_t map_access" 0 "Relabel the test program" - rlRun "make -f /usr/share/selinux/devel/Makefile test_policy.pp M4PARAM='-D TEST_ROLE=$SE_ROLE -D TEST_TYPE=$SE_TYPE'" 0 \ - "Build the test policy" - rlRun "semodule -i test_policy.pp" 0 "Load test policy" - - rlRun "mkdir lowerdir upperdir workdir mountpoint" 0 "Create test dirs" - rlRun "touch lowerdir/file_ok lowerdir/file_no_map lowerdir/file_no_read lowerdir/file_no_write" 0 \ - "Create test files" - rlRun "chcon -R -t test_lowerfile_t lowerdir workdir upperdir" - rlRun "chcon -t test_lowerfile_no_map_t lowerdir/file_no_map" - rlRun "chcon -t test_lowerfile_no_write_t lowerdir/file_no_write" - rlRun "chcon -t test_lowerfile_no_read_t lowerdir/file_no_read" - - rlRun "runcon -t test_mounter_t mount -t overlay none -o 'context=$OVERLAYCON,lowerdir=./lowerdir,upperdir=./upperdir,workdir=./workdir' ./mountpoint" 0 \ - "Mount the overlay filesystem" - - rlRun ":>/var/log/audit/audit.log; rm -f /var/log/audit/audit.log.*" 0 \ - "Clear the audit log" - rlPhaseEnd - - rlPhaseStartTest "CVE-2026-46054" - # Bug 1 - # Should get below AVC: - # avc: denied { map } for scontext=...test_mounter_t... tcontext=...test_lowerfile_no_map_t... tclass=file - rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_no_map RDONLY SHARED" 3 "Test Bug 1" - - # Bug 2, result 1 - # Shouldn't get below AVC: - # avc: denied { use } for scontext=...test_access_full_t... tcontext=...test_mounter_t... tclass=fd - rlRun "setsebool domain_fd_use 0" - rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED" 0 "Test Bug 2, result 1" - rlRun "setsebool domain_fd_use 1" - - # Bug 2, result 2 - # Shouldn't get below AVC: - # avc: denied { read } for scontext=...test_access_full_t... tcontext=...test_lowerfile_t... tclass=file - rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED" 0 "Test Bug 2, result 2" - - # Bug 2, result 3 - # Should get below AVC: - # avc: denied { read } for scontext=...test_access_exploit_t... tcontext=...test_mountedfile_t... tclass=file - rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED $DYNTRANSCON" 5 "Test Bug 2, result 3" - rlPhaseEnd - - rlPhaseStartTest "execmem regression" - rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY PRIVATE" 0 "Verify no execmem denied" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "ausearch -i -m avc" 0 "Show AVC denials" - - rlRun "umount ./mountpoint" - rlRun "rm -rf lowerdir upperdir workdir mountpoint" - rlRun "semodule -r test_policy" 0 "Unload test policy" - rlRun "make -f /usr/share/selinux/devel/Makefile clean" 0 \ - "Clean the test policy" - rlRun "rm -f map_access" 0 "Remove the test program" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/overlayfs-mmap-bugs/test_policy.te b/kernel/overlayfs-mmap-bugs/test_policy.te deleted file mode 100644 index 73f05cc..0000000 --- a/kernel/overlayfs-mmap-bugs/test_policy.te +++ /dev/null @@ -1,106 +0,0 @@ -policy_module(test_policy,1.0.0) - -type test_lowerfile_t; -files_type(test_lowerfile_t) - -type test_lowerfile_no_map_t; -files_type(test_lowerfile_no_map_t) - -type test_lowerfile_no_write_t; -files_type(test_lowerfile_no_write_t) - -type test_lowerfile_no_read_t; -files_type(test_lowerfile_no_read_t) - -type test_mountedfile_t; -files_type(test_mountedfile_t) - -type test_mounter_t; -domain_type(test_mounter_t) - -allow test_mounter_t self:capability { sys_admin dac_read_search dac_override }; - -# test_mounter_t has full access to test_lowerfile_t -manage_dirs_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) -manage_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) -manage_chr_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) -allow test_mounter_t test_lowerfile_t:file map; -# extra permission for execmem regression test -allow test_mounter_t test_lowerfile_t:file { execute }; - -# test_mounter_t can't map test_lowerfile_t -rw_files_pattern(test_mounter_t, test_lowerfile_no_map_t, test_lowerfile_no_map_t) - -# test_mounter_t can't write test_lowerfile_no_write_t -read_files_pattern(test_mounter_t, test_lowerfile_no_write_t, test_lowerfile_no_write_t) -allow test_mounter_t test_lowerfile_no_write_t:file map; - -# test_mounter_t can't read test_lowerfile_no_read_t -write_files_pattern(test_mounter_t, test_lowerfile_no_read_t, test_lowerfile_no_read_t) -allow test_mounter_t test_lowerfile_no_read_t:file map; - -allow test_mounter_t test_mountedfile_t:dir { getattr setattr }; -allow test_mounter_t test_mountedfile_t:filesystem { relabelfrom relabelto mount }; - -kernel_read_system_state(test_mounter_t) -kernel_read_proc_symlinks(test_mounter_t) -kernel_request_load_module(test_mounter_t) -kernel_search_proc(test_mounter_t) - -fs_getattr_xattr_fs(test_mounter_t) -fs_relabelfrom_xattr_fs(test_mounter_t) - -mount_entry_type(test_mounter_t) -mount_rw_pid_files(test_mounter_t) - -selinux_getattr_fs(test_mounter_t) - -files_mounton_all_mountpoints(test_mounter_t) - -# Domain with full mountedfile access -type test_access_full_t; -domain_type(test_access_full_t) - -manage_dirs_pattern(test_access_full_t, test_mountedfile_t, test_mountedfile_t) -manage_files_pattern(test_access_full_t, test_mountedfile_t, test_mountedfile_t) -allow test_access_full_t test_mountedfile_t:file map; - -corecmd_bin_entry_type(test_access_full_t) - -# Domain with lowerfile access, but no mountedfile access (exploiting Bug 2) -type test_access_exploit_t; -domain_type(test_access_exploit_t) - -manage_files_pattern(test_access_exploit_t, test_lowerfile_t, test_lowerfile_t) - -corecmd_bin_entry_type(test_access_exploit_t) - -# for dyntransition test_access_full_t -> test_access_exploit_t -allow test_access_full_t self:process { setcurrent }; -allow test_access_full_t test_access_exploit_t:process { dyntransition }; - -# extra permissions for execmem regression test -allow test_access_full_t test_mountedfile_t:file { execute }; -allow test_access_full_t self:process { execmem }; - -attribute test_domain; -typeattribute test_mounter_t test_domain; -typeattribute test_access_full_t test_domain; -typeattribute test_access_exploit_t test_domain; - -require { - type TEST_TYPE; - role TEST_ROLE; -} -allow TEST_TYPE test_domain:process transition; -role TEST_ROLE types test_domain; - -allow test_domain TEST_TYPE:fd use; -allow test_domain TEST_TYPE:fifo_file rw_inherited_fifo_file_perms; -allow test_domain TEST_TYPE:process { sigchld }; - -files_search_tmp(test_domain) - -term_use_all_terms(test_domain) - -userdom_search_user_tmp_dirs(test_domain) diff --git a/kernel/policy_load_enomem_on_new_context/main.fmf b/kernel/policy_load_enomem_on_new_context/main.fmf deleted file mode 100644 index 0f69dae..0000000 --- a/kernel/policy_load_enomem_on_new_context/main.fmf +++ /dev/null @@ -1,17 +0,0 @@ -summary: Test that creating a new SELinux context doesn't fail during policy load -description: | - Verifies that there are no ENOMEM errors when the kernel encounters a new - SELinux context during a policy load. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - policycoreutils - - diffutils -duration: 10m -tier: 2 -enabled: true -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1335986 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1656787 diff --git a/kernel/policy_load_enomem_on_new_context/runtest.sh b/kernel/policy_load_enomem_on_new_context/runtest.sh deleted file mode 100755 index a6c7196..0000000 --- a/kernel/policy_load_enomem_on_new_context/runtest.sh +++ /dev/null @@ -1,36 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2019-2022 Red Hat, Inc. -# Author: Milos Malik - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print running kernel version" - rlPhaseEnd - - rlPhaseStartTest "bz#1335986 + bz#1656787" - rlRun "dmesg > before.txt" - rlRun "while true; do load_policy; sleep 0.1; done &" 0 \ - "Start reloading the policy in a loop" - - function runcon_loop() { - for (( i = 0; i < 1024; i++ )); do - runcon -l s0:c$i true || return 1 - done - return 0 - } - rlRun "runcon_loop" 0 "Run runcon in a loop with varying contexts" - rlRun "dmesg > after.txt" - rlRun "diff before.txt after.txt | grep -e inode_doinit_with_dentry -e context_to_sid" 1 - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "kill \$(jobs -p)" 0 "Terminate background jobs" - rlRun "wait" 0 "Wait for background jobs to terminate" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/sctp_peeloff_corner_case/main.fmf b/kernel/sctp_peeloff_corner_case/main.fmf deleted file mode 100644 index 68b07e7..0000000 --- a/kernel/sctp_peeloff_corner_case/main.fmf +++ /dev/null @@ -1,25 +0,0 @@ -summary: Verify that two-way SCTP association setup doesn't trigger AVCs -description: | - When two SCTP endpoints try to initiate an association - simultaneously with each other, they may hit various corner cases. - This test verifies that this scenario works correctly and that the - resulting association is properly labeled (by peeling it off, which - transfers the label onto the new socket). -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - make - - gcc - - lksctp-tools-devel - - audit -duration: 10m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-8 - because: RHEL-7 and below don't have SCTP SELinux support -link: - - verifies: https://issues.redhat.com/browse/RHEL-48647 diff --git a/kernel/sctp_peeloff_corner_case/reproducer.c b/kernel/sctp_peeloff_corner_case/reproducer.c deleted file mode 100644 index de6cedb..0000000 --- a/kernel/sctp_peeloff_corner_case/reproducer.c +++ /dev/null @@ -1,187 +0,0 @@ -// SPDX-License-Identifier: GPLv2 -/* - * Copyright (c) 2024 Red Hat, Inc. - * Author: Ondrej Mosnacek - */ - -#include -#include -#include -#include -#include -#include -#include -#include - -#include -#include -#include -#include -#include - -static const char * const TEST_PORTS[] = { "9998", "9999" }; - -#define ITERATIONS 1000 - -#define member_size(type, member) sizeof(((type *)0)->member) -#define sizeof_up_to(type, member) (offsetof(type, member) + member_size(type, member)) - -enum { - PIPE_R = 0, - PIPE_W, -}; - -int main(int argc, char **argv) -{ - int sock, psock, result, flags, index, i, pipefd[2], pipes[2][2]; - struct addrinfo hints, *info; - struct sctp_event_subscribe subscr_events; - pid_t fork_pid; - char byte = 0x41, data[1024]; - sctp_assoc_t assoc_id; - union sctp_notification *notif; - - result = pipe(pipefd); - if (result < 0) { - perror("pipe"); - return 1; - } - pipes[0][PIPE_R] = pipefd[0]; - pipes[1][PIPE_W] = pipefd[1]; - - result = pipe(pipefd); - if (result < 0) { - perror("pipe"); - return 1; - } - pipes[1][PIPE_R] = pipefd[0]; - pipes[0][PIPE_W] = pipefd[1]; - - fork_pid = fork(); - if (fork_pid < 0) { - perror("fork"); - return 1; - } - - index = !!fork_pid; - close(pipes[!index][PIPE_R]); - close(pipes[!index][PIPE_W]); - - memset(&hints, 0, sizeof(struct addrinfo)); - hints.ai_flags = AI_PASSIVE; - hints.ai_protocol = IPPROTO_SCTP; - hints.ai_family = AF_INET; - hints.ai_socktype = SOCK_SEQPACKET; - - result = getaddrinfo(NULL, TEST_PORTS[index], &hints, &info); - if (result < 0) { - fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(result)); - return 1; - } - - sock = socket(info->ai_family, info->ai_socktype, info->ai_protocol); - if (sock < 0) { - perror("socket"); - return 1; - } - - result = bind(sock, info->ai_addr, info->ai_addrlen); - if (result < 0) { - perror("bind"); - return 1; - } - - if (listen(sock, SOMAXCONN)) { - perror("listen"); - return 1; - } - - memset(&subscr_events, 0, sizeof(subscr_events)); - subscr_events.sctp_association_event = 1; - result = setsockopt(sock, IPPROTO_SCTP, SCTP_EVENTS, &subscr_events, - sizeof_up_to(struct sctp_event_subscribe, - sctp_association_event)); - - memset(&hints, 0, sizeof(struct addrinfo)); - hints.ai_protocol = IPPROTO_SCTP; - hints.ai_socktype = SOCK_SEQPACKET; - - result = getaddrinfo("127.0.0.1", TEST_PORTS[!index], &hints, &info); - if (result < 0) { - fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(result)); - return 1; - } - - for (i = 0; i < ITERATIONS; i++) { - printf("[%i] ITERATION %i...\n", index, i); - - /* synchronize */ - result = write(pipes[index][PIPE_W], &byte, 1); - if (result < 0) { - perror("pipe"); - return 1; - } - result = read(pipes[index][PIPE_R], &byte, 1); - if (result < 0) { - perror("pipe"); - return 1; - } - - result = connect(sock, info->ai_addr, info->ai_addrlen); - if (result < 0 && errno != EISCONN) { - perror("connect"); - return 1; - } - - /* Get assoc_id for sctp_peeloff() */ - flags = 0; - result = sctp_recvmsg(sock, data, sizeof(data), - NULL, 0, NULL, &flags); - if (result < 0) { - perror("sctp_recvmsg"); - return 1; - } - - if ((flags & (MSG_NOTIFICATION | MSG_EOR)) != (MSG_NOTIFICATION | MSG_EOR)) { - fprintf(stderr, "[%i] Invalid sctp_recvmsg response FLAGS: %x\n", index, flags); - return 1; - } - - notif = (union sctp_notification *)data; - if (notif->sn_header.sn_type != SCTP_ASSOC_CHANGE) { - fprintf(stderr, "[%i] Invalid sctp_recvmsg response type: %x\n", index, notif->sn_header.sn_type); - return 1; - } - assoc_id = notif->sn_assoc_change.sac_assoc_id; - psock = sctp_peeloff(sock, assoc_id); - if (psock < 0) { - perror("sctp_peeloff"); - return 1; - } - - data[0] = 42; - result = sctp_sendmsg(psock, data, 1, NULL, 0, - 0, 0, 0, 0, 0); - if (result < 0) { - perror("sctp_sendmsg"); - return 1; - } - - result = sctp_recvmsg(psock, data, sizeof(data), - NULL, 0, NULL, NULL); - if (result < 0) { - perror("sctp_recvmsg"); - return 1; - } - - if (data[0] != 42) { - fprintf(stderr, "[%i] Invalid sctp_recvmsg response: %d\n", index, (int)data[0]); - return 1; - } - - close(psock); - printf("[%i] ITERATION %i SUCCESS!\n", index, i); - } - close(sock); - return 0; -} diff --git a/kernel/sctp_peeloff_corner_case/runtest.sh b/kernel/sctp_peeloff_corner_case/runtest.sh deleted file mode 100755 index befc319..0000000 --- a/kernel/sctp_peeloff_corner_case/runtest.sh +++ /dev/null @@ -1,100 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2024 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -function installDepsYum() { - local yum="$1"; shift - - if "$yum" install --help | grep -q -- --skip-unavailable; then - "$yum" install -y --skip-unavailable $* - elif "$yum" install --help | grep -q -- --skip-broken; then - "$yum" install -y --skip-broken $* - else - for req in $*; do - if ! rpm -q --quiet --whatprovides "$req"; then - "$yum" install -y "$req" || true - fi - done - fi -} - -function installDeps() { - if [ -e /run/ostree-booted ]; then - for item in "$@"; do - if ! rpm -q --quiet --whatprovides "$item"; then - rpm-ostree --apply-live -y install "$item" - fi - done - elif type yum >/dev/null; then - installDepsYum yum "$@" - elif type dnf >/dev/null; then - installDepsYum dnf "$@" - fi -} - -function check_avc_begin() { - sleep 1.1 - date +'%x %T' - sleep 1.1 -} - -function check_avc_end() { - marker="marker-$RANDOM" - - auditctl -m "$marker" - - for (( i = 0; i < 100; i++ )); do - if ausearch -i -m user -ts $1 2>/dev/null -component: - - kernel -framework: beakerlib -require: - - make - - gcc - - lksctp-tools-devel - - audit - - kernel-modules -recommend: - - kernel-modules-extra -duration: 10m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-8 - because: RHEL-7 and below don't have SCTP SELinux support -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2048251 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2015525 diff --git a/kernel/sctp_peer_label_bug/runtest.sh b/kernel/sctp_peer_label_bug/runtest.sh deleted file mode 100755 index 96973c2..0000000 --- a/kernel/sctp_peer_label_bug/runtest.sh +++ /dev/null @@ -1,61 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -function check_avc_begin() { - sleep 1.1 - date +'%x %T' - sleep 1.1 -} - -function check_avc_end() { - marker="marker-$RANDOM" - - auditctl -m "$marker" - - for (( i = 0; i < 100; i++ )); do - if ausearch -i -m user -ts $1 2>/dev/null flag" 0 "Wait for the server to start listening" - rlRun "./sctp_bz2048251_client 127.0.0.1 9999" 0 "Run the client" - rlRun "wait" 0 "Wait for the server to exit" - - rlRun "check_avc_end \"\$audit_ts\"" 1 "Check if there are AVC denials" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f sctp_bz2048251_client sctp_bz2048251_server flag" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c b/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c deleted file mode 100644 index 03fbd09..0000000 --- a/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c +++ /dev/null @@ -1,109 +0,0 @@ -#include "sctp_common.h" - -static void usage(char *progname) -{ - fprintf(stderr, - "usage: %s [-v] addr port\n" - "\nWhere:\n\t" - - "-v Print context and ip options information.\n\t" - "addr IPv4 or IPv6 address (e.g. 127.0.0.1 or ::1).\n\t" - "port Port for accessing server.\n", progname); - exit(1); -} - -int main(int argc, char **argv) -{ - int opt, sock, result; - struct addrinfo hints, *serverinfo; - bool verbose = false; - struct timeval tm; - socklen_t sinlen; - struct sockaddr_storage sin; - - while ((opt = getopt(argc, argv, "v")) != -1) { - switch (opt) { - case 'v': - verbose = true; - break; - default: - usage(argv[0]); - } - } - - if ((argc - optind) != 2) - usage(argv[0]); - - memset(&hints, 0, sizeof(struct addrinfo)); - hints.ai_protocol = IPPROTO_SCTP; - hints.ai_socktype = SOCK_SEQPACKET; - - result = getaddrinfo(argv[optind], argv[optind + 1], &hints, - &serverinfo); - if (result < 0) { - fprintf(stderr, "Client getaddrinfo: %s\n", - gai_strerror(result)); - exit(2); - } - - sock = socket(serverinfo->ai_family, serverinfo->ai_socktype, - serverinfo->ai_protocol); - if (sock < 0) { - perror("Client socket"); - exit(3); - } - - /* - * These timeouts are set to test whether the peer { recv } completes - * or not when the permission is denied. - */ - tm.tv_sec = 4; - tm.tv_usec = 0; - result = setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO, &tm, sizeof(tm)); - if (result < 0) { - perror("Client setsockopt: SO_SNDTIMEO"); - exit(4); - } - - result = setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, &tm, sizeof(tm)); - if (result < 0) { - perror("Client setsockopt: SO_RCVTIMEO"); - exit(5); - } - - if (listen(sock, SOMAXCONN)) { - perror("Client listen"); - close(sock); - exit(1); - } - - /* Subscribe to assoc_id events */ - result = set_subscr_events(sock, off, on, off, off); - if (result < 0) { - perror("Client setsockopt: SCTP_EVENTS"); - return 1; - } - - result = open_assoc(sock, serverinfo->ai_addr, serverinfo->ai_addrlen, - verbose); - if (result) { - close(sock); - exit(result); - } - - result = receive_assoc(sock, &sin, &sinlen, verbose); - if (result) { - close(sock); - exit(result); - } - - result = open_assoc(sock, serverinfo->ai_addr, serverinfo->ai_addrlen, - verbose); - if (result) { - close(sock); - exit(result); - } - - close(sock); - exit(0); -} diff --git a/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c b/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c deleted file mode 100644 index 2af11f6..0000000 --- a/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c +++ /dev/null @@ -1,132 +0,0 @@ -#include "sctp_common.h" - -static void usage(char *progname) -{ - fprintf(stderr, - "usage: %s [-4] [-f file] [-v] port\n" - "\nWhere:\n\t" - "-4 Listen on IPv4 addresses only.\n\t" - "-f Write a line to the file when listening starts.\n\t" - " \"nopeer\" message to client, otherwise the peer context\n\t" - " will be retrieved and sent to client.\n\t" - "-v Print context and ip options information.\n\t" - "port Listening port.\n", progname); - exit(1); -} - -int main(int argc, char **argv) -{ - int opt, sock, result; - socklen_t sinlen; - struct sockaddr_storage sin; - struct addrinfo hints, *res; - char *flag_file = NULL; - bool verbose = false, ipv4 = false; - unsigned short port; - - while ((opt = getopt(argc, argv, "4f:v")) != -1) { - switch (opt) { - case '4': - ipv4 = true; - break; - case 'f': - flag_file = optarg; - break; - case 'v': - verbose = true; - break; - default: - usage(argv[0]); - } - } - - if ((argc - optind) != 1) - usage(argv[0]); - - port = atoi(argv[optind]); - if (!port) - usage(argv[0]); - - memset(&hints, 0, sizeof(struct addrinfo)); - hints.ai_flags = AI_PASSIVE; - hints.ai_protocol = IPPROTO_SCTP; - - if (ipv4) - hints.ai_family = AF_INET; - else - hints.ai_family = AF_INET6; - - /* sctp_peeloff(3) must be from 1 to Many style socket */ - hints.ai_socktype = SOCK_SEQPACKET; - - result = getaddrinfo(NULL, argv[optind], &hints, &res); - if (result < 0) { - fprintf(stderr, "Server getaddrinfo: %s\n", - gai_strerror(result)); - exit(1); - } - - sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol); - if (sock < 0) { - perror("Server socket"); - exit(1); - } - - result = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); - if (result < 0) { - perror("Server setsockopt: SO_REUSEADDR"); - close(sock); - exit(1); - } - - result = bind(sock, res->ai_addr, res->ai_addrlen); - if (result < 0) { - perror("Server bind"); - close(sock); - exit(1); - } - - if (listen(sock, SOMAXCONN)) { - perror("Server listen"); - close(sock); - exit(1); - } - - /* Subscribe to assoc_id events */ - result = set_subscr_events(sock, off, on, off, off); - if (result < 0) { - perror("Client setsockopt: SCTP_EVENTS"); - return 1; - } - - if (flag_file) { - FILE *f = fopen(flag_file, "w"); - if (!f) { - perror("Flag file open"); - exit(1); - } - fprintf(f, "listening\n"); - fclose(f); - } - - result = receive_assoc(sock, &sin, &sinlen, verbose); - if (result) { - close(sock); - exit(result); - } - - result = open_assoc(sock, (struct sockaddr *)&sin, sinlen, verbose); - if (result) { - close(sock); - exit(result); - } - - result = receive_assoc(sock, &sin, &sinlen, verbose); - if (result) { - close(sock); - exit(result); - } - - close(sock); - exit(0); -} diff --git a/kernel/sctp_peer_label_bug/sctp_common.c b/kernel/sctp_peer_label_bug/sctp_common.c deleted file mode 100644 index f8c6fbf..0000000 --- a/kernel/sctp_peer_label_bug/sctp_common.c +++ /dev/null @@ -1,384 +0,0 @@ -#include "sctp_common.h" - -#define member_size(type, member) sizeof(((type *)0)->member) -#define sizeof_up_to(type, member) (offsetof(type, member) + member_size(type, member)) - -void print_addr_info(struct sockaddr *sin, char *text) -{ - struct sockaddr_in *addr4; - struct sockaddr_in6 *addr6; - char addr_str[INET6_ADDRSTRLEN + 1]; - - switch (sin->sa_family) { - case AF_INET: - addr4 = (struct sockaddr_in *)sin; - inet_ntop(sin->sa_family, - (void *)&addr4->sin_addr, - addr_str, INET6_ADDRSTRLEN + 1); - printf("%s IPv4 addr %s\n", text, addr_str); - break; - case AF_INET6: - addr6 = (struct sockaddr_in6 *)sin; - if (IN6_IS_ADDR_V4MAPPED(&addr6->sin6_addr)) { - inet_ntop(AF_INET, - (void *)&addr6->sin6_addr.s6_addr32[3], - addr_str, INET6_ADDRSTRLEN + 1); - printf("%s IPv6->IPv4 MAPPED addr %s\n", - text, addr_str); - } else if (IN6_IS_ADDR_LINKLOCAL(&addr6->sin6_addr)) { - inet_ntop(sin->sa_family, - (void *)&addr6->sin6_addr, - addr_str, INET6_ADDRSTRLEN + 1); - printf("%s IPv6 local link addr %s scope_id %d\n", - text, addr_str, - ((struct sockaddr_in6 *)addr6)->sin6_scope_id); - } else { - inet_ntop(sin->sa_family, - (void *)&addr6->sin6_addr, - addr_str, INET6_ADDRSTRLEN + 1); - printf("%s IPv6 addr %s\n", text, - addr_str); - } - break; - default: - printf("%s Unknown IP family %d\n", text, sin->sa_family); - break; - } -} - -int set_subscr_events(int fd, int data_io, int assoc, int addr, int shutd) -{ - struct sctp_event_subscribe subscr_events; - - memset(&subscr_events, 0, sizeof(subscr_events)); - subscr_events.sctp_data_io_event = data_io; - subscr_events.sctp_association_event = assoc; - subscr_events.sctp_address_event = addr; - subscr_events.sctp_shutdown_event = shutd; - - /* - * Truncate optlen to just the fields we touch to avoid errors when - * the uapi headers are newer than the running kernel. - */ - return setsockopt(fd, IPPROTO_SCTP, SCTP_EVENTS, &subscr_events, - sizeof_up_to(struct sctp_event_subscribe, - sctp_shutdown_event)); -} - -/* - * Currently only SCTP_ASSOC_CHANGE, SCTP_PEER_ADDR_CHANGE and - * SCTP_SHUTDOWN_EVENT are enabled via set_subscr_events(). - */ -int handle_event(void *buf, char *cmp_addr, sctp_assoc_t *assoc_id, - bool verbose, char *text) -{ - union sctp_notification *snp = buf; - char addrbuf[INET6_ADDRSTRLEN]; - struct sockaddr_in *sin; - struct sockaddr_in6 *sin6; - const char *ap; - struct sctp_paddr_change *spc; - struct sctp_assoc_change *sac; - struct sctp_remote_error *sre; - struct sctp_send_failed *ssf; - struct sctp_authkey_event *auth_event; - - switch (snp->sn_header.sn_type) { - case SCTP_ASSOC_CHANGE: - sac = &snp->sn_assoc_change; - - if (verbose) - printf("%s SCTP_ASSOC_CHANGE event for assoc_id: %d ERR: 0x%x\n", - text, sac->sac_assoc_id, sac->sac_error); - - if (assoc_id) - *assoc_id = sac->sac_assoc_id; - break; - case SCTP_PEER_ADDR_CHANGE: - spc = &snp->sn_paddr_change; - - if (verbose) - /* - * Not all spc_error codes are errors - linux/sctp.h - * (e.g. SCTP_HEARTBEAT_SUCCESS = 0x02) - */ - printf("%s SCTP_PEER_ADDR_CHANGE event for assoc_id: %d ERR: 0x%x\n", - text, spc->spc_assoc_id, spc->spc_error); - - if (spc->spc_aaddr.ss_family == AF_INET) { - sin = (struct sockaddr_in *) &spc->spc_aaddr; - ap = inet_ntop(AF_INET, &sin->sin_addr, addrbuf, - INET6_ADDRSTRLEN); - } else { - sin6 = (struct sockaddr_in6 *) &spc->spc_aaddr; - ap = inet_ntop(AF_INET6, &sin6->sin6_addr, addrbuf, - INET6_ADDRSTRLEN); - } - if (verbose) /* Print additional address details */ - print_addr_info((struct sockaddr *)&spc->spc_aaddr, - "Peer Address change:\n\t"); - - switch (spc->spc_state) { - case SCTP_ADDR_AVAILABLE: - if (verbose) - printf("\t%s is available\n", text); - break; - case SCTP_ADDR_UNREACHABLE: - if (verbose) - printf("\t%s is not available - Error: 0x%x\n", - text, spc->spc_error); - break; - case SCTP_ADDR_REMOVED: - if (verbose) - printf("\t%s was removed\n", text); - break; - case SCTP_ADDR_ADDED: - if (verbose) - printf("\t%s was added\n", text); - break; - case SCTP_ADDR_MADE_PRIM: - if (verbose) - printf("\t%s is primary\n", text); - if (cmp_addr) { - if (!strcmp(ap, cmp_addr)) { - if (verbose) - printf("\t%s and is now the new primary\n", text); - - return EVENT_ADDR_MATCH; - } - } - break; - case SCTP_ADDR_CONFIRMED: - if (verbose) - printf("\t%s is confirmed\n", text); - break; - default: - if (verbose) - printf("%s unknown state: %d\n", text, - spc->spc_state); - break; - } - break; - case SCTP_SEND_FAILED: - ssf = &snp->sn_send_failed; - - if (verbose) - printf("%s SCTP_SEND_FAILED event assoc_id: %d ERR: 0x%x\n", - text, ssf->ssf_assoc_id, ssf->ssf_error); - break; - case SCTP_REMOTE_ERROR: - sre = &snp->sn_remote_error; - if (verbose) /* Error in network byte order - linux/sctp.h */ - printf("%s SCTP_REMOTE_ERROR event ERR: 0x%x\n", - text, ntohs(sre->sre_error)); - break; - case SCTP_SHUTDOWN_EVENT: - if (verbose) - printf("%s SCTP_SHUTDOWN_EVENT\n", text); - - return EVENT_SHUTDOWN; - case SCTP_PARTIAL_DELIVERY_EVENT: - if (verbose) - printf("%s SCTP_PARTIAL_DELIVERY_EVENT\n", text); - break; - case SCTP_ADAPTATION_INDICATION: - if (verbose) - printf("%s SCTP_ADAPTATION_INDICATION event\n", text); - break; - case SCTP_AUTHENTICATION_INDICATION: - auth_event = &snp->sn_authkey_event; - - if (verbose) { - printf("%s SCTP_AUTHENTICATION_INDICATION event\n" - "\tauth_event->auth_type: 0x%x\n" - "\tauth_event->auth_flags: 0x%x\n" - "\tauth_event->auth_length: 0x%x\n" - "\tauth_event->auth_keynumber: 0x%x\n" - "\tauth_event->auth_indication: 0x%x\n" - "\tauth_event->auth_assoc_id: %d\n", - text, auth_event->auth_type, - auth_event->auth_flags, - auth_event->auth_length, - auth_event->auth_keynumber, - auth_event->auth_indication, - auth_event->auth_assoc_id); - } - /* SCTP_AUTH_NO_AUTH defined in linux/sctp.h */ - if (auth_event->auth_indication == SCTP_AUTH_NO_AUTH) - return EVENT_NO_AUTH; - break; - case SCTP_SENDER_DRY_EVENT: - if (verbose) - printf("%s SCTP_SENDER_DRY_EVENT\n", text); - break; - case SCTP_STREAM_RESET_EVENT: - if (verbose) - printf("%s SCTP_STREAM_RESET_EVENT\n", text); - break; - case SCTP_ASSOC_RESET_EVENT: - if (verbose) - printf("%s SCTP_ASSOC_RESET_EVENT\n", text); - break; - case SCTP_STREAM_CHANGE_EVENT: - if (verbose) - printf("%s SCTP_STREAM_CHANGE_EVENT\n", text); - break; - case SCTP_SEND_FAILED_EVENT: - if (verbose) - printf("%s SCTP_SEND_FAILED_EVENT\n", text); - break; - default: - fprintf(stderr, "%s unknown event: 0x%x\n", text, - snp->sn_header.sn_type); - break; - } - - return EVENT_OK; -} - -int receive_assoc(int sock, struct sockaddr_storage *sin, socklen_t *sinlen, - int verbose) -{ - int result, peeloff_sk = 0, flags; - sctp_assoc_t assoc_id = 0; - char *peerlabel, msglabel[256]; - - *sinlen = sizeof(*sin); - flags = 0; - - result = sctp_recvmsg(sock, msglabel, sizeof(msglabel), - (struct sockaddr *)sin, sinlen, - NULL, &flags); - if (result < 0) { - perror("Server sctp_recvmsg-1"); - return 1; - } - - if (verbose) - print_addr_info((struct sockaddr *)sin, - "Server SEQPACKET recvmsg"); - - if (!(flags & MSG_NOTIFICATION) || !(flags & MSG_EOR)) { - printf("Invalid sctp_recvmsg response FLAGS: %x\n", - flags); - return 1; - } - - handle_event(msglabel, NULL, &assoc_id, - verbose, "Peeloff Server"); - if (assoc_id <= 0) { - printf("Server Invalid association ID: %d\n", - assoc_id); - return 1; - } - peeloff_sk = sctp_peeloff(sock, assoc_id); - if (peeloff_sk < 0) { - perror("Server sctp_peeloff"); - return 1; - } - if (verbose) { - printf("Server sctp_peeloff(3) on sk: %d with association ID: %d\n", - peeloff_sk, assoc_id); - } - - /* Now get the client msg on peeloff socket */ - result = sctp_recvmsg(peeloff_sk, msglabel, sizeof(msglabel), - (struct sockaddr *)sin, sinlen, - NULL, &flags); - if (result < 0) { - perror("Server sctp_recvmsg-2"); - close(peeloff_sk); - return 1; - } - - if (verbose) { - print_addr_info((struct sockaddr *)sin, - "Server SEQPACKET peeloff recvmsg"); - printf("peeloff association ID: %d\n", - assoc_id); - } - - peerlabel = strdup("nopeer"); - - printf("Server PEELOFF peer label: %s\n", peerlabel); - - result = sctp_sendmsg(peeloff_sk, peerlabel, - strlen(peerlabel), - NULL, 0, - 0, 0, 0, 0, 0); - if (result < 0) { - perror("Server sctp_sendmsg"); - close(peeloff_sk); - close(sock); - exit(1); - } - - if (verbose) - printf("Server PEELOFF sent: %s\n", peerlabel); - - free(peerlabel); - - close(peeloff_sk); - return 0; -} - -int open_assoc(int sock, struct sockaddr *sin, socklen_t sinlen, - int verbose) -{ - int result, peeloff_sk = 0, flags; - sctp_assoc_t assoc_id = 0; - char byte = 0x41, label[1024]; - - /* otherwise we might connect too fast */ - sleep(1); - - result = connect(sock, sin, sinlen); - if (result < 0) { - perror("Client connect"); - return 1; - } - - /* Get assoc_id for sctp_peeloff() */ - flags = 0; - result = sctp_recvmsg(sock, label, sizeof(label), - NULL, 0, NULL, &flags); - if (result < 0) { - perror("Client sctp_recvmsg-1"); - return 1; - } - - if ((flags & (MSG_NOTIFICATION | MSG_EOR)) != (MSG_NOTIFICATION | MSG_EOR)) { - printf("Invalid sctp_recvmsg response FLAGS: %x\n", flags); - return 1; - } - handle_event(label, NULL, &assoc_id, verbose, "Peeloff Client"); - if (assoc_id <= 0) { - printf("Client Invalid association ID: %d\n", assoc_id); - return 1; - } - - peeloff_sk = sctp_peeloff(sock, assoc_id); - if (peeloff_sk < 0) { - perror("Client sctp_peeloff"); - return 1; - } - - result = sctp_sendmsg(peeloff_sk, &byte, 1, NULL, 0, - 0, 0, 0, 0, 0); - if (result < 0) { - perror("Client sctp_sendmsg"); - close(peeloff_sk); - return 1; - } - - result = sctp_recvmsg(peeloff_sk, label, sizeof(label), - NULL, 0, NULL, NULL); - if (result < 0) { - perror("Client sctp_recvmsg"); - close(peeloff_sk); - return 1; - } - - close(peeloff_sk); - return 0; -} diff --git a/kernel/sctp_peer_label_bug/sctp_common.h b/kernel/sctp_peer_label_bug/sctp_common.h deleted file mode 100644 index aeec4d2..0000000 --- a/kernel/sctp_peer_label_bug/sctp_common.h +++ /dev/null @@ -1,38 +0,0 @@ -#ifndef _GNU_SOURCE -#define _GNU_SOURCE /* For poll(2) POLLRDHUP - Detect client close(2) */ -#endif - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -enum event_ret { - EVENT_OK, - EVENT_ADDR_MATCH, - EVENT_SHUTDOWN, - EVENT_NO_AUTH -}; - -void print_addr_info(struct sockaddr *sin, char *text); -int set_subscr_events(int fd, int data_io, int assoc, int addr, int shutd); -int handle_event(void *buf, char *cmp_addr, sctp_assoc_t *assoc_id, - bool verbose, char *text); - -static const int on = 1, off = 0; - -int receive_assoc(int sock, struct sockaddr_storage *sin, socklen_t *sinlen, - int verbose); -int open_assoc(int sock, struct sockaddr *sin, socklen_t sinlen, int verbose); diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf index d3875ba..358efb6 100644 --- a/kernel/selinux-testsuite/main.fmf +++ b/kernel/selinux-testsuite/main.fmf @@ -1,24 +1,10 @@ +path: /kernel/selinux-testsuite + summary: Wrapper for selinux-testuite description: | This TC runs a functional test suite for the LSM-based SELinux security module. -contact: Milos Malik -component: - - kernel - - selinux-policy -framework: beakerlib -duration: 1h -tier: 1 -enabled: true -tag: - - fusa -adjust+: - - enabled: false - when: distro < rhel-6 - - enabled: false - when: arch = i386 -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail -id: f491d519-a7cd-4acf-8405-67a6afcc678a +duration: 60m +tier: 2 +adjust: +- enabled: false + when: distro < rhel-5 diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index cefb9e1..a3ca98f 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="72e60b6018321a3da9d5e328477e29ee7366e498" +DEFAULT_COMMIT="24bb5c0090710767ff187f1682e5bf355166caa3" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. @@ -44,7 +44,7 @@ DEFAULT_PULLS="" DEFAULT_PATCHES="" # Optional test parameter - location of testuite git. -GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} +GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"} # Optional test parameter - timeout for detecting lost packets NETWORK_TIMEOUT=${NETWORK_TIMEOUT:-4} @@ -70,21 +70,27 @@ else PIPEFAIL_DISABLE="" fi -function version_le() { - { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2" -} +if rlIsRHEL 5 ; then + # On RHEL-5 sort -V doesn't work, so just pretend we have the oldest kernel + function kver_ge() { false; } + function kver_lt() { true; } + function kver_le() { true; } + function kver_gt() { false; } +else + function version_le() { + { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2" + } -function kver_ge() { version_le "$1" "$(uname -r)"; } -function kver_lt() { ! kver_ge "$1"; } -function kver_le() { version_le "$(uname -r)" "$1"; } -function kver_gt() { ! kver_le "$1"; } + function kver_ge() { version_le "$1" "$(uname -r)"; } + function kver_lt() { ! kver_ge "$1"; } + function kver_le() { version_le "$(uname -r)" "$1"; } + function kver_gt() { ! kver_le "$1"; } +fi function installDepsYum() { local yum="$1"; shift - if "$yum" install --help | grep -q -- --skip-unavailable; then - "$yum" install -y --skip-unavailable $* - elif "$yum" install --help | grep -q -- --skip-broken; then + if "$yum" --help | grep -q -- --skip-broken; then "$yum" install -y --skip-broken $* else for req in $*; do @@ -96,13 +102,7 @@ function installDepsYum() { } function installDeps() { - if [ -e /run/ostree-booted ]; then - for item in "$@"; do - if ! rpm -q --quiet --whatprovides "$item"; then - rpm-ostree --apply-live -y install "$item" - fi - done - elif type yum >/dev/null; then + if type yum >/dev/null; then installDepsYum yum "$@" elif type dnf >/dev/null; then installDepsYum dnf "$@" @@ -121,34 +121,25 @@ function boolSet() { rlJournalStart rlPhaseStartSetup "Install" - # Determine the base kernel package name and version corresponding - # to the currently running kernel. Use this information to derive - # the correct kernel subpackages to install. - if KERNEL_CORE_NVRA="$(rpm -qf "/boot/vmlinuz-$(uname -r)")"; then - KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" - KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" - - KERNEL_PKG_VRA="${KERNEL_CORE_NVRA#$KERNEL_CORE_N-}" - KERNEL_PKG_BASE="${KERNEL_CORE_N%-core}" - - rlLog "Detected kernel package base name '$KERNEL_PKG_BASE' and version-release.arch '$KERNEL_PKG_VRA'" - KERNEL_PKGS=" - $KERNEL_PKG_BASE-modules-extra-$KERNEL_PKG_VRA - $KERNEL_PKG_BASE-devel-$KERNEL_PKG_VRA - " - else - rlLog "Detected non-RPM running kernel - no extra kernel packages will be installed" - KERNEL_PKGS="" - fi - # We need to install the kernel-* packages by ourselves, since we need # the same versions as the running kernel. And since we already need a # reliable package install function, let's just install all the # dependencies here. Thus we don't need to maintain duplicate lists of # package requirements in many places (RH repo, Fedora kernel dist-git, # CKI). + PKG_SUFFIX="" + KERNEL_VERSION="$(uname -r)" + PKG_VERSION="${KERNEL_VERSION%+debug}" + if [ "$PKG_VERSION" != "$KERNEL_VERSION" ]; then + rlLog "Detected debug kernel running." + PKG_SUFFIX="-debug" + fi + REQUIRES=" - $KERNEL_PKGS + kernel$PKG_SUFFIX-modules-extra-$PKG_VERSION + kernel-rt$PKG_SUFFIX-modules-extra-$PKG_VERSION + kernel$PKG_SUFFIX-devel-$PKG_VERSION + kernel-rt$PKG_SUFFIX-devel-$PKG_VERSION /usr/bin/unbuffer attr audit @@ -189,12 +180,13 @@ rlJournalStart rdma-core-devel selinux-policy-devel setools-console + which xfsprogs-devel " rlRun "installDeps \$REQUIRES" 0 "Install requires" # The CRB repo with libbpf-devel might not be enabled on RHEL - if rlIsRHEL '>=8' && ! [ -e /run/ostree-booted ]; then + if rlIsRHEL '>=8'; then for repo in "rhel-CRB" "beaker-CRB"; do rpm -q libbpf-devel &>/dev/null && break rlRun "dnf install --enablerepo $repo -y libbpf-devel" 0-255 @@ -206,15 +198,18 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm audit rlFileBackup /etc/selinux/semanage.conf - # run the testsuite in /root to avoid problems with other paths - rlRun "pushd /root" + # running the testsuite in /tmp causes permission denied messages + # rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + # rlRun "pushd $TmpDir" - # version_le() sanity check: - rlRun "version_le 4.10 4.10" - rlRun "version_le 4.10 4.10.0" - rlRun "version_le 4.10 4.10.1" - rlRun "! version_le 4.10 4.9" - rlRun "! version_le 4.10.0 4.10" + if ! rlIsRHEL 5 ; then + # version_le() sanity check: + rlRun "version_le 4.10 4.10" + rlRun "version_le 4.10 4.10.0" + rlRun "version_le 4.10 4.10.1" + rlRun "! version_le 4.10 4.9" + rlRun "! version_le 4.10.0 4.10" + fi if [ -d /sys/fs/selinux ]; then selinuxfs=/sys/fs/selinux @@ -263,23 +258,24 @@ rlJournalStart for pull in $GIT_PULLS; do ref="refs/pull/$pull/head" if ! rlRun "git fetch origin $ref:$ref" 0; then - rlLogFatal "PR merge failed!" - rlPhaseEnd - exit 127 + rlRun "git checkout $GIT_BRANCH" 0 + rlLogWarning "PR merge failed, falling back to GIT_BRANCH" + break fi if ! rlRun "git merge --no-edit $ref" 0; then - rlLogFatal "PR merge failed!" - rlPhaseEnd - exit 127 + rlRun "git merge --abort" 0 + rlRun "git checkout $GIT_BRANCH" 0 + rlLogWarning "PR merge failed, falling back to GIT_BRANCH" + break fi done $PIPEFAIL_ENABLE for pwseries in $GIT_PATCHES; do url="https://patchwork.kernel.org/series/$pwseries/mbox/" if ! rlRun "curl $url | git am -"; then - rlLogFatal "Applying patch failed!" - rlPhaseEnd - exit 127 + rlRun "git checkout $GIT_BRANCH" 0 + rlLogWarning "Applying patch failed, falling back to GIT_BRANCH" + break fi done $PIPEFAIL_DISABLE @@ -309,49 +305,34 @@ rlJournalStart } | rlRun "tee -a tests/tun_tap/tun_common.h" 0 \ "Harden tun_tap test against missing defs" - # needed to avoid a flood of AVCs when run via restraint - # (RHEL-6 doesn't have unconfined_service_t) - if ! rlIsRHEL '<7'; then - rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0 - rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0 - else - rlRun "sed -i '/install_t/d' policy/test_policy.if" 0 - "RHEL 6 doesn't have install_t" - fi - exclude_tests="" force_tests="" for file in ./tests/nnp*/execnnp.c; do - rlRun "sed -i 's/3\.18/3.9/' $file" 0 \ + rlRun "sed -i 's/3.18/3.9/' $file" 0 \ "Fix up kernel version in nnp test" done + if rlIsRHEL 5 ; then + rlRun "sed -i '/unconfined_devpts_t/d' policy/test_policy.if" 0 + + rlRun "sed -i 's/read_file_perms/r_file_perms/' policy/*.te" 0 + rlRun "sed -i 's/mmap_file_perms/rx_file_perms/' policy/*.te" 0 + rlRun "sed -i 's/list_dir_perms/r_dir_perms/' policy/*.te" 0 + rlRun "sed -i 's/ open / /' policy/*.te" 0 + + rlRun "sed -i 's/^sysadm_bin_spec_domtrans_to/userdom_sysadm_bin_spec_domtrans_to/' policy/*.te" 0 + + rlRun "sed -i 's/^corecmd_exec_bin(\(.*\))$/corecmd_exec_bin(\1)\ncorecmd_exec_sbin(\1)/' policy/*.te" 0 + rlRun "sed -i 's/^corecmd_bin_entry_type(\(.*\))$/corecmd_bin_entry_type(\1)\ncorecmd_sbin_entry_type(\1)/' policy/*.te" 0 + rlRun "sed -i 's/^userdom_search_user_home_dirs(\(.*\))$/userdom_search_user_home_dirs(user, \1)/' policy/*.te" 0 + fi if rlIsRHEL "<8.2"; then rlRun "sed -i '/SUBDIRS += bpf/d;/export CFLAGS += -DHAVE_BPF/d' tests/Makefile" 0 \ "RHEL < 8.2 doesn't ship libbpf => disable BPF subtests" fi - if rlIsRHEL "<9"; then - # CONFIG_KEY_DH_OPERATIONS not enabled on RHEL-8 :( - # on RHEL-7, KEYCTL_DH_COMPUTE is not defined in the header - exclude_tests+=" keys" - fi rlRun "sed -i 's/tm\.tv_sec = [0-9]*;/tm.tv_sec = $NETWORK_TIMEOUT;/' ./tests/*/*.c" 0 \ "Tweak timeout in networking tests" # 2 secs is too little for SCTP test - if [ -e /run/ostree-booted ]; then - # Fixed by https://github.com/fedora-selinux/selinux-policy/pull/2029, - # but may not be in all distro streams. - rlRun "tee -a policy/test_global.te" 0 \ - "Work around missing policy rules" <>policy/test_mmap.te <<<'allow_map(test_no_execmem_t, tmpfs_t, file)'" fi - # work around non-functional ext4 native quota support on - # RHEL-7 - if kver_lt 4.18; then - rlRun "sed -i 's/3.6/4.18/g' tests/{fs_,}filesystem/test" - fi - if kver_ge 4.18; then force_tests+=" sctp" fi @@ -401,61 +376,18 @@ EOF rlRun "sed -i 's/SCTP_SEND_FAILED_EVENT/SCTP_STREAM_CHANGE_EVENT + 1/g' tests/sctp/*.c" 0 \ "Fix SCTP test compilation on old RHEL kernels" fi - if kver_lt 4.18.0-252; then - # 8a4d5985551b [security] selinux: Add xfs quota command types - script1='s/\$test_count += 62;/$test_count = 55;/g' - script2='s/\$quota_checks += 1;/$quota_checks = 0;/g' - # for some reason this is needed for older RHEL 7 versions... - script3='s/\$test_count += 69;/$test_count = 55;/g' - rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \ - "Apply workaround for missing XFS quota checks" - fi - if kver_lt 4.18.0-314; then - # a17f0671017f selinux: vsock: Set SID for socket returned by accept() - exclude_tests+=" vsock_socket" - fi + # CONFIG_KEYS_DH_COMPUTE not enabled on RHEL-8 :( + exclude_tests+=" keys" - sctp_client_peeloff=0 - if kver_ge 4.18.0-305.39.1 && kver_lt 4.18.0-306; then - sctp_client_peeloff=1 - fi - if kver_ge 4.18.0-348.19.1 && kver_lt 4.18.0-349; then - sctp_client_peeloff=1 - fi - if kver_ge 4.18.0-372.1.1 && kver_lt 5.14; then - sctp_client_peeloff=1 - fi - if kver_ge 5.14.0-70.15.1 && kver_lt 5.14.0-71; then - sctp_client_peeloff=1 - fi - if kver_ge 5.14.0-84; then - sctp_client_peeloff=1 - fi - if [ "$sctp_client_peeloff" -eq 1 ]; then - rlRun "sed -i 's/5\.18/4.18/g' tests/sctp/test" 0 \ - "Fix up kernel version in sctp test" - fi - - # TODO: wait for 786fc12457268cc9b555dde6c22ae7300d4b40e1 - # to be backported - #if kver_ge 5.14.0-326; then - # force_tests+=" inet_socket/mptcp" - #fi - - if ! grep -q 'CONFIG_SCSI_ISCSI_ATTRS=y' "/lib/modules/$(uname -r)/config"; then - rlRun "sed -i -e 's/runcon -t test_netlink_iscsi_socket_t/true/' \ - -e 's/runcon -t test_no_netlink_iscsi_socket_t/false/' \ - tests/netlink_socket/test" 0 \ - "Apply workaround for disabled CONFIG_SCSI_ISCSI_ATTRS" - fi - - if ! grep -q 'CONFIG_QFMT_V2=y' "/lib/modules/$(uname -r)/config"; then - # patch the filesystem tests to not do quota tests on ext4 - rlRun "sed -i -e 's/\`uname -r\`/\"3.0\"/' \ - -e 's/\\(elsif ( \$fs_type eq \"nfs4\" or \$fs_type eq \"nfs\"\\)/\\1 or \$fs_type eq \"ext4\"/' \ - tests/filesystem/test tests/fs_filesystem/test" 0 \ - "Apply workaround for disabled CONFIG_QFMT_V2" - fi + # Needs: + # e4cfa05e9bfe ("selinux: Add xfs quota command types") + # (not backported to any RHEL at this point - TODO update the check once it is) + script1='s/\$test_count += 62;/$test_count = 55;/g' + script2='s/\$quota_checks += 1;/$quota_checks = 0;/g' + # for some reason this is needed for older RHEL 7 versions... + script3='s/\$test_count += 69;/$test_count = 55;/g' + rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \ + "Apply workaround for missing XFS quota checks" fi # CKI mainline kernels don't ship with module build infrastructure @@ -483,6 +415,24 @@ EOF "Force applicable tests: $force_tests" fi + if ! modprobe sctp 2>/dev/null; then + script1='s/runcon -t test_sctp_socket_t/true/g' + script2='s/runcon -t test_no_sctp_socket_t/false/g' + rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \ + "No SCTP support => fix up extended_socket_class test" + fi + + # on aarch64 and s390x the kernel support for Bluetooth is turned + # off so we disable the Bluetooth socket tests there + case "$(rlGetPrimaryArch)" in + aarch64|s390x) + script1='s/runcon -t test_bluetooth_socket_t/true/g' + script2='s/runcon -t test_no_bluetooth_socket_t/false/g' + rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \ + "No Bluetooth support => fix up extended_socket_class test" + ;; + esac + # Initialize report. rlRun "echo 'Remote: $GIT_URL' >results.log" 0 rlRun "echo 'Branch: $GIT_BRANCH' >>results.log" 0 @@ -533,8 +483,6 @@ EOF rlRun "sleep 5" 0 rlRun "dmesg | grep -i \"rcu_sched detected stalls\"" 1 - - rlRun "popd" 0 "Leave /root" rlFileRestore rlPhaseEnd rlJournalPrintText diff --git a/kernel/selinuxfs_dentry_softlockup/main.fmf b/kernel/selinuxfs_dentry_softlockup/main.fmf deleted file mode 100644 index 5043c2e..0000000 --- a/kernel/selinuxfs_dentry_softlockup/main.fmf +++ /dev/null @@ -1,18 +0,0 @@ -summary: Test soft lockup on selinuxfs dentry lookup -description: | - Verifies that traversing selinuxfs while policy is being reloaded doesn't - cause a deadlock in the kernel. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - policycoreutils - - findutils -duration: 5m -tier: 2 -enabled: true -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1510603 -extra-hardware: | - keyvalue = PROCESSORS >= 2 diff --git a/kernel/selinuxfs_dentry_softlockup/runtest.sh b/kernel/selinuxfs_dentry_softlockup/runtest.sh deleted file mode 100755 index 779df6d..0000000 --- a/kernel/selinuxfs_dentry_softlockup/runtest.sh +++ /dev/null @@ -1,37 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" 0 "Print running kernel version" - rlPhaseEnd - - rlPhaseStartTest - rlAssertGreaterOrEqual "Ensure the machine has at least two cores" \ - "$(nproc)" 2 - - rlRun "(cd /sys/fs/selinux; while true; do find >/dev/null 2>&1; done) &" - rlRun "while true; do load_policy; sleep 0.1; done &" - - function check_soft_lockup() { - for (( i = 0; i < 60; i++ )); do - dmesg | grep 'BUG: soft lockup' && return 1 - sleep 1 - done - return 0 - } - rlRun "check_soft_lockup" 0 "Wait and see if soft lockup appears in dmesg" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "kill \$(jobs -p)" 0 "Terminate background jobs" - rlRun "wait" 0 "Wait for background jobs to terminate" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/setsebool-deadlock/Makefile b/kernel/setsebool-deadlock/Makefile deleted file mode 100644 index e6e0bfb..0000000 --- a/kernel/setsebool-deadlock/Makefile +++ /dev/null @@ -1,7 +0,0 @@ -# Minimal Makefile for standard-test-roles-beakerlib - -R="RhtsRequires: audit policycoreutils" - -run: - chmod +x runtest.sh - TEST=/SELinux/kernel/setsebool-deadlock ./runtest.sh diff --git a/kernel/setsebool-deadlock/main.fmf b/kernel/setsebool-deadlock/main.fmf deleted file mode 100644 index e83260e..0000000 --- a/kernel/setsebool-deadlock/main.fmf +++ /dev/null @@ -1,23 +0,0 @@ -summary: Regression test for deadlock when changing booleans -description: | - Verify that setting booleans with SELinux audit exclude rules present - doesn't deadlock itself. - WARNING: This test will lockup the machine if the bug is present! - https://bugzilla.redhat.com/show_bug.cgi?id=1924230 -contact: Ondrej Mosnacek -component: -- kernel -framework: beakerlib -require: -- audit -- policycoreutils -duration: 5m -tier: 3 -enabled: true -adjust+: - - enabled: false - when: distro < fedora-34 - because: some kernels on Fedora 33 and below don't have the fix - - enabled: false - when: distro ~< rhel-8.4 - because: not expected to be fixed in RHEL-8 below 8.4 diff --git a/kernel/setsebool-deadlock/runtest.sh b/kernel/setsebool-deadlock/runtest.sh deleted file mode 100755 index 20239b4..0000000 --- a/kernel/setsebool-deadlock/runtest.sh +++ /dev/null @@ -1,43 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2021 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -function boolGet() { - getsebool "$1" | cut -d ' ' -f 3 -} -function boolSet() { - getsebool "$1" &>/dev/null || return 0 - setsebool "$1" "$2" || return 1 - [ "$(boolGet "$1")" == "$2" ] -} - -TEST_BOOLEAN="domain_can_mmap_files" - -rlJournalStart - rlPhaseStartSetup - rlRun "bool_default=\$(boolGet domain_can_mmap_files)" 0 \ - "Get the initial boolean value" - rlRun "auditctl -a exclude,never -F subj_user=sysadm_u" 0 \ - "Add an audit rule that triggers the bug" - rlPhaseEnd - - rlPhaseStartTest - rlRun "setsebool domain_can_mmap_files $(( 1 - $bool_default )) &" 0 \ - "Start setsebool in the background (it may hang)" - rlRun "sleep 5s" 0 "Give it a grace period of 5 seconds" - rlRun "test \$(jobs -r | wc -l) -eq 0" 0 "Check that it has exited" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "auditctl -d exclude,never -F subj_user=sysadm_u" 0 \ - "Remove the audit rule" - rlRun "boolSet domain_can_mmap_files $bool_default" 0 \ - "Restore the boolean value" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/synflood/main.fmf b/kernel/synflood/main.fmf index a0304ef..94c46d0 100644 --- a/kernel/synflood/main.fmf +++ b/kernel/synflood/main.fmf @@ -8,9 +8,7 @@ component: - kernel framework: beakerlib require: -- type: library - url: https://github.com/beakerlib/epel.git - name: /epel +- library(distribution/epel) - /usr/bin/nc - perf - git @@ -20,16 +18,12 @@ require: recommend: - /usr/sbin/hping3 duration: 1h -# currently disabled due to being unreliable -enabled: false +enabled: true tier: 3 -adjust+: - - enabled: false +adjust: + enabled: false when: distro < rhel-8 because: The test doesn't work well on RHEL-7 - - enabled: false - when: arch = s390x - because: No machines likely available with required HW configuration extra-hardware: | keyvalue = PROCESSORS >= 64 hostrequire = diff --git a/kernel/synflood/runtest.sh b/kernel/synflood/runtest.sh index 8e33ceb..aaaf8ab 100755 --- a/kernel/synflood/runtest.sh +++ b/kernel/synflood/runtest.sh @@ -7,9 +7,6 @@ # Include Beakerlib environment . /usr/share/beakerlib/beakerlib.sh || exit 1 -# Set this parameter to 1 to also generate a flamegraph. -GENERATE_FLAMEGRAPH="${GENERATE_FLAMEGRAPH:-0}" - TEST_PORT=8080 FG_URL="https://github.com/brendangregg/FlameGraph" @@ -29,15 +26,13 @@ if [ $(nproc) -lt 64 ]; then rlPhaseEnd else rlPhaseStartSetup - rlImport "epel/epel" + rlImport "distribution/epel" rlRun "command -v hping3 || epelyum install -y hping3" 0 \ "Make sure hping3 is installed (EPEL-only on RHEL)" rlRun "uname -r" - if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then - rlRun "git clone $FG_URL $FG_DIR" - fi + rlRun "git clone $FG_URL $FG_DIR" rlPhaseEnd rlPhaseStartTest @@ -69,14 +64,10 @@ else rlPhaseEnd rlPhaseStartCleanup - if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then - rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" - rlFileSubmit "flamegraph.svg" - rlRun "rm -f flamegraph.svg" - fi + rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" rlRun "xz -T0 perf.data" - for file in "perf.data.xz" "perf-report.txt"; do + for file in "perf.data.xz" "flamegraph.svg" "perf-report.txt"; do rlFileSubmit "$file" rlRun "rm -f $file" done diff --git a/kernel/sysctl-avcs/main.fmf b/kernel/sysctl-avcs/main.fmf deleted file mode 100644 index 968e37e..0000000 --- a/kernel/sysctl-avcs/main.fmf +++ /dev/null @@ -1,22 +0,0 @@ -summary: Test for unexpected denials from sysctl -a -description: | - Verifes that running sysctl -a doesn't trigger unexpected capability - checks that would result in AVC denials even when access is allowed. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -require: - - selinux-policy-devel -duration: 10m -tier: 2 -check: - - avc -enabled: true -adjust+: - - enabled: false - when: distro < rhel-9 - because: RHEL-8 and below are not worth supporting by this test -link: - - verifies: https://issues.redhat.com/browse/RHEL-135610 - - verifies: https://issues.redhat.com/browse/RHEL-145590 diff --git a/kernel/sysctl-avcs/runtest.sh b/kernel/sysctl-avcs/runtest.sh deleted file mode 100755 index b8129a9..0000000 --- a/kernel/sysctl-avcs/runtest.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2026 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" - - SE_ROLE="$(secon -r --pid $$)" - SE_TYPE="$(secon -t --pid $$)" - - rlRun "make -f /usr/share/selinux/devel/Makefile test_policy.pp M4PARAM='-D TEST_ROLE=$SE_ROLE -D TEST_TYPE=$SE_TYPE'" 0 \ - "Build the test policy" - rlRun "semodule -i test_policy.pp" 0 "Load test policy" - rlPhaseEnd - - rlPhaseStartTest - rlRun "runcon -t test_domain_t sysctl -a" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "semodule -r test_policy" 0 "Unload test policy" - rlRun "make -f /usr/share/selinux/devel/Makefile clean" 0 \ - "Clean the test policy" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/sysctl-avcs/test_policy.te b/kernel/sysctl-avcs/test_policy.te deleted file mode 100644 index bf53caa..0000000 --- a/kernel/sysctl-avcs/test_policy.te +++ /dev/null @@ -1,37 +0,0 @@ -policy_module(test_policy,1.0.0) - -type test_domain_t; -domain_type(test_domain_t) - -corecmd_bin_entry_type(test_domain_t) -kernel_read_all_sysctls(test_domain_t) -kernel_read_security_state(test_domain_t) -fs_read_binfmt_misc(test_domain_t) -fs_search_auto_mountpoints(test_domain_t) - -# No interface for this in policy: -require { - type binfmt_misc_fs_t; -} -list_dirs_pattern(test_domain_t, binfmt_misc_fs_t, binfmt_misc_fs_t) - -# Some BPF sysctls can only be read with CAP_SYS_ADMIN, so we need to silence -# it. -dontaudit test_domain_t self:capability sys_admin; - -require { - type TEST_TYPE; - role TEST_ROLE; -} -allow TEST_TYPE test_domain_t:process transition; -role TEST_ROLE types test_domain_t; - -allow test_domain_t TEST_TYPE:fd use; -allow test_domain_t TEST_TYPE:fifo_file rw_inherited_fifo_file_perms; -allow test_domain_t TEST_TYPE:process { sigchld }; - -files_search_tmp(test_domain_t) - -term_use_all_terms(test_domain_t) - -userdom_search_user_tmp_dirs(test_domain_t) diff --git a/kernel/wrong-rules-after-setsebool/Makefile b/kernel/wrong-rules-after-setsebool/Makefile deleted file mode 100644 index 1b54785..0000000 --- a/kernel/wrong-rules-after-setsebool/Makefile +++ /dev/null @@ -1,7 +0,0 @@ -# Minimal Makefile for standard-test-roles-beakerlib - -R="RhtsRequires: policycoreutils setools-console" - -run: - chmod +x runtest.sh - ./runtest.sh diff --git a/kernel/wrong-rules-after-setsebool/main.fmf b/kernel/wrong-rules-after-setsebool/main.fmf deleted file mode 100644 index 4dfcd12..0000000 --- a/kernel/wrong-rules-after-setsebool/main.fmf +++ /dev/null @@ -1,20 +0,0 @@ -summary: Regression test for broken rules after setting booleans -description: | - Test that conditional rules are not broken after changing SELinux booleans. - - Originally discovered in: - https://src.fedoraproject.org/tests/selinux/pull-request/203#comment-71053 -contact: Ondrej Mosnacek -component: -- kernel -framework: beakerlib -require: -- policycoreutils -- setools-console -duration: 5m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-7 - because: RHEL-6 and below are not worth supporting by this test diff --git a/kernel/wrong-rules-after-setsebool/runtest.sh b/kernel/wrong-rules-after-setsebool/runtest.sh deleted file mode 100755 index 6aad544..0000000 --- a/kernel/wrong-rules-after-setsebool/runtest.sh +++ /dev/null @@ -1,29 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2021 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "uname -r" - rlPhaseEnd - - rlPhaseStartTest - rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \ - tee sesearch-before.txt" - rlRun "setsebool ftpd_anon_write=off ftpd_connect_all_unreserved=off \ - ftpd_connect_db=off ftpd_full_access=off" - rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \ - tee sesearch-after.txt" - rlAssertNotDiffer "sesearch-before.txt" "sesearch-after.txt" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f sesearch-before.txt sesearch-after.txt" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/kernel/xfrm-refcount-underflow/main.fmf b/kernel/xfrm-refcount-underflow/main.fmf deleted file mode 100644 index a08b332..0000000 --- a/kernel/xfrm-refcount-underflow/main.fmf +++ /dev/null @@ -1,22 +0,0 @@ -summary: XFRM refcount underflow test -description: | - Test that allocating and deallocating XFRM state and/or policy - structures doesn't lead to selinux_xfrm_refcount imbalance and - underflow. -contact: Ondrej Mosnacek -component: - - kernel -framework: beakerlib -recommend: - - systemtap -duration: 15m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-7 - because: RHEL-6 and below are not worth supporting by this test -link: - - verifies: https://issues.redhat.com/browse/RHEL-27751 -extra-nitrate: TC#0617218 -id: d2bfb49c-fe12-48b5-8f17-8edf6f93810a diff --git a/kernel/xfrm-refcount-underflow/runtest.sh b/kernel/xfrm-refcount-underflow/runtest.sh deleted file mode 100755 index 42392ba..0000000 --- a/kernel/xfrm-refcount-underflow/runtest.sh +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2024 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -function installDepsYum() { - local yum="$1"; shift - - if "$yum" install --help | grep -q -- --skip-unavailable; then - "$yum" install -y --skip-unavailable $* - elif "$yum" install --help | grep -q -- --skip-broken; then - "$yum" install -y --skip-broken $* - else - for req in $*; do - if ! rpm -q --quiet --whatprovides "$req"; then - "$yum" install -y "$req" || true - fi - done - fi -} - -function installDeps() { - if type yum >/dev/null; then - installDepsYum yum "$@" - elif type dnf >/dev/null; then - installDepsYum dnf "$@" - fi -} - -rlJournalStart - rlPhaseStartSetup - # Determine the base kernel package name and version corresponding - # to the currently running kernel. Use this information to derive - # the correct kernel subpackages to install. - if KERNEL_CORE_NVRA="$(rpm -qf "/boot/vmlinuz-$(uname -r)")"; then - KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" - KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" - - KERNEL_PKG_VRA="${KERNEL_CORE_NVRA#$KERNEL_CORE_N-}" - KERNEL_PKG_BASE="${KERNEL_CORE_N%-core}" - - rlLog "Detected kernel package base name '$KERNEL_PKG_BASE' and version-release.arch '$KERNEL_PKG_VRA'" - KERNEL_PKGS="$KERNEL_PKG_BASE-devel-$KERNEL_PKG_VRA" - else - rlLog "Detected non-RPM running kernel - no extra kernel packages will be installed" - KERNEL_PKGS="" - fi - - rlRun "installDeps systemtap $KERNEL_PKGS" 0 "Install requires" - rlPhaseEnd - - rlPhaseStartTest - function dump_xfrm_refcount() { - local refcount_addr="0x$(grep selinux_xfrm_refcount /proc/kallsyms | cut -f 1 -d ' ')" - stap -e "probe begin { - printf(\"%i\\n\", atomic_read($refcount_addr)) - exit() - }" - } - rlRun "dump_xfrm_refcount" - rlAssertEquals "Assert that XFRM refcount is zero at the beginning" \ - "$(dump_xfrm_refcount)" 0 - rlRun "ip xfrm policy add src 127.0.0.1 dst 127.0.0.1 proto tcp dir out tmpl proto ah mode transport level required" 0 \ - "Add a dummy XFRM policy entry" - rlRun "ip xfrm state add src 127.0.0.1 dst 127.0.0.1 proto ah spi 0x200 auth sha1 0123456789012345" 0 \ - "Add a dummy XFRM state entry" - rlRun "ip xfrm policy flush" 0 "Clear XFRM policy entries" - rlRun "ip xfrm state flush" 0 "Clear XFRM state entries" - rlRun "dump_xfrm_refcount" - rlAssertEquals "Assert that XFRM refcount is still zero" \ - "$(dump_xfrm_refcount)" 0 - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/libselinux/container-selinux_crond/main.fmf b/libselinux/container-selinux_crond/main.fmf index 8078bd8..40f9694 100644 --- a/libselinux/container-selinux_crond/main.fmf +++ b/libselinux/container-selinux_crond/main.fmf @@ -1,21 +1,2 @@ -summary: Does installing container-selinux break crond? -description: | - Does installing container-selinux break crond? - See https://bugzilla.redhat.com/show_bug.cgi?id=1862823 - and https://bugzilla.redhat.com/show_bug.cgi?id=1879368 -contact: Vit Mojzis -component: - - libselinux -recommend: - - cronie - - container-selinux - - libselinux-utils - - policycoreutils -duration: 10m -tag: - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1862823 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1879368 -extra-summary: /CoreOS/libselinux/Regression/container-selinux_crond -extra-task: /CoreOS/libselinux/Regression/container-selinux_crond +path: /libselinux/container-selinux_crond +tier: 2 diff --git a/libselinux/container-selinux_crond/runtest.sh b/libselinux/container-selinux_crond/runtest.sh index 0963796..071537e 100755 --- a/libselinux/container-selinux_crond/runtest.sh +++ b/libselinux/container-selinux_crond/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" @@ -35,7 +36,7 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} rlAssertRpm cronie - rlRun "rpm -qa | grep -e container-selinux -e selinux-policy" + rlAssertRpm container-selinux rlRun "setenforce 1" rlRun "sestatus" OUTPUT_FILE=`mktemp` diff --git a/libselinux/get_default_context/main.fmf b/libselinux/get_default_context/main.fmf index 55bc274..229106f 100644 --- a/libselinux/get_default_context/main.fmf +++ b/libselinux/get_default_context/main.fmf @@ -1,36 +1,2 @@ -summary: Does get_default_context_with_rolelevel work as expected? -description: | - Perform lookup of a default context for system_u:system_r:crond_t. This should - return context derived from "system_r:system_cronjob_t", but fails, - because of a kernel bug, when libselinux uses security_compute_user - (deprecated). - See https://bugzilla.redhat.com/show_bug.cgi?id=1879368 -contact: Milos Malik -component: - - libselinux -recommend: - - python3 - - python3-libselinux - - libselinux - - libselinux-utils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1879368 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1884282 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0608317 -extra-summary: /CoreOS/libselinux/Regression/get_default_context -extra-task: /CoreOS/libselinux/Regression/get_default_context +path: /libselinux/get_default_context +tier: 1 diff --git a/libselinux/get_default_context/runtest.sh b/libselinux/get_default_context/runtest.sh index 94feae4..14c57fe 100755 --- a/libselinux/get_default_context/runtest.sh +++ b/libselinux/get_default_context/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" @@ -39,7 +40,7 @@ rlJournalStart rlRun "sestatus" rlPhaseEnd - if rlIsRHEL ">=8.3" || rlIsFedora || rlIsCentOS ">=8.3" ; then + if rlIsRHEL ">=8.3" || rlIsFedora; then rlPhaseStartTest "#1879368" rlRun "cat ./reproducer.py" rlRun "./reproducer.py" 0 diff --git a/libselinux/getpolicyload/main.fmf b/libselinux/getpolicyload/main.fmf deleted file mode 100644 index 0c19ee2..0000000 --- a/libselinux/getpolicyload/main.fmf +++ /dev/null @@ -1,23 +0,0 @@ -summary: basic test for the getpolicyload program -test: ./runtest.sh -framework: beakerlib -component: - - libselinux -recommend: - - libselinux - - libselinux-utils - - policycoreutils -duration: 5m -enabled: true -tag: - - NoRHIVOS -link: - - relates: https://issues.redhat.com/browse/RHEL-16233 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 - because: the getpolicyload program is not available there - - enabled: false - when: distro < fedora-40 - because: the getpolicyload program is not available there -extra-nitrate: TC#0615981 diff --git a/libselinux/getpolicyload/runtest.sh b/libselinux/getpolicyload/runtest.sh deleted file mode 100755 index 1954763..0000000 --- a/libselinux/getpolicyload/runtest.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm libselinux - rlAssertRpm libselinux-utils - rlAssertRpm policycoreutils - rlRun "sestatus" - rlPhaseEnd - - rlPhaseStartTest - for CMD in "semodule -R" "semodule -B" "semodule --refresh" "load_policy" "load_policy -i" ; do - BEFORE=`getpolicyload` - rlRun "getpolicyload" - rlRun "${CMD}" - AFTER=`getpolicyload` - rlRun "getpolicyload" - rlAssertGreater "the number of policy loads increased" ${AFTER} ${BEFORE} - done - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalEnd - diff --git a/libselinux/getsebool/main.fmf b/libselinux/getsebool/main.fmf index 9621457..9227c9b 100644 --- a/libselinux/getsebool/main.fmf +++ b/libselinux/getsebool/main.fmf @@ -1,27 +1,2 @@ -summary: Does getsebool work as expected? -description: |+ - Does getsebool work as expected? - -contact: Milos Malik -component: - - libselinux -recommend: - - libselinux -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - f32friendly - - f33friendly - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402140 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0549303 -extra-summary: /CoreOS/libselinux/Sanity/getsebool -extra-task: /CoreOS/libselinux/Sanity/getsebool +path: /libselinux/getsebool +tier: 1 diff --git a/libselinux/matchpathcon-in-chroot-env/Makefile b/libselinux/matchpathcon-in-chroot-env/Makefile deleted file mode 100644 index 0028f3e..0000000 --- a/libselinux/matchpathcon-in-chroot-env/Makefile +++ /dev/null @@ -1,67 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env -# Description: Does matchpathcon work correctly in chroot environment? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/libselinux/Regression/matchpathcon-in-chroot-env -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE test-script.sh test-script.py - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - test -x test-script.sh || chmod a+x test-script.sh - test -x test-script.py || chmod a+x test-script.py - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does matchpathcon work correctly in chroot environment?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: policycoreutils libselinux libselinux-utils python3-libselinux" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2295428" >> $(METADATA) # Fedora 41 - @echo "Bug: RHEL-46558" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/libselinux/matchpathcon-in-chroot-env/PURPOSE b/libselinux/matchpathcon-in-chroot-env/PURPOSE deleted file mode 100644 index 7cbb17e..0000000 --- a/libselinux/matchpathcon-in-chroot-env/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env -Author: Milos Malik - -Does matchpathcon work correctly in chroot environment? - diff --git a/libselinux/matchpathcon-in-chroot-env/main.fmf b/libselinux/matchpathcon-in-chroot-env/main.fmf deleted file mode 100644 index 8bc4d6f..0000000 --- a/libselinux/matchpathcon-in-chroot-env/main.fmf +++ /dev/null @@ -1,28 +0,0 @@ -summary: Does matchpathcon work correctly in chroot environment? -description: | - Does matchpathcon work correctly in chroot environment? - -contact: Milos Malik -component: - - libselinux -test: ./runtest.sh -framework: beakerlib -recommend: - - libselinux - - libselinux-utils - - python3-libselinux - - policycoreutils -duration: 15m -enabled: true -tier: 1 -tag: - - targeted - - CI-Tier-1 - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2295428 - - verifies: https://issues.redhat.com/browse/RHEL-46558 -extra-summary: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env -extra-task: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env -extra-nitrate: TC#0617627 -id: 649c1bfa-1739-4d87-8799-f37fd30499f4 diff --git a/libselinux/matchpathcon-in-chroot-env/runtest.sh b/libselinux/matchpathcon-in-chroot-env/runtest.sh deleted file mode 100755 index 5a98804..0000000 --- a/libselinux/matchpathcon-in-chroot-env/runtest.sh +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env -# Description: Does matchpathcon work correctly in chroot environment? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="libselinux" -CHROOT_DIR=`mktemp -d` -INSTALL_OPTION="" -if yum --help | grep -q use-host-config ; then - INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" -fi -if yum install --help | grep -q skip-broken ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" -fi -if yum install --help | grep -q skip-unavailable ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" -fi -# detect release version -test -e /etc/os-release && os_release='/etc/os-release' || os_release='/usr/lib/os-release' -. "${os_release}" -INSTALL_OPTION="${INSTALL_OPTION} --releasever ${VERSION_ID}" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-utils - rlPhaseEnd - - rlPhaseStartTest "bz#2295428 + RHEL-46558" - rlRun "yum -y install filesystem libselinux libselinux-utils python3-libselinux policycoreutils --installroot=${CHROOT_DIR} ${INSTALL_OPTION}" - rlRun "dmesg -c >& /dev/null" - rlRun "cp ./test-script.sh ${CHROOT_DIR}/usr/bin/" - rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.sh" - rlRun "grep -i -e 'segmentation' -e 'fault' $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlRun "cp ./test-script.py ${CHROOT_DIR}/usr/bin/" - rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.py" - rlRun "grep -i -e 'segmentation' -e 'fault' $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlRun "dmesg" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf ${CHROOT_DIR}" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/libselinux/matchpathcon-in-chroot-env/test-script.py b/libselinux/matchpathcon-in-chroot-env/test-script.py deleted file mode 100755 index 630741f..0000000 --- a/libselinux/matchpathcon-in-chroot-env/test-script.py +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/python3 - -import selinux -try: - selinux.matchpathcon("/dev", 16384) -except FileNotFoundError as e: - print(e) - diff --git a/libselinux/matchpathcon-in-chroot-env/test-script.sh b/libselinux/matchpathcon-in-chroot-env/test-script.sh deleted file mode 100755 index 77ee72f..0000000 --- a/libselinux/matchpathcon-in-chroot-env/test-script.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -sestatus -matchpathcon /dev ; true - diff --git a/libselinux/python-bindings/Makefile b/libselinux/python-bindings/Makefile index 9ba0613..f2068e4 100644 --- a/libselinux/python-bindings/Makefile +++ b/libselinux/python-bindings/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: python3-libselinux python3-pip" >> $(METADATA) + @echo "Requires: python3-libselinux" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libselinux/python-bindings/main.fmf b/libselinux/python-bindings/main.fmf index 8a2b690..03cdc91 100644 --- a/libselinux/python-bindings/main.fmf +++ b/libselinux/python-bindings/main.fmf @@ -1,12 +1,8 @@ +path: /libselinux/python-bindings summary: Import selinux python module, check its metadata -description: '' -contact: Petr Lautrbach -component: - - libselinux -recommend: - - python3-libselinux - - python3-pip -tag: - - NoRHIVOS -extra-summary: /CoreOS/libselinux/Sanity/python-bindings -extra-task: /CoreOS/libselinux/Sanity/python-bindings +description: | + The test compares rpm version with python module metadata version and + tries to use selinux python module in a simple operation +adjust: +- enabled: false + when: distro < rhel-8 diff --git a/libselinux/python-bindings/runtest.sh b/libselinux/python-bindings/runtest.sh index fcf2890..a8e9b11 100755 --- a/libselinux/python-bindings/runtest.sh +++ b/libselinux/python-bindings/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="python3-libselinux" @@ -46,14 +47,13 @@ rlJournalStart rlPhaseStartTest "Import selinux module and try selinux.is_selinux_enabled()" rlRun "python3 -c 'import selinux'" 0 - rlRun "python3 -c 'import selinux, sys; rc = selinux.is_selinux_enabled(); sys.exit(rc)'" 0,1 - - rlRun "PYTHON_SELINUX_ENABLED=$?" - if selinuxenabled; then - rlAssertEquals "SELinux is enabled" $PYTHON_SELINUX_ENABLED 1 - else - rlAssertNotEquals "SELinux is disabled" $PYTHON_SELINUX_ENABLED 0 - fi + rlRun "python3 -c 'import selinux; rc = selinux.is_selinux_enabled(); sys.exit(rc)'" 0,1 + rlRun "PYTHON_SELINUX_ENABLED=$?" + if selinuxenabled; then + rlAssertEquals "SELinux is enabled" $PYTHON_SELINUX_ENABLED 1 + else + rlAssertNotEquals "SELinux is disabled" $PYTHON_SELINUX_ENABLED 0 + fi rlPhaseEnd rlPhaseStartCleanup diff --git a/libselinux/realpath_not_final-function/PURPOSE b/libselinux/realpath_not_final-function/PURPOSE index 8fcf56a..8305d70 100644 --- a/libselinux/realpath_not_final-function/PURPOSE +++ b/libselinux/realpath_not_final-function/PURPOSE @@ -1,61 +1,3 @@ PURPOSE of /CoreOS/libselinux/Sanity/realpath_not_final-function Description: Test realpath_not_final function Author: Jan Zarsky - -Inputs - -compiled C source code - -Outputs - -Test passes or fail based on log file content - -Expected log output example - -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Test -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: - -:: [ 06:17:21 ] :: [ BEGIN ] :: Running './test NULL' -/usr/share/beakerlib/testing.sh: line 896: 39526 Segmentation fault (core dumped) ./test NULL -:: [ 06:17:22 ] :: [ PASS ] :: Command './test NULL' (Expected 139, got 139) -:: [ 06:17:22 ] :: [ BEGIN ] :: Running './test /somedir/somefile NULL' -symlink_realpath(/somedir/somefile) realpath() failed: No such file or directory -Executing: realpath_not_final(/somedir/somefile, resolved_path) -realpath_not_final: /somedir -:: [ 06:17:22 ] :: [ PASS ] :: Command './test /somedir/somefile NULL' (Expected 255, got 255) -:: [ 06:17:22 ] :: [ BEGIN ] :: Running './test NULL NULL' -/usr/share/beakerlib/testing.sh: line 896: 39584 Segmentation fault (core dumped) ./test NULL NULL -:: [ 06:17:23 ] :: [ PASS ] :: Command './test NULL NULL' (Expected 139, got 139) -:: [ 06:17:23 ] :: [ BEGIN ] :: Running './test /tmp | tee output' -Executing: realpath_not_final(/tmp, resolved_path) -realpath_not_final: /tmp -:: [ 06:17:23 ] :: [ PASS ] :: Command './test /tmp | tee output' (Expected 0, got 0) -:: [ 06:17:23 ] :: [ BEGIN ] :: Running 'grep 'realpath_not_final: /tmp' output' -realpath_not_final: /tmp -:: [ 06:17:23 ] :: [ PASS ] :: Command 'grep 'realpath_not_final: /tmp' output' (Expected 0, got 0) -:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test //tmp | tee output' -Executing: realpath_not_final(//tmp, resolved_path) -realpath_not_final: //tmp -:: [ 06:17:24 ] :: [ PASS ] :: Command './test //tmp | tee output' (Expected 0, got 0) -:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' -realpath_not_final: //tmp -:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0) -:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test ///tmp | tee output' -Executing: realpath_not_final(///tmp, resolved_path) -realpath_not_final: //tmp -:: [ 06:17:24 ] :: [ PASS ] :: Command './test ///tmp | tee output' (Expected 0, got 0) -:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' -realpath_not_final: //tmp -:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0) -:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test ////tmp | tee output' -Executing: realpath_not_final(////tmp, resolved_path) -realpath_not_final: //tmp -:: [ 06:17:24 ] :: [ PASS ] :: Command './test ////tmp | tee output' (Expected 0, got 0) -:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' -realpath_not_final: //tmp -:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0) -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Duration: 3s -:: Assertions: 11 good, 0 bad -:: RESULT: PASS (Test) diff --git a/libselinux/realpath_not_final-function/main.fmf b/libselinux/realpath_not_final-function/main.fmf index e22cf47..52d16d0 100644 --- a/libselinux/realpath_not_final-function/main.fmf +++ b/libselinux/realpath_not_final-function/main.fmf @@ -1,31 +1 @@ -summary: Test realpath_not_final function -description: '' -contact: Milos Malik -component: - - libselinux -recommend: - - libselinux - - libselinux-devel - - glibc - - gcc -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - fusa -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1404644 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0544859 -extra-summary: /CoreOS/libselinux/Sanity/realpath_not_final-function -extra-task: /CoreOS/libselinux/Sanity/realpath_not_final-function +path: /libselinux/realpath_not_final-function diff --git a/libselinux/selabel-functions/PURPOSE b/libselinux/selabel-functions/PURPOSE index d718413..aa07643 100644 --- a/libselinux/selabel-functions/PURPOSE +++ b/libselinux/selabel-functions/PURPOSE @@ -1,73 +1,3 @@ PURPOSE of /CoreOS/libselinux/Sanity/selabel-functions Description: Test selabel functions Author: Jan Zarsky - -Inputs - -compiled C source code - -Outputs - -Test passes or fail based on log file content - -Expected log output example - -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: selabel_lookup and selabel_lookup_raw -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: - -:: [ 06:17:59 ] :: [ INFO ] :: Handle -:: [ 06:17:59 ] :: [ BEGIN ] :: Running './test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle' -/usr/share/beakerlib/testing.sh: line 896: 45881 Segmentation fault (core dumped) ./test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle -:: [ 06:18:00 ] :: [ PASS ] :: Command './test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) -:: [ 06:18:00 ] :: [ BEGIN ] :: Running './test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle' -/usr/share/beakerlib/testing.sh: line 896: 45913 Segmentation fault (core dumped) ./test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle -:: [ 06:18:01 ] :: [ PASS ] :: Command './test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) -:: [ 06:18:02 ] :: [ BEGIN ] :: Running './test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle' -/usr/share/beakerlib/testing.sh: line 896: 45945 Segmentation fault (core dumped) ./test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle -:: [ 06:18:03 ] :: [ PASS ] :: Command './test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) -:: [ 06:18:03 ] :: [ BEGIN ] :: Running './test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle' -/usr/share/beakerlib/testing.sh: line 896: 45977 Segmentation fault (core dumped) ./test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle -:: [ 06:18:04 ] :: [ PASS ] :: Command './test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) -:: [ 06:18:04 ] :: [ INFO ] :: Path -:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_FILE NULL NULL 0 0 NULL 0' -selabel_lookup - ERROR: Invalid argument -selabel_lookup_raw - ERROR: Invalid argument -selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 -Executing: selabel_open(SELABEL_CTX_FILE, &selabel_option, 4) -Executing: selabel_lookup(hnd, &selabel_context, (null), 0) -Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) -:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_FILE NULL NULL 0 0 NULL 0' (Expected 22, got 22) -:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0' -selabel_lookup - ERROR: Invalid argument -selabel_lookup_raw - ERROR: Invalid argument -selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 -Executing: selabel_open(SELABEL_CTX_MEDIA, &selabel_option, 4) -Executing: selabel_lookup(hnd, &selabel_context, (null), 0) -Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) -:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0' (Expected 22, got 22) -:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_X NULL NULL 0 0 NULL 0' -selabel_lookup - ERROR: Invalid argument -selabel_lookup_raw - ERROR: Invalid argument -selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 -Executing: selabel_open(SELABEL_CTX_X, &selabel_option, 4) -Executing: selabel_lookup(hnd, &selabel_context, (null), 0) -Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) -:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_X NULL NULL 0 0 NULL 0' (Expected 22, got 22) -:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_DB NULL NULL 0 0 NULL 0' -selabel_lookup - ERROR: Invalid argument -selabel_lookup_raw - ERROR: Invalid argument -selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 -Executing: selabel_open(SELABEL_CTX_DB, &selabel_option, 4) -Executing: selabel_lookup(hnd, &selabel_context, (null), 0) -Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) -:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_DB NULL NULL 0 0 NULL 0' (Expected 22, got 22) -:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_ANDROID_PROP NULL NULL 0 0 NULL 0' -selabel_open - ERROR: Operation not supported -selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 -Executing: selabel_open(SELABEL_CTX_ANDROID_PROP, &selabel_option, 4) -:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_ANDROID_PROP NULL NULL 0 0 NULL 0' (Expected 255, got 255) -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Duration: 6s -:: Assertions: 9 good, 0 bad -:: RESULT: PASS (selabel_lookup and selabel_lookup_raw) diff --git a/libselinux/selabel-functions/main.fmf b/libselinux/selabel-functions/main.fmf index c61f519..222b1c8 100644 --- a/libselinux/selabel-functions/main.fmf +++ b/libselinux/selabel-functions/main.fmf @@ -1,31 +1 @@ -summary: Test selabel functions -description: '' -contact: Milos Malik -component: - - libselinux -recommend: - - libselinux - - libselinux-devel - - glibc - - gcc -enabled: true -duration: 10m -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - TierCandidatesPASS - - f33friendly - - targeted - - fusa -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390909 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0536014 -extra-summary: /CoreOS/libselinux/Sanity/selabel-functions -extra-task: /CoreOS/libselinux/Sanity/selabel-functions +path: /libselinux/selabel-functions diff --git a/libselinux/selabel-functions/runtest.sh b/libselinux/selabel-functions/runtest.sh index 6a9c404..64d593f 100755 --- a/libselinux/selabel-functions/runtest.sh +++ b/libselinux/selabel-functions/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" diff --git a/libselinux/selabel-functions/test_best.c b/libselinux/selabel-functions/test_best.c index ffa1ade..7eca4f4 100644 --- a/libselinux/selabel-functions/test_best.c +++ b/libselinux/selabel-functions/test_best.c @@ -13,9 +13,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_UNUSED, NULL }, + { SELABEL_OPT_SUBSET, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_UNUSED, NULL } + { SELABEL_OPT_BASEONLY, (char *) 1 } }; if (argc < 8) { @@ -52,11 +52,11 @@ int main (int argc, char **argv) } // set subset - if (backend == SELABEL_CTX_FILE) { - selabel_option[1].type = SELABEL_OPT_SUBSET; - if (strcmp(argv[3], "NULL") != 0) { - selabel_option[1].value = argv[3]; - } + if (strcmp(argv[3], "NULL") == 0) { + selabel_option[1].value = NULL; + } + else { + selabel_option[1].value = argv[3]; } // set validate @@ -68,11 +68,11 @@ int main (int argc, char **argv) } // set baseonly - if (backend == SELABEL_CTX_FILE) { - selabel_option[3].type = SELABEL_OPT_BASEONLY; - if (strcmp(argv[5], "0") != 0) { - selabel_option[3].value = (char *) 1; - } + if (strcmp(argv[5], "0") == 0) { + selabel_option[3].value = NULL; + } + else { + selabel_option[3].value = (char *) 1; } printf("selabel_options: "); diff --git a/libselinux/selabel-functions/test_lookup.c b/libselinux/selabel-functions/test_lookup.c index 268e460..ee0caaa 100644 --- a/libselinux/selabel-functions/test_lookup.c +++ b/libselinux/selabel-functions/test_lookup.c @@ -13,9 +13,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_UNUSED, NULL }, + { SELABEL_OPT_SUBSET, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_UNUSED, NULL } + { SELABEL_OPT_BASEONLY, (char *) 1 } }; if (argc < 8) { @@ -53,11 +53,11 @@ int main (int argc, char **argv) } // set subset - if (backend == SELABEL_CTX_FILE) { - selabel_option[1].type = SELABEL_OPT_SUBSET; - if (strcmp(argv[3], "NULL") != 0) { - selabel_option[1].value = argv[3]; - } + if (strcmp(argv[3], "NULL") == 0) { + selabel_option[1].value = NULL; + } + else { + selabel_option[1].value = argv[3]; } // set validate @@ -69,11 +69,11 @@ int main (int argc, char **argv) } // set baseonly - if (backend == SELABEL_CTX_FILE) { - selabel_option[3].type = SELABEL_OPT_BASEONLY; - if (strcmp(argv[5], "0") != 0) { - selabel_option[3].value = (char *) 1; - } + if (strcmp(argv[5], "0") == 0) { + selabel_option[3].value = NULL; + } + else { + selabel_option[3].value = (char *) 1; } printf("selabel_options: "); diff --git a/libselinux/selabel-functions/test_open.c b/libselinux/selabel-functions/test_open.c index f19f720..87f61ee 100644 --- a/libselinux/selabel-functions/test_open.c +++ b/libselinux/selabel-functions/test_open.c @@ -14,9 +14,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_UNUSED, NULL }, + { SELABEL_OPT_SUBSET, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_UNUSED, NULL } + { SELABEL_OPT_BASEONLY, (char *) 1 } }; if (argc < 6) { @@ -49,12 +49,12 @@ int main (int argc, char **argv) } // set subset - if (backend == SELABEL_CTX_FILE) { - selabel_option[1].type = SELABEL_OPT_SUBSET; - if (strcmp(argv[3], "NULL") != 0) { - selabel_option[1].value = argv[3]; - } - } + if (strcmp(argv[3], "NULL") == 0) { + selabel_option[1].value = NULL; + } + else { + selabel_option[1].value = argv[3]; + } // set validate if (strcmp(argv[4], "0") == 0) { @@ -65,12 +65,12 @@ int main (int argc, char **argv) } // set baseonly - if (backend == SELABEL_CTX_FILE) { - selabel_option[3].type = SELABEL_OPT_BASEONLY; - if (strcmp(argv[5], "0") != 0) { - selabel_option[3].value = (char *) 1; - } - } + if (strcmp(argv[5], "0") == 0) { + selabel_option[3].value = NULL; + } + else { + selabel_option[3].value = (char *) 1; + } if (argc == 7) { nopt = strtol(argv[6], NULL, 10); diff --git a/libselinux/selabel-functions/test_partial.c b/libselinux/selabel-functions/test_partial.c index dd60016..4513cfa 100644 --- a/libselinux/selabel-functions/test_partial.c +++ b/libselinux/selabel-functions/test_partial.c @@ -13,9 +13,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_UNUSED, NULL }, + { SELABEL_OPT_SUBSET, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_UNUSED, NULL } + { SELABEL_OPT_BASEONLY, (char *) 1 } }; if (argc < 7) { @@ -52,11 +52,11 @@ int main (int argc, char **argv) } // set subset - if (backend == SELABEL_CTX_FILE) { - selabel_option[1].type = SELABEL_OPT_SUBSET; - if (strcmp(argv[3], "NULL") != 0) { - selabel_option[1].value = argv[3]; - } + if (strcmp(argv[3], "NULL") == 0) { + selabel_option[1].value = NULL; + } + else { + selabel_option[1].value = argv[3]; } // set validate @@ -68,11 +68,11 @@ int main (int argc, char **argv) } // set baseonly - if (backend == SELABEL_CTX_FILE) { - selabel_option[3].type = SELABEL_OPT_BASEONLY; - if (strcmp(argv[5], "0") != 0) { - selabel_option[3].value = (char *) 1; - } + if (strcmp(argv[5], "0") == 0) { + selabel_option[3].value = NULL; + } + else { + selabel_option[3].value = (char *) 1; } printf("selabel_options: "); diff --git a/libselinux/selabel_lookup-and-local-changes/main.fmf b/libselinux/selabel_lookup-and-local-changes/main.fmf deleted file mode 100644 index ed09439..0000000 --- a/libselinux/selabel_lookup-and-local-changes/main.fmf +++ /dev/null @@ -1,24 +0,0 @@ -summary: Test selabel_lookup with local fcontext modifications -description: We need to be sure that different of local fcontext modifications are consistently resolved -test: ./test.sh -framework: beakerlib -contact: Petr Lautrbach -component: - - libselinux -require: - - libselinux-utils - - policycoreutils-python-utils -enabled: true -duration: 10m -tier: 1 -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2360183 -id: 586ca788-80fa-4ec6-8cea-36fe7520388b diff --git a/libselinux/selabel_lookup-and-local-changes/test.sh b/libselinux/selabel_lookup-and-local-changes/test.sh deleted file mode 100755 index 1a944b7..0000000 --- a/libselinux/selabel_lookup-and-local-changes/test.sh +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PATHS="/rc.d/init.d/test42XYZ-selabel -/usr/bin/test42XYZ-selabel_lookup -/var/lib/test42XYZ-selabel_lookup/bestmatch" - -PATHSPECS='/rc\.d/init\.d/test42XYZ-(selabel|lookup) -/usr/bin/test42XYZ-selabel_lookup -/var/lib/test42XYZ-selabel_lookup(/.*)?' - -rlJournalStart - rlPhaseStartSetup - rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" - rlRun "pushd $tmp" - rlRun "set -o pipefail" - rlPhaseEnd - - rlPhaseStartTest - echo -n '' > test-selabel-lookup.cil - for pathspec in $PATHSPECS; do - echo "(filecon \"${pathspec}\" file (system_u object_r shell_exec_t ((s0) (s0))))" >> test-selabel-lookup.cil - done - rlRun "cat test-selabel-lookup.cil" - rlRun "semodule -i test-selabel-lookup.cil" - for path in $PATHS; do - rlRun -s "selabel_lookup -b file -k ${path}" - rlAssertGrep shell_exec_t $rlRun_LOG - done - for pathspec in $PATHSPECS; do - rlRun "semanage fcontext -a -t bin_t '${pathspec}'" - done - rlRun "semanage fcontext -l -C" - for path in $PATHS; do - rlRun -s "selabel_lookup -b file -k ${path}" - rlAssertGrep bin_t $rlRun_LOG - - echo $? - rlRun "matchpathcon ${path}" - done - for pathspec in $PATHSPECS; do - rlRun "semanage fcontext -d -t bin_t '${pathspec}'" - done - rlRun "semodule -r test-selabel-lookup" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $tmp" 0 "Remove tmp directory" - rlPhaseEnd -rlJournalEnd diff --git a/libselinux/selinux_boolean_sub-function/PURPOSE b/libselinux/selinux_boolean_sub-function/PURPOSE index a34845b..289e8e7 100644 --- a/libselinux/selinux_boolean_sub-function/PURPOSE +++ b/libselinux/selinux_boolean_sub-function/PURPOSE @@ -1,57 +1,3 @@ PURPOSE of /CoreOS/libselinux/Sanity/selinux_boolean_sub-function Description: Test selinux_boolean_sub function Author: Jan Zarsky - -Inputs - -compiled C source code - -Outputs - -Test passes or fail based on log file content - -Expected log output example - -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Test -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: - -:: [ 06:19:03 ] :: [ BEGIN ] :: Running './test NULL | tee output' -Executing: selinux_boolean_sub((null)) -selinux_boolean_sub: (null) -:: [ 06:19:04 ] :: [ PASS ] :: Command './test NULL | tee output' (Expected 0, got 0) -:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: (null)' output' -selinux_boolean_sub: (null) -:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: (null)' output' (Expected 0, got 0) -:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test my_nonexisting_record | tee output' -Executing: selinux_boolean_sub(my_nonexisting_record) -selinux_boolean_sub: my_nonexisting_record -:: [ 06:19:04 ] :: [ PASS ] :: Command './test my_nonexisting_record | tee output' (Expected 0, got 0) -:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: my_nonexisting_record' output' -selinux_boolean_sub: my_nonexisting_record -:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: my_nonexisting_record' output' (Expected 0, got 0) -:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test allow_auditadm_exec_content | tee output' -Executing: selinux_boolean_sub(allow_auditadm_exec_content) -selinux_boolean_sub: auditadm_exec_content -:: [ 06:19:04 ] :: [ PASS ] :: Command './test allow_auditadm_exec_content | tee output' (Expected 0, got 0) -:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: auditadm_exec_content' output' -selinux_boolean_sub: auditadm_exec_content -:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: auditadm_exec_content' output' (Expected 0, got 0) -:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test allow_domain_fd_use | tee output' -Executing: selinux_boolean_sub(allow_domain_fd_use) -selinux_boolean_sub: domain_fd_use -:: [ 06:19:04 ] :: [ PASS ] :: Command './test allow_domain_fd_use | tee output' (Expected 0, got 0) -:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: domain_fd_use' output' -selinux_boolean_sub: domain_fd_use -:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: domain_fd_use' output' (Expected 0, got 0) -:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test virt_sandbox_use_nfs | tee output' -Executing: selinux_boolean_sub(virt_sandbox_use_nfs) -selinux_boolean_sub: virt_use_nfs -:: [ 06:19:04 ] :: [ PASS ] :: Command './test virt_sandbox_use_nfs | tee output' (Expected 0, got 0) -:: [ 06:19:05 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: virt_use_nfs' output' -selinux_boolean_sub: virt_use_nfs -:: [ 06:19:05 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: virt_use_nfs' output' (Expected 0, got 0) -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Duration: 2s -:: Assertions: 10 good, 0 bad -:: RESULT: PASS (Test) diff --git a/libselinux/selinux_boolean_sub-function/main.fmf b/libselinux/selinux_boolean_sub-function/main.fmf index e370b46..efc0f9f 100644 --- a/libselinux/selinux_boolean_sub-function/main.fmf +++ b/libselinux/selinux_boolean_sub-function/main.fmf @@ -1,29 +1 @@ -summary: Test selinux_boolean_sub function -description: '' -contact: Milos Malik -component: - - libselinux -recommend: - - libselinux - - libselinux-devel - - glibc - - gcc -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - fusa -tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0544857 -extra-summary: /CoreOS/libselinux/Sanity/selinux_boolean_sub-function -extra-task: /CoreOS/libselinux/Sanity/selinux_boolean_sub-function +path: /libselinux/selinux_boolean_sub-function diff --git a/libselinux/selinux_restorecon-functions/Makefile b/libselinux/selinux_restorecon-functions/Makefile index f826c98..631f5a8 100644 --- a/libselinux/selinux_restorecon-functions/Makefile +++ b/libselinux/selinux_restorecon-functions/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: libselinux libselinux-devel glibc strace gcc" >> $(METADATA) + @echo "Requires: libselinux libselinux-devel glibc strace" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libselinux/selinux_restorecon-functions/PURPOSE b/libselinux/selinux_restorecon-functions/PURPOSE index a51df62..8a2f7ba 100644 --- a/libselinux/selinux_restorecon-functions/PURPOSE +++ b/libselinux/selinux_restorecon-functions/PURPOSE @@ -1,40 +1,3 @@ PURPOSE of /CoreOS/libselinux/Sanity/selinux_restorecon-functions Description: Test functions in selinux_restorecon.c Author: Jan Zarsky - -Inputs - -compiled C source code - -Outputs - -Test passes or fail based on log files content - -Expected log output example - -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: /sys directory -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: - -:: [ 06:19:36 ] :: [ BEGIN ] :: Calling selinux_restorecon on /tmp :: actually running 'strace -ostrace.out -s 64 ./test_restorecon /var/log RECURSE NOCHANGE' -Running selinux_restorecon("/var/log", 0x00000a); -:: [ 06:19:36 ] :: [ PASS ] :: Calling selinux_restorecon on /tmp (Expected 0, got 0) -:: [ 06:19:37 ] :: [ BEGIN ] :: Running 'grep -E "security\.(restorecon_last|sehash)" strace.out' -getxattr("/var/log", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) -getxattr("/var/log/journal", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) -getxattr("/var/log/journal/9f26e28ec0b04e2bbb812e4227ff5bb3", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) -getxattr("/var/log/chrony", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) -getxattr("/var/log/private", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) -getxattr("/var/log/audit", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) -:: [ 06:19:37 ] :: [ PASS ] :: Command 'grep -E "security\.(restorecon_last|sehash)" strace.out' (Expected 0, got 0) -:: [ 06:19:37 ] :: [ BEGIN ] :: Calling selinux_restorecon on /sys :: actually running 'strace -ostrace.out -s 64 ./test_restorecon /sys RECURSE NOCHANGE' -Running selinux_restorecon("/sys", 0x00000a); -:: [ 06:19:55 ] :: [ PASS ] :: Calling selinux_restorecon on /sys (Expected 0, got 0) -:: [ 06:19:55 ] :: [ BEGIN ] :: Running 'grep -E "security\.(restorecon_last|sehash)" strace.out' -:: [ 06:19:55 ] :: [ PASS ] :: Command 'grep -E "security\.(restorecon_last|sehash)" strace.out' (Expected 1, got 1) -:: [ 06:19:55 ] :: [ BEGIN ] :: Running 'rm -f strace.out' -:: [ 06:19:55 ] :: [ PASS ] :: Command 'rm -f strace.out' (Expected 0, got 0) -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Duration: 19s -:: Assertions: 5 good, 0 bad -:: RESULT: PASS (/sys directory) diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index f6e1a3e..29aaadf 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -1,30 +1 @@ -summary: Test functions in selinux_restorecon.c -description: '' -contact: Milos Malik -component: - - libselinux -recommend: - - libselinux - - libselinux-devel - - glibc - - gcc - - strace - - gcc -enabled: true -duration: 10m -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - TierCandidatesPASS - - targeted - - fusa -tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0535421 -extra-summary: /CoreOS/libselinux/Sanity/selinux_restorecon-functions -extra-task: /CoreOS/libselinux/Sanity/selinux_restorecon-functions +path: /libselinux/selinux_restorecon-functions diff --git a/libselinux/selinux_restorecon-functions/runtest.sh b/libselinux/selinux_restorecon-functions/runtest.sh index b09e6f4..2f1b7bd 100755 --- a/libselinux/selinux_restorecon-functions/runtest.sh +++ b/libselinux/selinux_restorecon-functions/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" @@ -111,8 +112,8 @@ rlJournalStart rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir" 0 "Calling selinux_restorecon" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep var_log_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep var_log_t" 1 @@ -121,8 +122,8 @@ rlJournalStart rlRun "grep \"\\\"$TmpDir/a/bfile\\\"\" strace_xattr.out | grep var_log_t" 1 rlRun "grep \"\\\"$TmpDir/a/b/cfile\\\"\" strace_xattr.out | grep var_log_t" 1 - rlLogInfo "Checking setxattr calls" - rlRun "grep setxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lsetxattr calls" + rlRun "grep lsetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep user_home_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep user_home_t" 1 @@ -143,8 +144,8 @@ rlJournalStart rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon with RECURSE flag" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep var_log_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep var_log_t" @@ -153,8 +154,8 @@ rlJournalStart rlRun "grep \"\\\"$TmpDir/a/bfile\\\"\" strace_xattr.out | grep var_log_t" rlRun "grep \"\\\"$TmpDir/a/b/cfile\\\"\" strace_xattr.out | grep var_log_t" - rlLogInfo "Checking setxattr calls" - rlRun "grep setxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lsetxattr calls" + rlRun "grep lsetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep user_home_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep user_home_t" @@ -175,8 +176,8 @@ rlJournalStart rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE NOCHANGE" 0 "Calling selinux_restorecon with NOCHANGE flag" - rlLogInfo "Checking setxattr calls" - rlRun "grep setxattr strace.out" 1 + rlLogInfo "Checking lsetxattr calls" + rlRun "grep lsetxattr strace.out" 1 rlRun "rm -f strace.out" @@ -203,8 +204,8 @@ rlJournalStart # run restorecon first time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon for the first time" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -216,8 +217,8 @@ rlJournalStart # run restorecon second time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon for the second time" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux" 1 + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux" 1 rlRun "rm -f strace.out" rlRun "rm -f strace_xattr.out" @@ -231,8 +232,8 @@ rlJournalStart # run restorecon first time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon for the first time" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -244,8 +245,8 @@ rlJournalStart # run restorecon second time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE IGNORE_DIGEST" 0 "Calling selinux_restorecon for the second time" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -266,8 +267,8 @@ rlJournalStart # empty exclude list rlRun "strace -ostrace.out -s 64 ./test_exclude_list EMPTY $TmpDir" 0 "Calling selinux_restorecon_set_exclude_list with empty list" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -279,8 +280,8 @@ rlJournalStart # exclude $TmpDir/a rlRun "strace -ostrace.out -s 64 ./test_exclude_list $TmpDir/a $TmpDir" 0 "Calling selinux_restorecon_set_exclude_list" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" 1 @@ -301,8 +302,8 @@ rlJournalStart # default sehandle rlRun "strace -ostrace.out -s 64 ./test_sehandle DEFAULT $TmpDir" 0 "Calling selinux_restorecon_set_sehandle with default handle" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -314,8 +315,8 @@ rlJournalStart # custom sehandle rlRun "strace -ostrace.out -s 64 ./test_sehandle CUSTOM $TmpDir" 0 "Calling selinux_restorecon_set_sehandle with custom handle" - rlLogInfo "Checking getxattr calls" - rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking lgetxattr calls" + rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" diff --git a/libselinux/selinux_sestatus-functions/Makefile b/libselinux/selinux_sestatus-functions/Makefile index 0693800..d3ad9e8 100644 --- a/libselinux/selinux_sestatus-functions/Makefile +++ b/libselinux/selinux_sestatus-functions/Makefile @@ -41,6 +41,7 @@ build: $(BUILT_FILES) clean: rm -f *~ $(BUILT_FILES) + include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile @@ -52,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: libselinux libselinux-devel glibc gcc" >> $(METADATA) + @echo "Requires: libselinux libselinux-devel glibc" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @@ -60,4 +61,3 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) rhts-lint $(METADATA) - diff --git a/libselinux/selinux_sestatus-functions/PURPOSE b/libselinux/selinux_sestatus-functions/PURPOSE index 26011d7..c638364 100644 --- a/libselinux/selinux_sestatus-functions/PURPOSE +++ b/libselinux/selinux_sestatus-functions/PURPOSE @@ -1,79 +1,3 @@ PURPOSE of /CoreOS/libselinux/Sanity/selinux_sestatus-functions Description: Test sestatus.c functions Author: Jan Zarsky - -Inputs - -compiled C source code - -Outputs - -Test passes or fail based on res.txt file content - -Expected log output example - -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Test -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: - -:: [ 06:20:25 ] :: [ BEGIN ] :: Running './test > res.txt' -:: [ 06:20:25 ] :: [ PASS ] :: Command './test > res.txt' (Expected 0, got 0) -:: [ 06:20:25 ] :: [ BEGIN ] :: Running 'cat res.txt' -(before open) selinux_status_getenforce -1 -(before open) selinux_status_policyload -1 -(before open) selinux_status_deny_unknown -1 -(before open) selinux_status_updated -1 -selinux_status_open 0 -selinux_status_getenforce 1 -selinux_status_policyload 7 -selinux_status_deny_unknown 0 -selinux_status_updated 0 -selinux_status_close void -:: [ 06:20:26 ] :: [ LOG ] :: Output of 'cat res.txt': -:: [ 06:20:26 ] :: [ LOG ] :: --------------- OUTPUT START --------------- -:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_getenforce -1 -:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_policyload -1 -:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_deny_unknown -1 -:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_updated -1 -:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_open 0 -:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_getenforce 1 -:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_policyload 7 -:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_deny_unknown 0 -:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_updated 0 -:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_close void -:: [ 06:20:26 ] :: [ LOG ] :: --------------- OUTPUT END --------------- -:: [ 06:20:26 ] :: [ PASS ] :: Command 'cat res.txt' (Expected 0, got 0) -:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_getenforce -1" res.txt' -(before open) selinux_status_getenforce -1 -:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_getenforce -1" res.txt' (Expected 0, got 0) -:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_policyload -1" res.txt' -(before open) selinux_status_policyload -1 -:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_policyload -1" res.txt' (Expected 0, got 0) -:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_deny_unknown -1" res.txt' -(before open) selinux_status_deny_unknown -1 -:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_deny_unknown -1" res.txt' (Expected 0, got 0) -:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_updated -1" res.txt' -(before open) selinux_status_updated -1 -:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_updated -1" res.txt' (Expected 0, got 0) -:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "selinux_status_open 0" res.txt' -selinux_status_open 0 -:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "selinux_status_open 0" res.txt' (Expected 0, got 0) -:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "selinux_status_getenforce 1" res.txt' -selinux_status_getenforce 1 -:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "selinux_status_getenforce 1" res.txt' (Expected 0, got 0) -:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep -E "selinux_status_policyload [0-9]" res.txt' -selinux_status_policyload 7 -:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep -E "selinux_status_policyload [0-9]" res.txt' (Expected 0, got 0) -:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_deny_unknown 0" res.txt' -selinux_status_deny_unknown 0 -:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_deny_unknown 0" res.txt' (Expected 0, got 0) -:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_updated 0" res.txt' -selinux_status_updated 0 -:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_updated 0" res.txt' (Expected 0, got 0) -:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_close void" res.txt' -selinux_status_close void -:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_close void" res.txt' (Expected 0, got 0) -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Duration: 2s -:: Assertions: 12 good, 0 bad -:: RESULT: PASS (Test) diff --git a/libselinux/selinux_sestatus-functions/main.fmf b/libselinux/selinux_sestatus-functions/main.fmf index cb94b2f..53e4ba1 100644 --- a/libselinux/selinux_sestatus-functions/main.fmf +++ b/libselinux/selinux_sestatus-functions/main.fmf @@ -1,30 +1 @@ -summary: Test sestatus.c functions -description: '' -contact: Milos Malik -component: - - libselinux -recommend: - - libselinux - - libselinux-devel - - glibc - - gcc -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - fusa -tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0535409 -extra-summary: /CoreOS/libselinux/Sanity/selinux_sestatus-functions -extra-task: /CoreOS/libselinux/Sanity/selinux_sestatus-functions +path: /libselinux/selinux_sestatus-functions diff --git a/libselinux/selinux_set_callback/main.fmf b/libselinux/selinux_set_callback/main.fmf index e60ab41..3d61e91 100644 --- a/libselinux/selinux_set_callback/main.fmf +++ b/libselinux/selinux_set_callback/main.fmf @@ -1,32 +1 @@ -summary: Test selinux_set_callback function -description: '' -contact: Milos Malik -component: - - libselinux -test: ./runtest.sh -framework: beakerlib -recommend: - - libselinux - - gcc - - glibc - - libselinux-devel -duration: 5m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - NoRHIVOS -tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0540241 -extra-summary: /CoreOS/libselinux/Sanity/selinux_set_callback -extra-task: /CoreOS/libselinux/Sanity/selinux_set_callback +path: /libselinux/selinux_set_callback diff --git a/libselinux/selinux_set_callback/test_callback.c b/libselinux/selinux_set_callback/test_callback.c index 9a4cd62..240bd11 100644 --- a/libselinux/selinux_set_callback/test_callback.c +++ b/libselinux/selinux_set_callback/test_callback.c @@ -58,8 +58,8 @@ int main (int argc, char **argv) { } printf("calling avc_audit to call audit and log functions\n"); - - avc_open(NULL, 0); + + avc_init("", NULL, NULL, NULL, NULL); struct security_id ssid = { "asdf", 5 }; struct security_id tsid = { "asdf", 5 }; @@ -99,9 +99,11 @@ int main (int argc, char **argv) { if (enforcing == 1) { security_setenforce(0); + security_setenforce(1); } else { security_setenforce(1); + security_setenforce(0); } // triggers callbacks @@ -121,14 +123,5 @@ int main (int argc, char **argv) { // triggers callbacks avc_has_perm_noaudit(&ssid, &tsid, 0, 1, NULL, &avd); - printf("switch enforcing back to %d\n", enforcing); - enforcing = security_getenforce(); - if (enforcing == 1) { - security_setenforce(0); - } - else { - security_setenforce(1); - } - return exit_code; } diff --git a/libselinux/setenforce/PURPOSE b/libselinux/setenforce/PURPOSE index dd776a1..de8a77e 100644 --- a/libselinux/setenforce/PURPOSE +++ b/libselinux/setenforce/PURPOSE @@ -3,43 +3,3 @@ Author: Milos Malik Does setenforce work as expected? Does it produce correct audit messages? -Inputs - -Various setups related to setenforce - -Outputs - -Test passes or fail based on ausearch resutls - -Expected log output example - -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: basic use -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: - -:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 1' -:: [ 06:20:45 ] :: [ PASS ] :: Command 'setenforce 1' (Expected 0, got 0) -:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'grep 1 /sys/fs/selinux/enforce' -1 -:: [ 06:20:45 ] :: [ PASS ] :: Command 'grep 1 /sys/fs/selinux/enforce' (Expected 0, got 0) -:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 0' -:: [ 06:20:45 ] :: [ PASS ] :: Command 'setenforce 0' (Expected 0, got 0) -:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'grep 0 /sys/fs/selinux/enforce' -0 -:: [ 06:20:45 ] :: [ PASS ] :: Command 'grep 0 /sys/fs/selinux/enforce' (Expected 0, got 0) -:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 1' -:: [ 06:20:46 ] :: [ PASS ] :: Command 'setenforce 1' (Expected 0, got 0) -:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=1.*old_enforcing=0'' -type=MAC_STATUS msg=audit(03/10/2025 06:20:45.979:2609) : enforcing=1 old_enforcing=0 auid=root ses=10 enabled=1 old-enabled=1 lsm=selinux res=yes -:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=1.*old_enforcing=0'' (Expected 0, got 0) -:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=0.*old_enforcing=1'' -type=MAC_STATUS msg=audit(03/10/2025 06:20:45.759:2608) : enforcing=0 old_enforcing=1 auid=root ses=10 enabled=1 old-enabled=1 lsm=selinux res=yes -:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=0.*old_enforcing=1'' (Expected 0, got 0) -:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=SYSCALL.*comm=setenforce'' -type=SYSCALL msg=audit(03/10/2025 06:20:45.759:2608) : arch=aarch64 syscall=write success=yes exit=1 a0=0x3 a1=0xffffd04eebc0 a2=0x1 a3=0xff78bbc00020 items=0 ppid=75829 pid=79376 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10 comm=setenforce exe=/usr/sbin/setenforce subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) -type=SYSCALL msg=audit(03/10/2025 06:20:45.979:2609) : arch=aarch64 syscall=write success=yes exit=1 a0=0x3 a1=0xffffc38319d0 a2=0x1 a3=0xff32e45b8020 items=0 ppid=75829 pid=79426 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10 comm=setenforce exe=/usr/sbin/setenforce subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) -:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=SYSCALL.*comm=setenforce'' (Expected 0, got 0) -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Duration: 7s -:: Assertions: 8 good, 0 bad -:: RESULT: PASS (basic use) diff --git a/libselinux/setenforce/main.fmf b/libselinux/setenforce/main.fmf index 7b178b8..11ebcd7 100644 --- a/libselinux/setenforce/main.fmf +++ b/libselinux/setenforce/main.fmf @@ -1,35 +1 @@ -summary: Does setenforce work as expected? Does it produce correct audit messages? -description: |+ - Does setenforce work as expected? Does it produce correct audit messages? - -contact: Milos Malik -component: - - libselinux -recommend: - - audit - - libselinux - - libselinux-utils - - e2fsprogs -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - fusa -tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false - - when: distro >= rhel-10 - recommend+: - - audit-rules - because: since RHEL 10 package audit was split and early packages have wrong dependency -extra-nitrate: TC#0543754 -extra-summary: /CoreOS/libselinux/Sanity/setenforce -extra-task: /CoreOS/libselinux/Sanity/setenforce +path: /libselinux/setenforce diff --git a/libselinux/setenforce/runtest.sh b/libselinux/setenforce/runtest.sh index 7bddb5d..a4140d3 100755 --- a/libselinux/setenforce/runtest.sh +++ b/libselinux/setenforce/runtest.sh @@ -50,7 +50,6 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "basic use" - rlRun "which auditctl" 0 "'auditctl' have to be present for proper functioning, failing test otherwise" START_DATE_TIME=`date "+%m/%d/%Y %T"` sleep 1 rlRun "setenforce 1" diff --git a/libselinux/setfiles-in-chroot-env/Makefile b/libselinux/setfiles-in-chroot-env/Makefile deleted file mode 100644 index 7d5c948..0000000 --- a/libselinux/setfiles-in-chroot-env/Makefile +++ /dev/null @@ -1,66 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/libselinux/Regression/setfiles-in-chroot-env -# Description: Does setfiles work correctly in chroot environment? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/libselinux/Regression/setfiles-in-chroot-env -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE test-script.sh - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - test -x test-script.sh || chmod a+x test-script.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does setfiles work correctly in chroot environment?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: libselinux" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: libselinux policycoreutils" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2094683" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/libselinux/setfiles-in-chroot-env/PURPOSE b/libselinux/setfiles-in-chroot-env/PURPOSE deleted file mode 100644 index 5402a21..0000000 --- a/libselinux/setfiles-in-chroot-env/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/libselinux/Regression/setfiles-in-chroot-env -Author: Milos Malik - -Does setfiles work correctly in chroot environment? - diff --git a/libselinux/setfiles-in-chroot-env/main.fmf b/libselinux/setfiles-in-chroot-env/main.fmf deleted file mode 100644 index 9c3dae5..0000000 --- a/libselinux/setfiles-in-chroot-env/main.fmf +++ /dev/null @@ -1,22 +0,0 @@ -summary: Does setfiles work correctly in chroot environment? -description: | - Does setfiles work correctly in chroot environment? - -contact: Milos Malik -component: - - libselinux -test: ./runtest.sh -framework: beakerlib -recommend: - - libselinux - - policycoreutils -duration: 15m -enabled: true -tag: - - targeted - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094683 -extra-summary: /CoreOS/libselinux/Regression/setfiles-in-chroot-env -extra-task: /CoreOS/libselinux/Regression/setfiles-in-chroot-env -extra-nitrate: TC#0613958 diff --git a/libselinux/setfiles-in-chroot-env/runtest.sh b/libselinux/setfiles-in-chroot-env/runtest.sh deleted file mode 100755 index 0ddda9b..0000000 --- a/libselinux/setfiles-in-chroot-env/runtest.sh +++ /dev/null @@ -1,67 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/libselinux/Regression/setfiles-in-chroot-env -# Description: Does setfiles work correctly in chroot environment? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="libselinux" -CHROOT_DIR=`mktemp -d` -INSTALL_OPTION="" -if yum --help | grep -q use-host-config ; then - INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" -fi -if yum install --help | grep -q skip-broken ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" -fi -if yum install --help | grep -q skip-unavailable ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" -fi -# detect release version -test -e /etc/os-release && os_release='/etc/os-release' || os_release='/usr/lib/os-release' -. "${os_release}" -INSTALL_OPTION="${INSTALL_OPTION} --releasever ${VERSION_ID}" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm policycoreutils - rlPhaseEnd - - rlPhaseStartTest "bz#2094683" - rlRun "yum -y install filesystem policycoreutils selinux-policy-targeted --installroot=${CHROOT_DIR} ${INSTALL_OPTION}" - rlRun "cp ./test-script.sh ${CHROOT_DIR}/usr/bin/" - rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.sh" - rlRun "grep -i -e 'no such file or directory' -e 'not set context' $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf ${CHROOT_DIR}" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/libselinux/setfiles-in-chroot-env/test-script.sh b/libselinux/setfiles-in-chroot-env/test-script.sh deleted file mode 100755 index d20ba83..0000000 --- a/libselinux/setfiles-in-chroot-env/test-script.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash - -sestatus -ls -lZ / -/usr/sbin/setfiles -F /etc/selinux/targeted/contexts/files/file_contexts / -ls -lZ / - diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf index 08b1b92..a23f02f 100644 --- a/libselinux/validatetrans/main.fmf +++ b/libselinux/validatetrans/main.fmf @@ -1,47 +1,4 @@ -summary: Does the validatetrans tool work as expected? -description: |+ - Does the validatetrans tool work as expected? - -contact: Milos Malik -component: - - libselinux -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - f33friendly - - targeted - - NoRHIVOS -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - because: the validatetrans program is not available there - - enabled: false - when: distro < Fedora-32 - continue: false -extra-nitrate: TC#0606254 -extra-summary: /CoreOS/libselinux/Sanity/validatetrans -extra-task: /CoreOS/libselinux/Sanity/validatetrans +path: /libselinux/validatetrans +adjust: +- enabled: false + when: distro < fedora-32 diff --git a/libselinux/validatetrans/runtest.sh b/libselinux/validatetrans/runtest.sh index ab468eb..2b201df 100755 --- a/libselinux/validatetrans/runtest.sh +++ b/libselinux/validatetrans/runtest.sh @@ -27,20 +27,21 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" rlJournalStart # validatetrans utility is available since Fedora 32 - if ! rlIsRHEL ">8" && ! rlIsFedora ">31" && ! rlIsCentOS ">8" ; then + if ! rlIsRHEL ">8" && ! rlIsFedora ">31"; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlAssertRpm ${PACKAGE} rlRun "rpm -qf `which validatetrans`" rlRun "rpm -qf `which seinfo`" @@ -85,11 +86,11 @@ rlJournalStart rlPhaseStartTest "incomplete or invalid parameters" # first context incomplete - rlRun "validatetrans unconfined_u:object_r:bin_t: unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i -e 'invalid argument' -e 'invalid source context'" + rlRun "validatetrans unconfined_u:object_r:bin_t: unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'" # second context incomplete - rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t: file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i -e 'invalid argument' -e 'invalid target context'" + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t: file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'" # third context incomplete - rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t: 2>&1 | grep -i -e 'invalid argument' -e 'invalid new context'" + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t: 2>&1 | grep -i 'invalid argument'" # invalid target class rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 xyz unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid class'" rlPhaseEnd diff --git a/libsemanage/cross-device-link-in-containers/Makefile b/libsemanage/cross-device-link-in-containers/Makefile deleted file mode 100644 index d9930e4..0000000 --- a/libsemanage/cross-device-link-in-containers/Makefile +++ /dev/null @@ -1,65 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/libsemanage/Regression/cross-device-link-in-containers -# Description: Does rebuild of policy affect layered containers? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/libsemanage/Regression/cross-device-link-in-containers -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does rebuild of policy affect layered containers?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libsemanage podman policycoreutils selinux-policy libselinux-utils" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2068085" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-70632" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/libsemanage/cross-device-link-in-containers/PURPOSE b/libsemanage/cross-device-link-in-containers/PURPOSE deleted file mode 100644 index 1f8a6d1..0000000 --- a/libsemanage/cross-device-link-in-containers/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/libsemanage/Regression/cross-device-link-in-containers -Author: Milos Malik - -Description: Does rebuild of policy affect layered containers? - diff --git a/libsemanage/cross-device-link-in-containers/main.fmf b/libsemanage/cross-device-link-in-containers/main.fmf deleted file mode 100644 index 834fcf4..0000000 --- a/libsemanage/cross-device-link-in-containers/main.fmf +++ /dev/null @@ -1,31 +0,0 @@ -summary: Does rebuild of policy affect layered containers? -description: |+ - Does rebuild of policy affect layered containers? - -contact: Milos Malik -component: - - libsemanage -recommend: - - libsemanage - - podman - - policycoreutils - - selinux-policy - - libselinux-utils -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068085 - - verifies: https://issues.redhat.com/browse/RHEL-70632 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-summary: /CoreOS/libsemanage/Regression/cross-device-link-in-containers -extra-task: /CoreOS/libsemanage/Regression/cross-device-link-in-containers -extra-nitrate: TC#0613557 diff --git a/libsemanage/cross-device-link-in-containers/runtest.sh b/libsemanage/cross-device-link-in-containers/runtest.sh deleted file mode 100755 index bcf74b5..0000000 --- a/libsemanage/cross-device-link-in-containers/runtest.sh +++ /dev/null @@ -1,87 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/libsemanage/Regression/cross-device-link-in-containers -# Description: Does rebuild of policy affect layered containers? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="libsemanage" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm podman - rlRun "semodule -lfull | grep -e container -e podman" - rlRun "getsebool -a | grep -e container -e podman" - rlRun "mkdir selinux1 selinux2" - rlPhaseEnd - - rlPhaseStartTest "bz#2068085" - rlRun "pushd selinux1" - if rlIsCentOS 8 || rlIsRHEL 8 ; then - STREAM_ID="centos/centos:stream8" - elif rlIsCentOS 9 || rlIsRHEL 9 ; then - STREAM_ID="centos/centos:stream9" - elif rlIsCentOS 10 || rlIsRHEL 10 ; then - STREAM_ID="centos/centos:stream10" - else - STREAM_ID="fedora/fedora:rawhide" - fi -cat <> ./Dockerfile -FROM quay.io/${STREAM_ID} -RUN dnf install -y selinux-policy selinux-policy-targeted -EOF - rlRun "cat ./Dockerfile" - rlRun -s "podman build -t localhost/selinux . --no-cache" - rlAssertGrep "^complete" $rlRun_LOG -i - rlAssertGrep "^commit" $rlRun_LOG -i - rlAssertNotGrep "not supported" $rlRun_LOG -i - rlRun "popd" - - rlRun "pushd selinux2" -cat <> ./Dockerfile -FROM localhost/selinux -RUN semodule -B -EOF - rlRun "cat ./Dockerfile" - rlRun -s "podman build -t localhost/selinux2 . --no-cache" - rlAssertNotGrep "error" $rlRun_LOG -i - rlAssertNotGrep "failed" $rlRun_LOG -i - rlAssertNotGrep "not supported" $rlRun_LOG -i - rlRun "popd" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf selinux1 selinux2" - rlRun "podman images" - for ID in `podman images -q` ; do - rlRun "podman rmi $ID" - done - rlRun "podman images" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/libsemanage/sanity-tests/Makefile b/libsemanage/sanity-tests/Makefile index 3d8ffa9..23ef6ac 100644 --- a/libsemanage/sanity-tests/Makefile +++ b/libsemanage/sanity-tests/Makefile @@ -51,7 +51,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Test libsemanage functions" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 2h" >> $(METADATA) + @echo "TestTime: 60m" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) @echo "Requires: libsemanage libsemanage-devel gcc CUnit CUnit-devel checkpolicy policycoreutils-python-utils" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/libsemanage/sanity-tests/main.fmf b/libsemanage/sanity-tests/main.fmf index e5e8f4f..9c7a7e1 100644 --- a/libsemanage/sanity-tests/main.fmf +++ b/libsemanage/sanity-tests/main.fmf @@ -1,44 +1 @@ -summary: Test libsemanage functions -description: '' -contact: Milos Malik -component: - - libsemanage -recommend: - - libsemanage - - libsemanage-devel - - gcc - - CUnit - - CUnit-devel - - checkpolicy - - policycoreutils-python-utils -duration: 2h -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - f31friendly - - f32friendly - - failinfedora - - rhel8-buildroot - - rhel8-crb - - rhel9-buildroot - - targeted -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1636973 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false - - enabled: false - when: distro == rhel-7 and arch == s390x - continue: false - - enabled: false - when: distro == rhel-alt-7 and arch == s390x - continue: false -extra-nitrate: TC#0547810 -extra-summary: /CoreOS/libsemanage/Sanity/sanity-tests -extra-task: /CoreOS/libsemanage/Sanity/sanity-tests +path: /libsemanage/sanity-tests diff --git a/libsemanage/sanity-tests/runtest.sh b/libsemanage/sanity-tests/runtest.sh index b615086..0b1785b 100755 --- a/libsemanage/sanity-tests/runtest.sh +++ b/libsemanage/sanity-tests/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libsemanage" @@ -34,7 +35,7 @@ rlJournalStart rlPhaseStartSetup rlRun "rlImport --all" || rlDie - rlRun "rlCheckDependencies" || rlDie + rlRun "rlCheckMakefileRequires" || rlDie VERS=$(rpm -q $PACKAGE | cut -f 2 -d '-') VERS_MAJOR=$(echo $VERS | cut -f 1 -d '.') diff --git a/libsemanage/sanity-tests/tests/test_handle.c b/libsemanage/sanity-tests/tests/test_handle.c index a508043..810014d 100644 --- a/libsemanage/sanity-tests/tests/test_handle.c +++ b/libsemanage/sanity-tests/tests/test_handle.c @@ -102,8 +102,12 @@ void test_connect(void) { void test_disconnect(void) { setup_handle(SH_NULL); + CU_ASSERT_SIGNAL(semanage_disconnect(sh), SIGABRT); + helper_handle_create(); + CU_ASSERT_SIGNAL(semanage_disconnect(sh), SIGABRT); + helper_connect(); CU_ASSERT(semanage_disconnect(sh) >= 0); diff --git a/libsemanage/semanage-handle-functions/Makefile b/libsemanage/semanage-handle-functions/Makefile deleted file mode 100644 index c49dbe0..0000000 --- a/libsemanage/semanage-handle-functions/Makefile +++ /dev/null @@ -1,63 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/libsemanage/Sanity/semanage-handle-functions -# Description: Test functions from handle.h -# Author: Jan Zarsky -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2017 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/libsemanage/Sanity/semanage-handle-functions -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE functions.c test_*.c - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Jan Zarsky " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Test functions from handle.h" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libsemanage libsemanage-devel glibc gcc" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) - - rhts-lint $(METADATA) diff --git a/libsemanage/semanage-handle-functions/PURPOSE b/libsemanage/semanage-handle-functions/PURPOSE deleted file mode 100644 index 09a8e19..0000000 --- a/libsemanage/semanage-handle-functions/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of /CoreOS/libsemanage/Sanity/semanage-handle-functions -Description: Test functions from handle.h -Author: Jan Zarsky diff --git a/libsemanage/semanage-handle-functions/functions.c b/libsemanage/semanage-handle-functions/functions.c deleted file mode 100644 index 7722c09..0000000 --- a/libsemanage/semanage-handle-functions/functions.c +++ /dev/null @@ -1,132 +0,0 @@ -#include -#include -#include -#include -#include - -void check_result_int(const char *expected, int real) { - int exp = strtol(expected, NULL, 10); - - if (exp != real) { - fprintf(stderr, "Expected %d but got %d\n", exp, real); - exit(1); - } -} - -semanage_handle_t *test_handle_create() { - semanage_handle_t *sh = NULL; - - sh = semanage_handle_create(); - printf("semanage_handle_create(): %p\n", (void *) sh); - - if (sh == NULL) { - perror("semanage_handle_create"); - exit(1); - } - - return sh; -} - -int test_connect(semanage_handle_t *sh) { - int result = semanage_connect(sh); - printf("semanage_connect(%p): %d\n", (void *) sh, result); - - if (result != 0) { - perror("semanage_connect"); - exit(1); - } - - return result; -} - -int test_disconnect(semanage_handle_t *sh) { - int result = semanage_disconnect(sh); - printf("semanage_disconnect(%p): %d\n", (void *) sh, result); - - if (result != 0) { - perror("semanage_disconnect"); - exit(1); - } - - return result; -} - -int test_begin_transaction(semanage_handle_t *sh) { - int result = semanage_begin_transaction(sh); - printf("semanage_begin_transaction(%p): %d\n", (void *) sh, result); - - if (result != 0) { - perror("semanage_begin_transaction"); - exit(1); - } - - return result; -} - -int test_commit(semanage_handle_t *sh) { - int result = semanage_commit(sh); - printf("semanage_commit(%p): %d\n", (void *) sh, result); - - if (result != 0) { - perror("semanage_commit"); - exit(1); - } - - return result; -} - -#define STATE_INIT 1 -#define STATE_HANDLE 2 -#define STATE_CONN 3 -#define STATE_TRANS 4 - -int get_state(const char *state_str) { - if (strcmp(state_str, "init") == 0) - return STATE_INIT; - if (strcmp(state_str, "handle") == 0) - return STATE_HANDLE; - if (strcmp(state_str, "conn") == 0) - return STATE_CONN; - if (strcmp(state_str, "trans") == 0) - return STATE_TRANS; - - return 0; -} - -semanage_handle_t * get_handle(const char *state_str) { - int state; - semanage_handle_t *sh = NULL; - - state = get_state(state_str); - - if (state >= STATE_INIT) - sh = NULL; - - if (state >= STATE_HANDLE) - sh = test_handle_create(); - - if (state >= STATE_CONN) - test_connect(sh); - - if (state >= STATE_TRANS) - test_begin_transaction(sh); - - return sh; -} - -void destroy_handle(semanage_handle_t *sh, const char *state_str) { - int state; - - state = get_state(state_str); - - if (state >= STATE_TRANS) - test_commit(sh); - - if (state >= STATE_CONN) - test_disconnect(sh); - - if (state >= STATE_HANDLE) { - semanage_handle_destroy(sh); - printf("semanage_handle_destroy(%p)\n", (void *) sh); - } -} diff --git a/libsemanage/semanage-handle-functions/main.fmf b/libsemanage/semanage-handle-functions/main.fmf deleted file mode 100644 index 0c6e3c5..0000000 --- a/libsemanage/semanage-handle-functions/main.fmf +++ /dev/null @@ -1,32 +0,0 @@ -summary: Test functions from handle.h -description: '' -contact: Milos Malik -component: - - libsemanage -test: ./runtest.sh -framework: beakerlib -recommend: - - libsemanage - - libsemanage-devel - - glibc - - gcc -duration: 5m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - f31friendly - - f32friendly - - rhel8-buildroot - - rhel9-buildroot -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0546220 -extra-summary: /CoreOS/libsemanage/Sanity/semanage-handle-functions -extra-task: /CoreOS/libsemanage/Sanity/semanage-handle-functions diff --git a/libsemanage/semanage-handle-functions/plan.txt b/libsemanage/semanage-handle-functions/plan.txt deleted file mode 100644 index 521a914..0000000 --- a/libsemanage/semanage-handle-functions/plan.txt +++ /dev/null @@ -1,29 +0,0 @@ - init handle conn trans -semanage_set_root x ok ok ok - -semanage_root x ok ok ok - -semanage_handle_create x ok - - - -semanage_set_rebuild fail ok ok - -semanage_set_reload fail ok ok - -semanage_get_hll_compiler_path fail ? ? - -semanage_set_create_store fail ok ok - should be called after connect -semanage_get_disable_dontaudit fail ? ? - -semanage_set_disable_dontaudit fail ? ? - -semanage_get_preserve_tunables fail ? ? - -semanage_set_preserve_tunables fail ? ? - -semanage_get_ignore_module_cache fail ? ? - -semanage_set_ignore_module_cache fail ? ? - -semanage_set_check_contexts fail ok ok - -semanage_get_default_priority fail ok ok - -semanage_set_default_priority fail ok ok - -semanage_is_connected x fail ok ok - -semanage_select_store fail ok ok - should be called before connect -semanage_set_store_root fail ok ok - -semanage_is_managed x fail ok fail - -semanage_mls_enabled x fail ? ok - -semanage_connect x fail ok ? - -semanage_access_check x fail ok ? - -semanage_disconnect x fail fail ok - ok when disconnected twice -semanage_handle_destroy x fail ok ok - -semanage_begin_transaction x fail fail ok ok ok when begin twice -semanage_commit x fail fail fail ok -semanage_reload_policy fail ? ? ? diff --git a/libsemanage/semanage-handle-functions/runtest.sh b/libsemanage/semanage-handle-functions/runtest.sh deleted file mode 100755 index e29a22b..0000000 --- a/libsemanage/semanage-handle-functions/runtest.sh +++ /dev/null @@ -1,120 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/libsemanage/Sanity/semanage-handle-functions -# Description: Test functions from handle.h -# Author: Jan Zarsky -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2017 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="libsemanage" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-devel - rlAssertRpm "glibc" - rlAssertRpm "gcc" - - if rlIsRHEL ">=7" || rlIsFedora || rlIsCentOS ">=7" ; then - rlRun -l "gcc test_root.c -o test_root -lsemanage -Wall -Wextra -std=c99" - fi - - rlRun -l "gcc test_handle_create.c -o test_handle_create -lsemanage -Wall -Wextra -Wno-unused-parameter -std=c99" - rlRun -l "gcc test_access_check.c -o test_access_check -lsemanage -Wall -Wextra -std=c99" - rlRun -l "gcc test_is_managed.c -o test_is_managed -lsemanage -Wall -Wextra -std=c99" - rlRun -l "gcc test_connect.c -o test_connect -lsemanage -Wall -Wextra -std=c99" - rlRun -l "gcc test_is_connected.c -o test_is_connected -lsemanage -Wall -Wextra -std=c99" - rlRun -l "gcc test_mls_enabled.c -o test_mls_enabled -lsemanage -Wall -Wextra -std=c99" - rlRun -l "gcc test_transaction.c -o test_transaction -lsemanage -Wall -Wextra -std=c99" - - ERR_FAIL=1 - ERR_ABORT=134 - rlPhaseEnd - - if rlIsRHEL ">=7" || rlIsFedora || rlIsCentOS ">=7" ; then - rlPhaseStartTest "semanage_root, semanage_test_root" - rlRun "./test_root init" - rlRun "./test_root handle" - rlRun "./test_root conn" - rlRun "./test_root init /somepath" - rlRun "./test_root handle /somepath" - rlRun "./test_root conn /somepath" - rlPhaseEnd - fi - - rlPhaseStartTest "semanage_handle_create, semanage_handle_destroy" - rlRun "./test_handle_create init" - rlPhaseEnd - - rlPhaseStartTest "semanage_access_check" - rlRun "./test_access_check init" $ERR_ABORT - rlRun "./test_access_check handle 2" - rlRun "./test_access_check conn 2" - rlPhaseEnd - - rlPhaseStartTest "semanage_is_managed" - rlRun "./test_is_managed init" $ERR_ABORT - rlRun "./test_is_managed handle 1" - rlRun "./test_is_managed conn" $ERR_FAIL - rlPhaseEnd - - rlPhaseStartTest "semanage_connect, semanage_disconnect" - rlRun "./test_connect init" $ERR_ABORT - rlRun "./test_connect init reversed" $ERR_ABORT - rlRun "./test_connect handle" - rlRun "./test_connect handle twice" - # why does it work?? - rlRun "./test_connect conn" - rlPhaseEnd - - rlPhaseStartTest "semanage_is_connected" - rlRun "./test_is_connected init" $ERR_ABORT - rlRun "./test_is_connected handle 0" - rlRun "./test_is_connected conn 1" - rlPhaseEnd - - rlPhaseStartTest "semanage_mls_enabled" - rlRun "./test_mls_enabled init" $ERR_ABORT - rlRun "./test_mls_enabled handle" $ERR_ABORT - rlRun "./test_mls_enabled conn 1" - rlPhaseEnd - - rlPhaseStartTest "semanage_begin_transaction, semanage_commit" - rlRun "./test_transaction init" $ERR_ABORT - rlRun "./test_transaction init reversed" $ERR_ABORT - rlRun "./test_transaction handle" $ERR_ABORT - rlRun "./test_transaction handle reversed" $ERR_ABORT - rlRun "./test_transaction conn" - rlRun "./test_transaction conn twice" - rlRun "./test_transaction conn reversed" $ERR_FAIL - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f output test_root test_handle_create test_access_check \ - test_is_managed test_connect test_is_connected \ - test_mls_enabled test_transaction" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/libsemanage/semanage-handle-functions/test_access_check.c b/libsemanage/semanage-handle-functions/test_access_check.c deleted file mode 100644 index 8eb2530..0000000 --- a/libsemanage/semanage-handle-functions/test_access_check.c +++ /dev/null @@ -1,32 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - - if (argc < 2) - exit(1); - - sh = get_handle(argv[1]); - - int result = semanage_access_check(sh); - printf("semanage_access_check(%p): %d\n", (void *) sh, result); - - if (result < 0 || (result != 0 && result != SEMANAGE_CAN_READ - && result != SEMANAGE_CAN_WRITE)) { - perror("semanage_access_check"); - exit(1); - } - - if (argc >= 3) - check_result_int(argv[2], result); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-handle-functions/test_connect.c b/libsemanage/semanage-handle-functions/test_connect.c deleted file mode 100644 index df403e0..0000000 --- a/libsemanage/semanage-handle-functions/test_connect.c +++ /dev/null @@ -1,33 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - - if (argc < 2) - exit(1); - - sh = get_handle(argv[1]); - - if (argc >= 3 && strcmp(argv[2], "reversed") == 0) { - test_disconnect(sh); - test_connect(sh); - } - else { - test_connect(sh); - test_disconnect(sh); - } - - if (argc >= 3 && strcmp(argv[2], "twice") == 0) { - test_disconnect(sh); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-handle-functions/test_handle_create.c b/libsemanage/semanage-handle-functions/test_handle_create.c deleted file mode 100644 index 65d164e..0000000 --- a/libsemanage/semanage-handle-functions/test_handle_create.c +++ /dev/null @@ -1,15 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh = test_handle_create(); - - semanage_handle_destroy(sh); - - exit(0); -} diff --git a/libsemanage/semanage-handle-functions/test_is_connected.c b/libsemanage/semanage-handle-functions/test_is_connected.c deleted file mode 100644 index d428e48..0000000 --- a/libsemanage/semanage-handle-functions/test_is_connected.c +++ /dev/null @@ -1,32 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - int result; - - if (argc < 2) - exit(1); - - sh = get_handle(argv[1]); - - result = semanage_is_connected(sh); - printf("semanage_is_connected(%p): %d\n", (void *) sh, result); - - if (result != 0 && result != 1) { - perror("semanage_is_connected"); - exit(1); - } - - if (argc >= 3) - check_result_int(argv[2], result); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-handle-functions/test_is_managed.c b/libsemanage/semanage-handle-functions/test_is_managed.c deleted file mode 100644 index 4d11cb0..0000000 --- a/libsemanage/semanage-handle-functions/test_is_managed.c +++ /dev/null @@ -1,32 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - int result; - - if (argc < 2) - exit(1); - - sh = get_handle(argv[1]); - - result = semanage_is_managed(sh); - printf("semanage_is_managed(%p): %d\n", (void *) sh, result); - - if (result != 0 && result != 1) { - perror("semanage_is_managed"); - exit(1); - } - - if (argc >= 3) - check_result_int(argv[2], result); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-handle-functions/test_mls_enabled.c b/libsemanage/semanage-handle-functions/test_mls_enabled.c deleted file mode 100644 index 7e943f0..0000000 --- a/libsemanage/semanage-handle-functions/test_mls_enabled.c +++ /dev/null @@ -1,32 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - int result; - - if (argc < 2) - exit(1); - - sh = get_handle(argv[1]); - - result = semanage_mls_enabled(sh); - printf("semanage_mls_enabled(%p): %d\n", (void *) sh, result); - - if (result != 0 && result != 1) { - perror("semanage_mls_enabled"); - exit(1); - } - - if (argc >= 4) - check_result_int(argv[3], result); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-handle-functions/test_root.c b/libsemanage/semanage-handle-functions/test_root.c deleted file mode 100644 index 5786348..0000000 --- a/libsemanage/semanage-handle-functions/test_root.c +++ /dev/null @@ -1,53 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - const char *root; - int result; - - if (argc < 2) - exit(1); - - sh = get_handle(argv[1]); - - root = semanage_root(); - printf("semanage_root(): %s\n", root); - - if (root == NULL) { - perror("semanage_root"); - exit(1); - } - - if (argc >= 3) { - result = semanage_set_root(argv[2]); - printf("semanage_set_root(\"%s\"): %d\n", argv[2], result); - - if (root == NULL) { - perror("semanage_set_root"); - exit(1); - } - - root = semanage_root(); - printf("semanage_root(): %s\n", root); - - if (result != 0) { - perror("semanage_root"); - exit(1); - } - - if (strcmp(root, argv[2]) != 0) { - fprintf(stderr, "Expected \"%s\" but got \"%s\"\n", argv[2], root); - exit(1); - } - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-handle-functions/test_transaction.c b/libsemanage/semanage-handle-functions/test_transaction.c deleted file mode 100644 index f1b0e10..0000000 --- a/libsemanage/semanage-handle-functions/test_transaction.c +++ /dev/null @@ -1,34 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - - if (argc < 2) - exit(1); - - sh = get_handle(argv[1]); - - if (argc >= 3 && strcmp(argv[2], "reversed") == 0) { - test_commit(sh); - test_begin_transaction(sh); - } - else if (argc >= 3 && strcmp(argv[2], "twice") == 0) { - test_begin_transaction(sh); - test_begin_transaction(sh); - test_commit(sh); - } - else { - test_begin_transaction(sh); - test_commit(sh); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-root-on-nfs/main.fmf b/libsemanage/semanage-root-on-nfs/main.fmf deleted file mode 100644 index e115bf3..0000000 --- a/libsemanage/semanage-root-on-nfs/main.fmf +++ /dev/null @@ -1,16 +0,0 @@ -summary: Test semanage operation with /var/lib/selinux on NFS -test: ./test.sh -framework: beakerlib -component: libsemanage -require: - - nfs-utils - - policycoreutils-python-utils -duration: 10m -enabled: true -tag: - - NoRHIVOS - - avoidImageMode -link: - - verifies: https://issues.redhat.com/browse/RHEL-60503 -extra-nitrate: TC#0617969 -id: 2d20011e-cab6-43a6-8a82-9bb0a7c9736b diff --git a/libsemanage/semanage-root-on-nfs/test.sh b/libsemanage/semanage-root-on-nfs/test.sh deleted file mode 100755 index d7c944a..0000000 --- a/libsemanage/semanage-root-on-nfs/test.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*- -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -STORE_ROOT=$( grep -E '^store-root' /etc/selinux/semanage.conf | tr -d ' ' | cut -d '=' -f 2 ) -if [ -z "$STORE_ROOT" ]; then - STORE_ROOT=/var/lib/selinux -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" - rlRun "pushd $tmp" - rlRun "set -o pipefail" - rlAssertRpm nfs-utils - rlAssertRpm policycoreutils-python-utils - rlRun "mkdir -p /srv/nfs/selinux" - rlRun "cp -r $STORE_ROOT /srv/selinux" - rlRun "mount --bind /srv/selinux /srv/nfs/selinux" - rlRun "sed -i 's%.*rootdir.*=.*%rootdir=/srv/nfs%' /etc/nfs.conf" - rlRun "systemctl enable nfs-server --now" - rlRun "cat > /etc/exports < -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2017 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/libsemanage/Sanity/semanage-seuser-functions -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE functions.c test_*.c - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Jan Zarsky " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Test semanage_seuser_* functions" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libsemanage libsemanage-devel glibc gcc" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) - - rhts-lint $(METADATA) diff --git a/libsemanage/semanage-seuser-functions/PURPOSE b/libsemanage/semanage-seuser-functions/PURPOSE deleted file mode 100644 index 6b5201a..0000000 --- a/libsemanage/semanage-seuser-functions/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of /CoreOS/libsemanage/Sanity/semanage-seuser-functions -Description: Test semanage_seuser_* functions -Author: Jan Zarsky diff --git a/libsemanage/semanage-seuser-functions/functions.c b/libsemanage/semanage-seuser-functions/functions.c deleted file mode 100644 index b4152ed..0000000 --- a/libsemanage/semanage-seuser-functions/functions.c +++ /dev/null @@ -1,263 +0,0 @@ -#include -#include -#include -#include -#include - -void check_result_int(const char *expected, int real) { - int exp = strtol(expected, NULL, 10); - - if (exp != real) { - fprintf(stderr, "Expected %d but got %d\n", exp, real); - exit(1); - } -} - -semanage_handle_t *test_handle_create() { - semanage_handle_t *sh = NULL; - - sh = semanage_handle_create(); - printf("semanage_handle_create(): %p\n", (void *) sh); - - if (sh == NULL) { - perror("semanage_handle_create"); - exit(2); - } - - return sh; -} - -int test_connect(semanage_handle_t *sh) { - int result = semanage_connect(sh); - printf("semanage_connect(%p): %d\n", (void *) sh, result); - - if (result != 0) { - perror("semanage_connect"); - exit(2); - } - - return result; -} - -int test_disconnect(semanage_handle_t *sh) { - int result = semanage_disconnect(sh); - printf("semanage_disconnect(%p): %d\n", (void *) sh, result); - - if (result != 0) { - perror("semanage_disconnect"); - exit(2); - } - - return result; -} - -int test_begin_transaction(semanage_handle_t *sh) { - int result = semanage_begin_transaction(sh); - printf("semanage_begin_transaction(%p): %d\n", (void *) sh, result); - - if (result != 0) { - perror("semanage_begin_transaction"); - exit(2); - } - - return result; -} - -int test_commit(semanage_handle_t *sh) { - int result = semanage_commit(sh); - printf("semanage_commit(%p): %d\n", (void *) sh, result); - - if (result < 0) { - perror("semanage_commit"); - exit(2); - } - - return result; -} - -semanage_seuser_key_t *test_get_key(semanage_handle_t *sh, const char *name) { - semanage_seuser_key_t *key; - int result = semanage_seuser_key_create(sh, name, &key); - printf("semanage_seuser_key_create(%p, %s, %p): %d\n", - (void *) sh, name, (void *) &key, result); - - if (key == NULL || result < 0) { - perror("semanage_seuser_key_create"); - exit(2); - } - - return key; -} - -semanage_seuser_t *test_get_seuser_nth(semanage_handle_t *sh, unsigned int index) { - int result; - semanage_seuser_t **records; - unsigned int count; - - result = semanage_seuser_list(sh, &records, &count); - printf("semanage_seuser_list(%p, %p, %p): %d\n", - (void *) sh, (void *) &records, (void *) &count, result); - - if (result < 0) { - perror("semanage_seuser_list"); - exit(2); - } - - if (count < index + 1) - exit(2); - - return records[index]; -} - -semanage_seuser_t *test_get_seuser_new(semanage_handle_t *sh) { - int result; - semanage_seuser_t *seuser; - - result = semanage_seuser_create(sh, &seuser); - printf("semanage_seuser_create(%p, %p): %d\n", - (void *) sh, (void *) seuser, result); - - if (result < 0) { - perror("semanage_seuser_create"); - exit(2); - } - - return seuser; -} - -semanage_seuser_t *test_get_seuser(semanage_handle_t *sh, const char *param) { - if (strcmp(param, "new") == 0) - return test_get_seuser_new(sh); - - if (strcmp(param, "first") == 0) - return test_get_seuser_nth(sh, 0); - - if (strcmp(param, "second") == 0) - return test_get_seuser_nth(sh, 1); - - fprintf(stderr, "Unknown seuser \"%s\" specified\n", param); - exit(2); -} - -void test_add_local_seuser(semanage_handle_t *sh, semanage_seuser_t *seuser) { - int result; - semanage_seuser_key_t *key; - - result = semanage_seuser_key_extract(sh, seuser, &key); - printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", - (void *) sh, (void *) seuser, (void *) &key, result); - - if (result < 0) { - perror("semanage_seuser_key_extract"); - exit(2); - } - - result = semanage_seuser_modify_local(sh, key, seuser); - printf("semanage_seuser_modify_local(%p, %p, %p): %d\n", - (void *) seuser, (void *) key, (void *) seuser, result); - - if (result < 0) { - perror("semanage_seuser_modify_local"); - exit(2); - } -} - -void test_del_local_seuser(semanage_handle_t *sh, semanage_seuser_t *seuser) { - int result; - semanage_seuser_key_t *key; - - result = semanage_seuser_key_extract(sh, seuser, &key); - printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", - (void *) sh, (void *) seuser, (void *) &key, result); - - if (result < 0) { - perror("semanage_seuser_key_extract"); - exit(2); - } - - result = semanage_seuser_del_local(sh, key); - printf("semanage_seuser_del_local(%p, %p): %d\n", - (void *) seuser, (void *) key, result); - - if (result < 0) { - perror("semanage_seuser_del_local"); - exit(2); - } -} - -#define STATE_INIT 1 -#define STATE_HANDLE 2 -#define STATE_CONN 3 -#define STATE_TRANS 4 - -int get_state(const char *state_str) { - if (strcmp(state_str, "init") == 0) - return STATE_INIT; - if (strcmp(state_str, "handle") == 0) - return STATE_HANDLE; - if (strcmp(state_str, "conn") == 0) - return STATE_CONN; - if (strcmp(state_str, "trans") == 0) - return STATE_TRANS; - - return 0; -} - -semanage_handle_t * get_handle(const char *state_str) { - int state; - semanage_handle_t *sh = NULL; - - state = get_state(state_str); - - if (state >= STATE_INIT) - sh = NULL; - - if (state >= STATE_HANDLE) - sh = test_handle_create(); - - if (state >= STATE_CONN) - test_connect(sh); - - if (state >= STATE_TRANS) - test_begin_transaction(sh); - - return sh; -} - -void destroy_handle(semanage_handle_t *sh, const char *state_str) { - int state; - - state = get_state(state_str); - - if (state >= STATE_TRANS) - test_commit(sh); - - if (state >= STATE_CONN) - test_disconnect(sh); - - if (state >= STATE_HANDLE) { - semanage_handle_destroy(sh); - printf("semanage_handle_destroy(%p)\n", (void *) sh); - } -} - -int strcmp_null(const char *str1, const char *str2) { - if (str1 == NULL && str2 == NULL) - return 0; - - if (str1 == NULL) { - if (strcmp(str2, "NULL") == 0) - return 0; - else - return -1; - } - - if (str2 == NULL) { - if (strcmp(str1, "NULL") == 0) - return 0; - else - return 1; - } - - return strcmp(str1, str2); -} diff --git a/libsemanage/semanage-seuser-functions/main.fmf b/libsemanage/semanage-seuser-functions/main.fmf deleted file mode 100644 index 58089d1..0000000 --- a/libsemanage/semanage-seuser-functions/main.fmf +++ /dev/null @@ -1,29 +0,0 @@ -summary: Test semanage_seuser_* functions -description: '' -contact: Milos Malik -component: - - libsemanage -test: ./runtest.sh -framework: beakerlib -recommend: - - libsemanage - - libsemanage-devel - - glibc - - gcc -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - f32friendly - - f33friendly - - rhel8-buildroot - - targeted - - avoidImageMode -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0546750 -extra-summary: /CoreOS/libsemanage/Sanity/semanage-seuser-functions -extra-task: /CoreOS/libsemanage/Sanity/semanage-seuser-functions diff --git a/libsemanage/semanage-seuser-functions/runtest.sh b/libsemanage/semanage-seuser-functions/runtest.sh deleted file mode 100755 index 766a800..0000000 --- a/libsemanage/semanage-seuser-functions/runtest.sh +++ /dev/null @@ -1,257 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/libsemanage/Sanity/semanage-seuser-functions -# Description: Test semanage_seuser_* functions -# Author: Jan Zarsky -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2017 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="libsemanage" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-devel - rlAssertRpm "glibc" - rlAssertRpm "gcc" - - for f in test_*.c ; do - out=$(echo -n $f | cut -d'.' -f1) - rlRun "gcc $f -o $out -lsemanage -Wall -Wextra -Werror -std=c99" - done - - POLICY_TYPE="$(grep -E '^SELINUXTYPE=' /etc/selinux/config | cut -d'=' -f2 | tr '[:upper:]' '[:lower:]' | tr -d ' ')" - - if rlIsFedora; then - SEUSERS_PATH="/var/lib/selinux/$POLICY_TYPE/active/seusers" - elif rlIsRHEL '<=7'; then - SEUSERS_PATH="/etc/selinux/$POLICY_TYPE/active/seusers" - if rlIsRHEL '<=6'; then - SEUSERS_PATH="/etc/selinux/$POLICY_TYPE/seusers" - fi - elif rlIsRHEL '>=8' || rlIsCentOS '>=8' ; then - SEUSERS_PATH="/var/lib/selinux/$POLICY_TYPE/active/seusers" - fi - - rlRun "cat $SEUSERS_PATH" - - SEUSERS_COUNT="$(cat $SEUSERS_PATH | grep -vE '^#|^$' | wc -l)" - rlRun "[[ \"$SEUSERS_COUNT\" -gt 0 ]]" - - SEUSERS="$(cat $SEUSERS_PATH | grep -vE '^#|^$' | cut -d':' -f1 | tr '\n' ' ')" - rlRun "[[ -n \"$SEUSERS\" ]]" - - first_line="$(cat $SEUSERS_PATH | grep -vE '^#|^$' | head -n 1)" - SEUSER="$(echo -n $first_line | cut -d':' -f1)" - rlRun "[[ -n \"$SEUSER\" ]]" - SEUSER_SENAME="$(echo -n $first_line | cut -d':' -f2)" - rlRun "[[ -n \"$SEUSER_SENAME\" ]]" - SEUSER_MLSRANGE="$(echo -n $first_line | cut -d':' -f3-4)" - rlRun "[[ -n \"$SEUSER_MLSRANGE\" ]]" - - SEUSER_NONEXISTENT="nonuser" - SEUSER_DEFAULT="__default__" - - ERR_FAIL=1 - ERR_ABORT=134 - ERR_SEGFAULT=139 - - # note: each test_*.c program takes first argument which specifies setup - # before executing specified function - # init semanage handle == NULL - # handle semanage handle obtained via semanage_handle_create - # conn connected via semanage_connect - # trans inside transaction, via semanage_begin_transaction - # program returns 1 on error in function, 2 on error in setup - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_key_create, semanage_seuser_key_free" - # FIXME - # rlRun "./test_key_create init $SEUSER" $ERR_ABORT,$ERR_SEGFAULT - # rlRun "./test_key_create handle $SEUSER" $ERR_FAIL - rlRun "./test_key_create conn $SEUSER" - rlRun "./test_key_create trans $SEUSER" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_key_extract" - # FIXME - #rlRun "./test_key_extract conn new" - rlRun "./test_key_extract conn first" - # FIXME - #rlRun "./test_key_extract trans new" - rlRun "./test_key_extract trans first" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_compare" - rlRun "./test_compare conn $SEUSER same" - rlRun "./test_compare conn $SEUSER_NONEXISTENT different" - rlRun "./test_compare trans $SEUSER same" - rlRun "./test_compare trans $SEUSER_NONEXISTENT different" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_compare2" - rlRun "./test_compare2 conn NULL 0" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_compare2 conn 0 NULL" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_compare2 conn NULL NULL" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_compare2 conn 0 0" - rlRun "./test_compare2 conn 0 1" - rlRun "./test_compare2 trans NULL 0" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_compare2 trans 0 NULL" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_compare2 trans NULL NULL" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_compare2 trans 0 0" - rlRun "./test_compare2 trans 0 1" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_count" - rlRun "./test_count init" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_count handle" $ERR_FAIL - rlRun "./test_count conn $SEUSERS_COUNT" - rlRun "./test_count trans $SEUSERS_COUNT" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_list" - rlRun "./test_list init" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_list handle" $ERR_FAIL - rlRun "./test_list conn $SEUSERS_COUNT $SEUSERS" - rlRun "./test_list trans $SEUSERS_COUNT $SEUSERS" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_iterate" - rlRun "./test_iterate init" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_iterate handle" $ERR_FAIL - rlRun "./test_iterate conn $SEUSERS" - rlRun "./test_iterate trans $SEUSERS" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_exists" - rlRun "./test_exists conn $SEUSER_NONEXISTENT 0" - rlRun "./test_exists conn $SEUSER_DEFAULT 1" - rlRun "./test_exists conn $USER 1" - rlRun "./test_exists trans $SEUSER_NONEXISTENT 0" - rlRun "./test_exists trans $SEUSER_DEFAULT 1" - rlRun "./test_exists trans $SEUSER 1" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_query" - rlRun "./test_query conn $SEUSER_NONEXISTENT" $ERR_FAIL - rlRun "./test_query conn $SEUSER_DEFAULT" - rlRun "./test_query conn $SEUSER" - rlRun "./test_query trans $SEUSER_NONEXISTENT" $ERR_FAIL - rlRun "./test_query trans $SEUSER_DEFAULT" - rlRun "./test_query trans $SEUSER" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_get_name" - rlRun "./test_get_name conn new NULL" - rlRun "./test_get_name conn first $SEUSER" - rlRun "./test_get_name trans new NULL" - rlRun "./test_get_name trans first $SEUSER" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_set_name" - name="someuser" - rlRun "./test_set_name conn $name" - rlRun "./test_set_name trans $name" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_get_sename" - rlRun "./test_get_sename conn new NULL" - rlRun "./test_get_sename conn first $SEUSER_SENAME" - rlRun "./test_get_sename trans new NULL" - rlRun "./test_get_sename trans first $SEUSER_SENAME" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_set_sename" - sename="someuser_u" - rlRun "./test_set_sename conn $sename" - rlRun "./test_set_sename trans $sename" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_get_mlsrange" - rlRun "./test_get_mlsrange conn new NULL" - rlRun "./test_get_mlsrange conn first $SEUSER_MLSRANGE" - rlRun "./test_get_mlsrange trans new NULL" - rlRun "./test_get_mlsrange trans first $SEUSER_MLSRANGE" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_set_mlsrange" - mlsrange="c0-s1:c0.c42" - rlRun "./test_set_mlsrange conn $mlsrange" - rlRun "./test_set_mlsrange trans $mlsrange" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_clone" - # FIXME - #rlRun "./test_clone conn new" - rlRun "./test_clone conn first" - # FIXME - #rlRun "./test_clone trans new" - rlRun "./test_clone trans first" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_create" - # FIXME - #rlRun "./test_create init" $ERR_ABORT,$ERR_SEGFAULT - #rlRun "./test_create handle" $ERR_ABORT,$ERR_SEGFAULT - rlRun "./test_create conn" - rlRun "./test_create trans" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_modify_local" - # function requires transaction - #rlRun "./test_modify_local conn new" $ERR_FAIL - #rlRun "./test_modify_local conn first" $ERR_FAIL - #rlRun "./test_modify_local trans new" $ERR_FAIL - rlRun "./test_modify_local trans first" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_del_local" - # adding local seuser requires transaction - # FIXME - #rlRun "./test_del_local trans first new" - #rlRun "./test_del_local trans first second" - rlRun "./test_del_local trans first first" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_exists_local" - # adding local seuser requires transaction - rlRun "./test_exists_local trans first first 1" - rlRun "./test_exists_local trans first second 0" - rlPhaseEnd - - rlPhaseStartTest "semanage_seuser_count_local" - # adding local seuser requires transaction - # FIXME - #rlRun "./test_count_local trans 0" - rlRun "./test_count_local trans 1" - rlRun "./test_count_local trans 2" - rlPhaseEnd - - rlPhaseStartCleanup - testfiles="$(ls -1 test_* | grep -v '\.c' | tr '\n' ' ')" - rlRun "rm -f $testfiles" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/libsemanage/semanage-seuser-functions/test_clone.c b/libsemanage/semanage-seuser-functions/test_clone.c deleted file mode 100644 index 8c2554f..0000000 --- a/libsemanage/semanage-seuser-functions/test_clone.c +++ /dev/null @@ -1,60 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - semanage_seuser_t *seuser_clone; - int result; - const char *str; - const char *str_clone; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - seuser = test_get_seuser(sh, argv[2]); - - result = semanage_seuser_clone(sh, seuser, &seuser_clone); - printf("semanage_seuser_clone(%p, %p): %d\n", - (void *) seuser, (void *) seuser_clone, result); - - if (result < 0) { - perror("semanage_seuser_clone"); - exit(1); - } - - str = semanage_seuser_get_name(seuser); - str_clone = semanage_seuser_get_name(seuser_clone); - - if (strcmp(str, str_clone) != 0) { - fprintf(stderr, "Different in get_name\n"); - exit(1); - } - - str = semanage_seuser_get_sename(seuser); - str_clone = semanage_seuser_get_sename(seuser_clone); - - if (strcmp(str, str_clone) != 0) { - fprintf(stderr, "Different in get_sename\n"); - exit(1); - } - - str = semanage_seuser_get_mlsrange(seuser); - str_clone = semanage_seuser_get_mlsrange(seuser_clone); - - if (strcmp(str, str_clone) != 0) { - fprintf(stderr, "Different in get_mlsrange\n"); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_compare.c b/libsemanage/semanage-seuser-functions/test_compare.c deleted file mode 100644 index 5615463..0000000 --- a/libsemanage/semanage-seuser-functions/test_compare.c +++ /dev/null @@ -1,44 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - semanage_seuser_key_t *key; - int result; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - seuser = test_get_seuser(sh, "first"); - - key = test_get_key(sh, argv[2]); - - result = semanage_seuser_compare(seuser, key); - printf("semanage_seuser_compare(%p, %p): %d\n", - (void *) seuser, (void *) key, result); - - if (argc >= 4) { - if (strcmp(argv[3], "same") == 0 && result != 0) { - fprintf(stderr, "Expected same but got different\n"); - exit(1); - } - else if (strcmp(argv[3], "different") == 0 && result == 0) { - fprintf(stderr, "Expected different but got same\n"); - exit(1); - } - } - - semanage_seuser_key_free(key); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_compare2.c b/libsemanage/semanage-seuser-functions/test_compare2.c deleted file mode 100644 index afeec07..0000000 --- a/libsemanage/semanage-seuser-functions/test_compare2.c +++ /dev/null @@ -1,54 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - semanage_seuser_t *seuser2; - int result; - int first = -1; - int second = -1; - - if (argc < 4) - exit(2); - - sh = get_handle(argv[1]); - - if (strcmp(argv[2], "NULL") == 0) { - seuser = NULL; - } - else { - first = strtol(argv[2], NULL, 10); - seuser = test_get_seuser_nth(sh, first); - } - - if (strcmp(argv[3], "NULL") == 0) { - seuser2 = NULL; - } - else { - second = strtol(argv[3], NULL, 10); - seuser2 = test_get_seuser_nth(sh, second); - } - - result = semanage_seuser_compare2(seuser, seuser2); - printf("semanage_seuser_compare(%p, %p): %d\n", - (void *) seuser, (void *) seuser2, result); - - if (first == second && result != 0) { - fprintf(stderr, "Expected same but got different\n"); - exit(1); - } - else if (first != second && result == 0) { - fprintf(stderr, "Expected different but got same\n"); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_count.c b/libsemanage/semanage-seuser-functions/test_count.c deleted file mode 100644 index 7fabe4b..0000000 --- a/libsemanage/semanage-seuser-functions/test_count.c +++ /dev/null @@ -1,34 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - unsigned int response; - int result; - - if (argc < 2) - exit(2); - - sh = get_handle(argv[1]); - - result = semanage_seuser_count(sh, &response); - printf("semanage_seuser_count(%p, %p): %d, response: %u\n", - (void *) sh, (void *) &response, result, response); - - if (result < 0) { - perror("semanage_seuser_count"); - exit(1); - } - - if (argc >= 3) - check_result_int(argv[2], response); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_count_local.c b/libsemanage/semanage-seuser-functions/test_count_local.c deleted file mode 100644 index f25ab6d..0000000 --- a/libsemanage/semanage-seuser-functions/test_count_local.c +++ /dev/null @@ -1,46 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - int result; - unsigned int response; - int num; - - if (argc < 2) - exit(2); - - sh = get_handle(argv[1]); - - num = strtol(argv[2], NULL, 10); - - for (int i = 0; i < num; i++) { - seuser = test_get_seuser_nth(sh, i); - - test_add_local_seuser(sh, seuser); - } - - result = semanage_seuser_count_local(sh, &response); - printf("semanage_seuser_count_local(%p, %p): %d, response: %d\n", - (void *) sh, (void *) &response, result, response); - - if (result < 0) { - perror("semanage_seuser_count_local"); - exit(1); - } - - if (argc >= 3) - check_result_int(argv[2], response); - - test_del_local_seuser(sh, seuser); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_create.c b/libsemanage/semanage-seuser-functions/test_create.c deleted file mode 100644 index a5191a0..0000000 --- a/libsemanage/semanage-seuser-functions/test_create.c +++ /dev/null @@ -1,53 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - int result; - const char *str; - - if (argc < 2) - exit(2); - - sh = get_handle(argv[1]); - - result = semanage_seuser_create(sh, &seuser); - printf("semanage_seuser_create(%p, %p): %d\n", - (void *) sh, (void *) seuser, result); - - if (result < 0) { - perror("semanage_seuser_create"); - exit(1); - } - - str = semanage_seuser_get_name(seuser); - - if (str != NULL) { - fprintf(stderr, "Expected name == NULL, got %s\n", str); - exit(1); - } - - str = semanage_seuser_get_sename(seuser); - - if (str != NULL) { - fprintf(stderr, "Expected sename == NULL, got %s\n", str); - exit(1); - } - - str = semanage_seuser_get_mlsrange(seuser); - - if (str != NULL) { - fprintf(stderr, "Expected mlsrange == NULL, got %s\n", str); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_del_local.c b/libsemanage/semanage-seuser-functions/test_del_local.c deleted file mode 100644 index eced74a..0000000 --- a/libsemanage/semanage-seuser-functions/test_del_local.c +++ /dev/null @@ -1,64 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - semanage_seuser_t *seuser_del; - semanage_seuser_key_t *key; - semanage_seuser_t **records; - int result; - unsigned int count; - - if (argc < 4) - exit(2); - - sh = get_handle(argv[1]); - - seuser = test_get_seuser(sh, argv[2]); - - test_add_local_seuser(sh, seuser); - - seuser_del = test_get_seuser(sh, argv[3]); - - result = semanage_seuser_key_extract(sh, seuser_del, &key); - printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", - (void *) sh, (void *) seuser_del, (void *) &key, result); - - if (result < 0) { - perror("semanage_seuser_key_extract"); - exit(2); - } - - result = semanage_seuser_del_local(sh, key); - printf("semanage_seuser_del_local(%p, %p): %d\n", - (void *) seuser, (void *) key, result); - - if (result < 0) { - perror("semanage_seuser_del_local"); - exit(1); - } - - result = semanage_seuser_list_local(sh, &records, &count); - printf("semanage_seuser_list_local(%p, %p, %p): %d\n", - (void *) sh, (void *) &records, (void *) &count, result); - - if (result < 0) { - perror("semanage_seuser_list_local"); - exit(2); - } - - if (count != 0) { - fprintf(stderr, "Number of local seusers is not 0!\n"); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_exists.c b/libsemanage/semanage-seuser-functions/test_exists.c deleted file mode 100644 index c0af3b2..0000000 --- a/libsemanage/semanage-seuser-functions/test_exists.c +++ /dev/null @@ -1,37 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_key_t *key; - int result; - int response; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - key = test_get_key(sh, argv[2]); - - result = semanage_seuser_exists(sh, key, &response); - printf("semanage_seuser_exists(%p, %p, %p): %d, response: %d\n", - (void *) sh, (void *) key, (void *) &response, result, response); - - if (result < 0) { - perror("semanage_seuser_exists"); - exit(1); - } - - if (argc >= 4) - check_result_int(argv[3], response); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_exists_local.c b/libsemanage/semanage-seuser-functions/test_exists_local.c deleted file mode 100644 index 165d5b3..0000000 --- a/libsemanage/semanage-seuser-functions/test_exists_local.c +++ /dev/null @@ -1,59 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - semanage_seuser_t *seuser_exists; - semanage_seuser_key_t *key; - int result; - int response; - int exp; - - if (argc < 4) - exit(2); - - sh = get_handle(argv[1]); - - seuser = test_get_seuser(sh, argv[2]); - seuser_exists = test_get_seuser(sh, argv[3]); - - test_add_local_seuser(sh, seuser); - - result = semanage_seuser_key_extract(sh, seuser_exists, &key); - printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", - (void *) sh, (void *) seuser_exists, (void *) &key, result); - if (result < 0) { - perror("semanage_seuser_key_extract"); - exit(2); - } - - result = semanage_seuser_exists_local(sh, key, &response); - printf("semanage_seuser_exists_local(%p, %p, %p): %d\n", - (void *) sh, (void *) key, (void *) &response, result); - - if (result < 0) { - perror("semanage_seuser_exists_local"); - exit(1); - } - - if (argc >= 5) { - exp = strtol(argv[4], NULL, 10); - - if (response != exp) { - fprintf(stderr, "Expected %d but got %d\n", exp, response); - exit(1); - } - } - - test_del_local_seuser(sh, seuser); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_get_mlsrange.c b/libsemanage/semanage-seuser-functions/test_get_mlsrange.c deleted file mode 100644 index 97172dc..0000000 --- a/libsemanage/semanage-seuser-functions/test_get_mlsrange.c +++ /dev/null @@ -1,32 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - - if (argc < 4) - exit(2); - - sh = get_handle(argv[1]); - - seuser = test_get_seuser(sh, argv[2]); - - const char *name = semanage_seuser_get_mlsrange(seuser); - printf("semanage_seuser_get_mlsrange(%p): %s\n", - (void *) seuser, name); - - if (strcmp_null(argv[3], name) != 0) { - fprintf(stderr, "Expected %s but got %s\n", argv[2], name); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_get_name.c b/libsemanage/semanage-seuser-functions/test_get_name.c deleted file mode 100644 index 95d9025..0000000 --- a/libsemanage/semanage-seuser-functions/test_get_name.c +++ /dev/null @@ -1,32 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - - if (argc < 4) - exit(2); - - sh = get_handle(argv[1]); - - seuser = test_get_seuser(sh, argv[2]); - - const char *name = semanage_seuser_get_name(seuser); - printf("semanage_seuser_get_name(%p): %s\n", - (void *) seuser, name); - - if (strcmp_null(argv[3], name) != 0) { - fprintf(stderr, "Expected %s but got %s\n", argv[2], name); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_get_sename.c b/libsemanage/semanage-seuser-functions/test_get_sename.c deleted file mode 100644 index 1ed7248..0000000 --- a/libsemanage/semanage-seuser-functions/test_get_sename.c +++ /dev/null @@ -1,32 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - - if (argc < 4) - exit(2); - - sh = get_handle(argv[1]); - - seuser = test_get_seuser(sh, argv[2]); - - const char *name = semanage_seuser_get_sename(seuser); - printf("semanage_seuser_get_sename(%p): %s\n", - (void *) seuser, name); - - if (strcmp_null(argv[3], name) != 0) { - fprintf(stderr, "Expected %s but got %s\n", argv[2], name); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_iterate.c b/libsemanage/semanage-seuser-functions/test_iterate.c deleted file mode 100644 index 533087a..0000000 --- a/libsemanage/semanage-seuser-functions/test_iterate.c +++ /dev/null @@ -1,49 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int counter = 0; - -int handler(const semanage_seuser_t *record, void *varg) { - char **args = (char **) varg; - - const char *name = semanage_seuser_get_name(record); - - if (strcmp(name, args[2 + counter++]) != 0) - return -1; - - return 0; -} - -int main (int argc, char **argv) { - semanage_handle_t *sh; - int result; - - if (argc < 2) - exit(2); - - sh = get_handle(argv[1]); - - char **param = NULL; - - if (argc >= 3) { - param = argv; - } - - result = semanage_seuser_iterate(sh, &handler, (void *) param); - printf("semanage_seuser_iterate(%p, %p, %p): %d\n", - (void *) sh, (void *) &handler, (void *) param, result); - - if (result < 0) { - perror("semanage_seuser_iterate"); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_key_create.c b/libsemanage/semanage-seuser-functions/test_key_create.c deleted file mode 100644 index 8f3aaf5..0000000 --- a/libsemanage/semanage-seuser-functions/test_key_create.c +++ /dev/null @@ -1,39 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_key_t *key; - const char *name; - int result; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - if (strcmp(argv[2], "NULL") == 0) - name = NULL; - else - name = argv[2]; - - result = semanage_seuser_key_create(sh, name, &key); - printf("semanage_seuser_key_create(%p, %s, %p): %d\n", - (void *) sh, name, (void *) &key, result); - - if (result < 0 || key == NULL) { - perror("semanage_seuser_key_create"); - exit(1); - } - - semanage_seuser_key_free(key); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_key_extract.c b/libsemanage/semanage-seuser-functions/test_key_extract.c deleted file mode 100644 index 50658dc..0000000 --- a/libsemanage/semanage-seuser-functions/test_key_extract.c +++ /dev/null @@ -1,45 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - semanage_seuser_key_t *key; - int result; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - seuser = test_get_seuser(sh, argv[2]); - - result = semanage_seuser_key_extract(sh, seuser, &key); - printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", - (void *) sh, (void *) seuser, (void *) &key, result); - - if (result < 0) { - perror("semanage_seuser_key_extract"); - exit(1); - } - - result = semanage_seuser_compare(seuser, key); - printf("semanage_seuser_compare(%p, %p): %d\n", - (void *) seuser, (void *) key, result); - - if (result != 0) { - perror("semanage_seuser_compare"); - exit(1); - } - - semanage_seuser_key_free(key); - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_list.c b/libsemanage/semanage-seuser-functions/test_list.c deleted file mode 100644 index ae06187..0000000 --- a/libsemanage/semanage-seuser-functions/test_list.c +++ /dev/null @@ -1,63 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t **records; - unsigned int count; - int result; - - if (argc < 2) - exit(2); - - sh = get_handle(argv[1]); - - result = semanage_seuser_list(sh, &records, &count); - printf("semanage_seuser_list(%p, %p, %p): %d", - (void *) sh, (void *) &records, (void *) &count, result); - - if (result < 0) { - perror("semanage_seuser_list"); - exit(1); - } - - printf(", count: %u, records: ", count); - - const char *name; - - for (unsigned int i = 0; i < count; i++) { - name = semanage_seuser_get_name(records[i]); - printf("%p (%s), ", (void *) records[i], name); - } - - printf("\n"); - - if (argc >= 3) { - unsigned int exp_count = strtoul(argv[2], NULL, 10); - - if (count != exp_count) { - printf("Expected %u but got %u\n", exp_count, count); - exit(1); - } - - const char *name; - - for (unsigned int i = 0; i < count; i++) { - name = semanage_seuser_get_name(records[i]); - - if (strcmp(name, argv[3 + i]) != 0) { - printf("Expected %s but got %s\n", name, argv[3 + i]); - exit(1); - } - } - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_modify_local.c b/libsemanage/semanage-seuser-functions/test_modify_local.c deleted file mode 100644 index 53a11f5..0000000 --- a/libsemanage/semanage-seuser-functions/test_modify_local.c +++ /dev/null @@ -1,64 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *seuser; - semanage_seuser_key_t *key; - semanage_seuser_t **records; - int result; - unsigned int count; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - seuser = test_get_seuser(sh, argv[2]); - - result = semanage_seuser_key_extract(sh, seuser, &key); - printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", - (void *) sh, (void *) seuser, (void *) &key, result); - - if (result < 0) { - perror("semanage_seuser_key_extract"); - exit(2); - } - - result = semanage_seuser_modify_local(sh, key, seuser); - printf("semanage_seuser_modify_local(%p, %p, %p): %d\n", - (void *) seuser, (void *) key, (void *) seuser, result); - - if (result < 0) { - perror("semanage_seuser_modify_local"); - exit(1); - } - - result = semanage_seuser_list_local(sh, &records, &count); - printf("semanage_seuser_list_local(%p, %p, %p): %d\n", - (void *) sh, (void *) &records, (void *) &count, result); - - if (result < 0) { - perror("semanage_seuser_list_local"); - exit(2); - } - - if (count != 1) { - fprintf(stderr, "Number of local seusers is %u, expected 1!\n", count); - exit(1); - } - - if (semanage_seuser_compare(records[0], key) != 0) { - fprintf(stderr, "Local seuser is different!\n"); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_query.c b/libsemanage/semanage-seuser-functions/test_query.c deleted file mode 100644 index 10b4e27..0000000 --- a/libsemanage/semanage-seuser-functions/test_query.c +++ /dev/null @@ -1,50 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_key_t *key; - semanage_seuser_t *response; - int result; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - result = semanage_seuser_key_create(sh, argv[2], &key); - printf("semanage_seuser_key_create(%p, %s, %p): %d\n", - (void *) sh, argv[2], (void *) &key, result); - - if (result < 0 || key == NULL) { - perror("semanage_seuser_key_create"); - exit(2); - } - - result = semanage_seuser_query(sh, key, &response); - printf("semanage_seuser_query(%p, %p, %p): %d, response: %p\n", - (void *) sh, (void *) key, (void *) &response, result, (void *) response); - - if (result < 0) { - perror("semanage_seuser_query"); - exit(1); - } - - const char *name = semanage_seuser_get_name(response); - printf("semanage_seuser_get_name(%p): %s\n", - (void *) response, name); - - if (strcmp(argv[2], name) != 0) { - perror("semanage_seuser_get_name"); - exit(2); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_set_mlsrange.c b/libsemanage/semanage-seuser-functions/test_set_mlsrange.c deleted file mode 100644 index 48440ac..0000000 --- a/libsemanage/semanage-seuser-functions/test_set_mlsrange.c +++ /dev/null @@ -1,62 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *user; - int result; - const char *mlsrange; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - user = test_get_seuser(sh, "first"); - - if (strcmp(argv[2], "NULL") == 0) - mlsrange = NULL; - else - mlsrange = argv[2]; - - const char *old_mlsrange = semanage_seuser_get_mlsrange(user); - printf("semanage_seuser_get_mlsrange(%p): %s\n", - (void *) user, old_mlsrange); - - if (old_mlsrange == NULL) { - perror("semanage_seuser_get_mlsrange"); - exit(2); - } - - if (strcmp(old_mlsrange, mlsrange) == 0) { - printf("New mlsrange is the same\n"); - exit(2); - } - - result = semanage_seuser_set_mlsrange(sh, user, mlsrange); - printf("semanage_seuser_set_mlsrange(%p, %p, %s): %d\n", - (void *) sh, (void *) user, mlsrange, result); - - if (result < 0) { - perror("semanage_seuser_set_mlsrange"); - exit(1); - } - - const char *new_mlsrange = semanage_seuser_get_mlsrange(user); - printf("semanage_seuser_get_mlsrange(%p): %s\n", - (void *) user, new_mlsrange); - - if (strcmp(new_mlsrange, mlsrange) != 0) { - perror("semanage_seuser_get_mlsrange"); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_set_name.c b/libsemanage/semanage-seuser-functions/test_set_name.c deleted file mode 100644 index 3e448e8..0000000 --- a/libsemanage/semanage-seuser-functions/test_set_name.c +++ /dev/null @@ -1,62 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *user; - int result; - const char *name; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - user = test_get_seuser(sh, "first"); - - if (strcmp(argv[2], "NULL") == 0) - name = NULL; - else - name = argv[2]; - - const char *old_name = semanage_seuser_get_name(user); - printf("semanage_seuser_get_name(%p): %s\n", - (void *) user, old_name); - - if (old_name == NULL) { - perror("semanage_seuser_get_name"); - exit(2); - } - - if (strcmp(old_name, name) == 0) { - printf("New name is the same\n"); - exit(2); - } - - result = semanage_seuser_set_name(sh, user, name); - printf("semanage_seuser_set_name(%p, %p, %s): %d\n", - (void *) sh, (void *) user, name, result); - - if (result < 0) { - perror("semanage_seuser_set_name"); - exit(1); - } - - const char *new_name = semanage_seuser_get_name(user); - printf("semanage_seuser_get_name(%p): %s\n", - (void *) user, new_name); - - if (strcmp(new_name, name) != 0) { - perror("semanage_seuser_get_name"); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage-seuser-functions/test_set_sename.c b/libsemanage/semanage-seuser-functions/test_set_sename.c deleted file mode 100644 index 402c5b7..0000000 --- a/libsemanage/semanage-seuser-functions/test_set_sename.c +++ /dev/null @@ -1,62 +0,0 @@ -#include -#include -#include -#include -#include - -#include "functions.c" - -int main (int argc, char **argv) { - semanage_handle_t *sh; - semanage_seuser_t *user; - int result; - const char *name; - - if (argc < 3) - exit(2); - - sh = get_handle(argv[1]); - - user = test_get_seuser(sh, "first"); - - if (strcmp(argv[2], "NULL") == 0) - name = NULL; - else - name = argv[2]; - - const char *old_name = semanage_seuser_get_sename(user); - printf("semanage_seuser_get_sename(%p): %s\n", - (void *) user, old_name); - - if (old_name == NULL) { - perror("semanage_seuser_get_sename"); - exit(2); - } - - if (strcmp(old_name, name) == 0) { - printf("New name is the same\n"); - exit(2); - } - - result = semanage_seuser_set_sename(sh, user, name); - printf("semanage_seuser_set_sename(%p, %p, %s): %d\n", - (void *) sh, (void *) user, name, result); - - if (result < 0) { - perror("semanage_seuser_set_sename"); - exit(1); - } - - const char *new_name = semanage_seuser_get_sename(user); - printf("semanage_seuser_get_sename(%p): %s\n", - (void *) user, new_name); - - if (strcmp(new_name, name) != 0) { - perror("semanage_seuser_get_sename"); - exit(1); - } - - destroy_handle(sh, argv[1]); - - exit(0); -} diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf b/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf deleted file mode 100644 index 2dce7fb..0000000 --- a/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf +++ /dev/null @@ -1,11 +0,0 @@ -summary: Update a file context and relabel -test: ./test.sh -framework: beakerlib -require: - - python3-policycoreutils - - policycoreutils-python-utils - - python3-libsemanage - - setools-console -link: - - verifies: https://issues.redhat.com/browse/RHEL-73348 -id: f4ecd93d-d4bc-45fc-8386-193dd4f922e4 diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/test.sh b/libsemanage/semanage_setfiles-selinux_restorecon/test.sh deleted file mode 100755 index b52efd9..0000000 --- a/libsemanage/semanage_setfiles-selinux_restorecon/test.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" - rlRun "set -o pipefail" - rlRun "source /etc/selinux/config" - rlRun "ETC_RW_T_LABEL=\"$(seinfo -t | grep etc_rw_t | head -1 | awk '{$1=$1};1')\"" - rlPhaseEnd - - rlPhaseStartTest - rlRun "mkdir -p $tmp/test/subtest | cut -d ' ' -f 1" - rlRun "ls -Zd $tmp/test $tmp/test/subtest | cut -d ' ' -f 1" - - rlRun "python3 update_context.py $tmp/test ${ETC_RW_T_LABEL} ${SELINUXTYPE}" - LABEL="system_u:object_r:${ETC_RW_T_LABEL}:s0" - LABEL_TEST=$(ls -Zd $tmp/test | cut -d ' ' -f 1) - LABEL_SUBTEST=$(ls -Zd $tmp/test/subtest | cut -d ' ' -f 1) - rlRun "ls -Zd $tmp/test $tmp/test/subtest" - rlAssertEquals "Is $tmp/test $LABEL?" "$LABEL_TEST" "$LABEL" - rlAssertEquals "Is $tmp/test/subtest $LABEL?" "$LABEL_SUBTEST" "$LABEL" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "semanage fcontext -D" - rlRun "rm -rf $tmp" 0 "Remove tmp directory" - rlPhaseEnd -rlJournalEnd diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py b/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py deleted file mode 100755 index e58eac8..0000000 --- a/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py +++ /dev/null @@ -1,21 +0,0 @@ -#!/usr/bin/env python3 - -import sys -import selinux -import seobject - -def update_context(file_dir, new_context, selinux_policy): - suffix = '(/.*)?' - trans = seobject.semanageRecords(selinux_policy) - trans.start() - - fcon = seobject.fcontextRecords(trans) - fcon.add( - file_dir + suffix, - new_context, '', 's0', '') - trans.finish() - selinux.restorecon(file_dir, True, True, True) - - -if __name__ == "__main__": - update_context(sys.argv[1], sys.argv[2], sys.argv[3]) diff --git a/libsemanage/usepasswd-in-semanage-conf/Makefile b/libsemanage/usepasswd-in-semanage-conf/Makefile index f63aae5..04e5715 100644 --- a/libsemanage/usepasswd-in-semanage-conf/Makefile +++ b/libsemanage/usepasswd-in-semanage-conf/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-devel shadow-utils" >> $(METADATA) + @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-devel" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libsemanage/usepasswd-in-semanage-conf/main.fmf b/libsemanage/usepasswd-in-semanage-conf/main.fmf index 0e37053..7cd455b 100644 --- a/libsemanage/usepasswd-in-semanage-conf/main.fmf +++ b/libsemanage/usepasswd-in-semanage-conf/main.fmf @@ -1,34 +1,6 @@ +path: /libsemanage/usepasswd-in-semanage-conf summary: Make sure usepasswd option in semanage.conf works properly -description: |+ - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1871786 - - Make sure usepasswd option in semanage.conf works properly - -contact: Milos Malik -component: - - libsemanage -recommend: - - libselinux - - libselinux-utils - - libsemanage - - policycoreutils - - policycoreutils-python-utils - - selinux-policy - - selinux-policy-devel - - shadow-utils -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - targeted - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1871786 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0609005 -extra-summary: /CoreOS/libsemanage/Sanity/usepasswd-in-semanage-conf -extra-task: /CoreOS/libsemanage/Sanity/usepasswd-in-semanage-conf +tier: 2 +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/libsemanage/usepasswd-in-semanage-conf/runtest.sh b/libsemanage/usepasswd-in-semanage-conf/runtest.sh index b1ec6fd..8aadf23 100755 --- a/libsemanage/usepasswd-in-semanage-conf/runtest.sh +++ b/libsemanage/usepasswd-in-semanage-conf/runtest.sh @@ -61,9 +61,9 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -f duck-home" - rlRun "userdel -f duck-tmp" - rlRun "userdel -f duck-var-lib" + rlRun "userdel duck-home" + rlRun "userdel duck-tmp" + rlRun "userdel duck-var-lib" rlLog "SELinux users with home in / shoud not trigger a policy change" rlRun "useradd -Z unconfined_u -d /tmp duck-tmp" @@ -71,8 +71,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -fZ duck-tmp" - rlRun "userdel -fZ duck-var" + rlRun "userdel -Z duck-tmp" + rlRun "userdel -Z duck-var" rlLog "Other SELinux users should trigger a policy change" rlRun "useradd -Z unconfined_u duck-home" @@ -80,8 +80,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E 'duck-(home|var-home)'" 0 - rlRun "userdel -fZ duck-home" - rlRun "userdel -fZ duck-var-home" + rlRun "userdel -Z duck-home" + rlRun "userdel -Z duck-var-home" rlFileRestore rlPhaseEnd @@ -98,14 +98,14 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -f duck-home" + rlRun "userdel duck-home" rlLog "Standard users with home in directory like /var/home should trigger a policy change" rlRun "useradd -d /var/home/duck duck-var-home" rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E '/var/home/'" 0 - rlRun "userdel -f duck-var-home" + rlRun "userdel duck-var-home" rlLog "Standard users with home in / shoud not trigger a policy change" rlRun "useradd -d /tmp duck-tmp" @@ -113,8 +113,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -fZ duck-tmp" - rlRun "userdel -fZ duck-var" + rlRun "userdel -Z duck-tmp" + rlRun "userdel -Z duck-var" rlLog "SELinux users with home in / shoud not trigger a policy change" rlRun "useradd -Z unconfined_u -d /tmp duck-tmp" @@ -122,8 +122,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -fZ duck-tmp" - rlRun "userdel -fZ duck-var" + rlRun "userdel -Z duck-tmp" + rlRun "userdel -Z duck-var" rlLog "Other SELinux users should trigger a policy change" rlRun "useradd -Z unconfined_u duck-home" @@ -131,8 +131,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E 'duck-(home|var-home)'" 0 - rlRun "userdel -fZ duck-home" - rlRun "userdel -fZ duck-var-home" + rlRun "userdel -Z duck-home" + rlRun "userdel -Z duck-var-home" rlFileRestore rlPhaseEnd diff --git a/libsemanage/verify-options-in-semanage-conf/Makefile b/libsemanage/verify-options-in-semanage-conf/Makefile index 83b6c9a..3f94665 100644 --- a/libsemanage/verify-options-in-semanage-conf/Makefile +++ b/libsemanage/verify-options-in-semanage-conf/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-devel" >> $(METADATA) + @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python selinux-policy selinux-policy-devel" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libsemanage/verify-options-in-semanage-conf/main.fmf b/libsemanage/verify-options-in-semanage-conf/main.fmf index 5b32f86..9444a6c 100644 --- a/libsemanage/verify-options-in-semanage-conf/main.fmf +++ b/libsemanage/verify-options-in-semanage-conf/main.fmf @@ -1,40 +1,12 @@ +path: /libsemanage/verify-options-in-semanage-conf summary: Are the verify options in semanage.conf honored? -description: |+ +description: | Are the verify options in semanage.conf honored? Tested options: verify kernel, verify module, verify linked Tested tools: semodule, semanage Positive and negative cases are tested. Original information found at http://selinuxproject.org/page/PolicyValidate - -contact: Milos Malik -component: - - libsemanage -recommend: - - libselinux - - libselinux-utils - - libsemanage - - policycoreutils - - policycoreutils-python-utils - - selinux-policy - - selinux-policy-devel -duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - TierCandidatesFAIL - - f32friendly - - f33friendly - - targeted tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1400705 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0540246 -extra-summary: /CoreOS/libsemanage/Sanity/verify-options-in-semanage-conf -extra-task: /CoreOS/libsemanage/Sanity/verify-options-in-semanage-conf +adjust: +- enabled: false + when: distro < rhel-6 diff --git a/libsemanage/verify-options-in-semanage-conf/runtest.sh b/libsemanage/verify-options-in-semanage-conf/runtest.sh index c295509..c7891f3 100755 --- a/libsemanage/verify-options-in-semanage-conf/runtest.sh +++ b/libsemanage/verify-options-in-semanage-conf/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libsemanage" @@ -61,7 +62,7 @@ rlJournalStart rlAssertNotGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertNotGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei + rlAssertNotGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" rlPhaseEnd @@ -73,7 +74,7 @@ rlJournalStart rlAssertNotGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertNotGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei + rlAssertNotGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" rlPhaseEnd @@ -102,7 +103,7 @@ rlJournalStart rlAssertGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" 1 rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei + rlAssertGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" 1 rlPhaseEnd @@ -114,7 +115,7 @@ rlJournalStart rlAssertGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" 1 rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei + rlAssertGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" 1 rlPhaseEnd diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile deleted file mode 100644 index b1cceb1..0000000 --- a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile +++ /dev/null @@ -1,72 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit -# Description: The rpm scripts from libsepol uses out of date commands like telinit. -# Author: Amith Kumar -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Amith Kumar " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: The rpm scripts from libsepol uses out of date commands like telinit" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: libsepol" >> $(METADATA) - @echo "RunFor: libselinux" >> $(METADATA) - @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libsepol" >> $(METADATA) - @echo "Requires: libsepol-devel" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-devel" >> $(METADATA) - @echo "Requires: libsemanage" >> $(METADATA) - @echo "Requires: libsemanage-devel" >> $(METADATA) - @echo "Requires: pkgconfig" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Bug: 1838257" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE deleted file mode 100644 index 21b5178..0000000 --- a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE +++ /dev/null @@ -1,11 +0,0 @@ -PURPOSE of /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit - -Description: libsepol rpm scripts use deprecated telinit command - -Author: Amith Kumar - -Bugzilla links: -https://bugzilla.redhat.com/show_bug.cgi?id=1838257 - -Description of problem: -The rpm scripts from the rpm is using out of date commands like telinit. diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf deleted file mode 100644 index d831b58..0000000 --- a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf +++ /dev/null @@ -1,27 +0,0 @@ -summary: The rpm scripts from libsepol uses out of date commands like telinit -description: | - Description: libsepol rpm scripts use deprecated telinit command - - Author: Amith Kumar - - Bugzilla links: - https://bugzilla.redhat.com/show_bug.cgi?id=1838257 - - Description of problem: - The rpm scripts from the rpm is using out of date commands like telinit. -contact: Amith Kumar -component: - - libsepol -recommend: - - libsepol - - libsepol-devel - - libselinux - - libselinux-devel - - libsemanage - - libsemanage-devel - - pkgconfig -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838257 -extra-summary: /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit -extra-task: /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit -id: bfadc6af-3873-4dd9-a7af-3f97bd92e150 diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh deleted file mode 100755 index adf27a2..0000000 --- a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh +++ /dev/null @@ -1,51 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit -# Description: The rpm scripts from the rpm is using out of date commands like telinit. -# Author: Amith Kumar -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE=libsepol -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlPhaseEnd - - if rlIsFedora '>=33' || rlIsRHEL ">=7" ; then - rlPhaseStartTest "libsepol rpm scripts use deprecated telinit command bz#1838257" - for COMPONENT in "libsepol" "libsemanage" "libselinux" ; do - rlRun "rpm -qa --scripts \*$COMPONENT\* 2>&1 | tee output_file" - rlAssertNotGrep "telinit" output_file - rlRun "rm -f output_file" - done - rlPhaseEnd - fi - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/libsepol/self-keyword-in-type-rules/main.fmf b/libsepol/self-keyword-in-type-rules/main.fmf deleted file mode 100644 index 5db34a4..0000000 --- a/libsepol/self-keyword-in-type-rules/main.fmf +++ /dev/null @@ -1,28 +0,0 @@ -summary: Test support for self keyword in type rules -description: | - Verifies that libsepol/checkmodule supports the self keyword in type rules. -contact: Ondrej Mosnacek -component: - - libsepol - - checkpolicy -framework: beakerlib -require: - - policycoreutils - - checkpolicy - - setools-console - - selinux-policy - - selinux-policy-devel - - diffutils -duration: 15m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-9.1 - because: RHEL-8 and below are not expected to support this - - enabled: false - when: distro < fedora-37 - because: This feature may not be available in F36 and below -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2069718 -extra-nitrate: TC#0613928 diff --git a/libsepol/self-keyword-in-type-rules/rules_expected.txt b/libsepol/self-keyword-in-type-rules/rules_expected.txt deleted file mode 100644 index 239acc4..0000000 --- a/libsepol/self-keyword-in-type-rules/rules_expected.txt +++ /dev/null @@ -1,90 +0,0 @@ -type_change test_a_t test_a_t:dir test_e_t; -type_change test_a_t test_a_t:file test_e_t; -type_change test_b_t test_b_t:dir test_e_t; -type_change test_b_t test_b_t:file test_e_t; -type_change test_c_t test_c_t:dir test_e_t; -type_change test_c_t test_c_t:file test_e_t; -type_change test_d_t test_d_t:dir test_e_t; -type_change test_d_t test_d_t:file test_e_t; -type_change test_h_t test_a_t:dir test_e_t; -type_change test_h_t test_a_t:file test_e_t; -type_change test_h_t test_b_t:dir test_e_t; -type_change test_h_t test_b_t:file test_e_t; -type_change test_h_t test_c_t:dir test_e_t; -type_change test_h_t test_c_t:file test_e_t; -type_change test_h_t test_d_t:dir test_e_t; -type_change test_h_t test_d_t:file test_e_t; -type_change test_h_t test_h_t:dir test_e_t; -type_change test_h_t test_h_t:file test_e_t; -type_member test_a_t test_a_t:dir test_e_t; -type_member test_a_t test_a_t:file test_e_t; -type_member test_b_t test_b_t:dir test_e_t; -type_member test_b_t test_b_t:file test_e_t; -type_member test_c_t test_c_t:dir test_e_t; -type_member test_c_t test_c_t:file test_e_t; -type_member test_d_t test_d_t:dir test_e_t; -type_member test_d_t test_d_t:file test_e_t; -type_member test_h_t test_a_t:dir test_e_t; -type_member test_h_t test_a_t:file test_e_t; -type_member test_h_t test_b_t:dir test_e_t; -type_member test_h_t test_b_t:file test_e_t; -type_member test_h_t test_c_t:dir test_e_t; -type_member test_h_t test_c_t:file test_e_t; -type_member test_h_t test_d_t:dir test_e_t; -type_member test_h_t test_d_t:file test_e_t; -type_member test_h_t test_h_t:dir test_e_t; -type_member test_h_t test_h_t:file test_e_t; -type_transition test_a_t test_a_t:dir test_e_t; -type_transition test_a_t test_a_t:dir test_f_t filename1; -type_transition test_a_t test_a_t:dir test_g_t filename2; -type_transition test_a_t test_a_t:file test_e_t; -type_transition test_a_t test_a_t:file test_f_t filename1; -type_transition test_a_t test_a_t:file test_g_t filename2; -type_transition test_b_t test_b_t:dir test_e_t; -type_transition test_b_t test_b_t:dir test_f_t filename1; -type_transition test_b_t test_b_t:dir test_g_t filename2; -type_transition test_b_t test_b_t:file test_e_t; -type_transition test_b_t test_b_t:file test_f_t filename1; -type_transition test_b_t test_b_t:file test_g_t filename2; -type_transition test_c_t test_c_t:dir test_e_t; -type_transition test_c_t test_c_t:dir test_f_t filename1; -type_transition test_c_t test_c_t:dir test_g_t filename2; -type_transition test_c_t test_c_t:file test_e_t; -type_transition test_c_t test_c_t:file test_f_t filename1; -type_transition test_c_t test_c_t:file test_g_t filename2; -type_transition test_d_t test_d_t:dir test_e_t; -type_transition test_d_t test_d_t:dir test_f_t filename1; -type_transition test_d_t test_d_t:dir test_g_t filename2; -type_transition test_d_t test_d_t:file test_e_t; -type_transition test_d_t test_d_t:file test_f_t filename1; -type_transition test_d_t test_d_t:file test_g_t filename2; -type_transition test_h_t test_a_t:dir test_e_t; -type_transition test_h_t test_a_t:dir test_f_t filename1; -type_transition test_h_t test_a_t:dir test_g_t filename2; -type_transition test_h_t test_a_t:file test_e_t; -type_transition test_h_t test_a_t:file test_f_t filename1; -type_transition test_h_t test_a_t:file test_g_t filename2; -type_transition test_h_t test_b_t:dir test_e_t; -type_transition test_h_t test_b_t:dir test_f_t filename1; -type_transition test_h_t test_b_t:dir test_g_t filename2; -type_transition test_h_t test_b_t:file test_e_t; -type_transition test_h_t test_b_t:file test_f_t filename1; -type_transition test_h_t test_b_t:file test_g_t filename2; -type_transition test_h_t test_c_t:dir test_e_t; -type_transition test_h_t test_c_t:dir test_f_t filename1; -type_transition test_h_t test_c_t:dir test_g_t filename2; -type_transition test_h_t test_c_t:file test_e_t; -type_transition test_h_t test_c_t:file test_f_t filename1; -type_transition test_h_t test_c_t:file test_g_t filename2; -type_transition test_h_t test_d_t:dir test_e_t; -type_transition test_h_t test_d_t:dir test_f_t filename1; -type_transition test_h_t test_d_t:dir test_g_t filename2; -type_transition test_h_t test_d_t:file test_e_t; -type_transition test_h_t test_d_t:file test_f_t filename1; -type_transition test_h_t test_d_t:file test_g_t filename2; -type_transition test_h_t test_h_t:dir test_e_t; -type_transition test_h_t test_h_t:dir test_f_t filename1; -type_transition test_h_t test_h_t:dir test_g_t filename2; -type_transition test_h_t test_h_t:file test_e_t; -type_transition test_h_t test_h_t:file test_f_t filename1; -type_transition test_h_t test_h_t:file test_g_t filename2; diff --git a/libsepol/self-keyword-in-type-rules/runtest.sh b/libsepol/self-keyword-in-type-rules/runtest.sh deleted file mode 100755 index 982a2e9..0000000 --- a/libsepol/self-keyword-in-type-rules/runtest.sh +++ /dev/null @@ -1,61 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -MODULES_BAD="test_self_tt_bad1 test_self_tt_bad2 test_self_tt_bad3 test_self_tt_bad4" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm "libsepol" - rlAssertRpm "checkpolicy" - rlAssertRpm "policycoreutils" - rlAssertRpm "selinux-policy" - rlPhaseEnd - - rlPhaseStartTest "Test good TE module" - rlRun "make -f /usr/share/selinux/devel/Makefile test_self_tt_good.pp" 0 \ - "Test that test_self_tt_good TE module can be built" - rlRun "semodule -i test_self_tt_good.pp" 0 \ - "Test that test_self_tt_good TE module can be installed" - rlRun "diff rules_expected.txt <(sesearch -T --type_change --type_member -rd -D 'test_[efg]_t' | sort)" 0 \ - "Test that the resulting binary policy rules match the expected ones" - rlRun "semodule -r test_self_tt_good" 0 \ - "Remove the test_self_tt_good TE module" - rlPhaseEnd - - rlPhaseStartTest "Test good CIL module" - rlRun "semodule -i test_self_tt_good.cil" 0 \ - "Test that test_self_tt_good CIL module can be installed" - rlRun "diff rules_expected.txt <(sesearch -T --type_change --type_member -rd -D 'test_[efg]_t' | sort)" 0 \ - "Test that the resulting binary policy rules match the expected ones" - rlRun "semodule -r test_self_tt_good" 0 \ - "Remove the test_self_tt_good CIL module" - rlPhaseEnd - - rlPhaseStartTest "Test bad TE modules" - for i in {1..8}; do - rlRun "make -f /usr/share/selinux/devel/Makefile test_self_tt_bad$i.pp" 0-2 \ - "Try to build test_self_tt_bad$i TE module" - rlRun "semodule -i test_self_tt_bad$i.pp" 1 \ - "Test that test_self_tt_bad$i TE module cannot be installed" - rlRun "semodule -r test_self_tt_bad$i" 1 \ - "Try to remove the test_self_tt_bad$i TE module" - done - rlPhaseEnd - - rlPhaseStartTest "Test bad CIL modules" - for i in {1..8}; do - rlRun "semodule -i test_self_tt_bad$i.cil" 1 \ - "Test that test_self_tt_bad$i CIL module cannot be installed" - rlRun "semodule -r test_self_tt_bad$i" 1 \ - "Try to remove the test_self_tt_bad$i CIL module" - done - rlPhaseEnd - - rlJournalPrintText -rlJournalEnd diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil deleted file mode 100644 index a686a2b..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil +++ /dev/null @@ -1,6 +0,0 @@ -(type test_a_t) -(type test_b_t) -(type test_c_t) - -(typetransition test_a_t self file test_b_t) -(typetransition test_a_t self file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te deleted file mode 100644 index a788670..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te +++ /dev/null @@ -1,8 +0,0 @@ -policy_module(test_self_tt_bad1,1.0) - -type test_a_t; -type test_b_t; -type test_c_t; - -type_transition test_a_t self:file test_b_t; -type_transition test_a_t self:file test_c_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil deleted file mode 100644 index a1815b1..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil +++ /dev/null @@ -1,6 +0,0 @@ -(type test_a_t) -(type test_b_t) -(type test_c_t) - -(typetransition test_a_t self file test_b_t) -(typetransition test_a_t test_a_t file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te deleted file mode 100644 index 592880a..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te +++ /dev/null @@ -1,8 +0,0 @@ -policy_module(test_self_tt_bad2,1.0) - -type test_a_t; -type test_b_t; -type test_c_t; - -type_transition test_a_t self:file test_b_t; -type_transition test_a_t test_a_t:file test_c_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil deleted file mode 100644 index 850305b..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil +++ /dev/null @@ -1,11 +0,0 @@ -(typeattribute test_attrib_1) - -(type test_a_t) -(type test_b_t) -(type test_c_t) -(type test_d_t) - -(typeattributeset test_attrib_1 (test_a_t test_b_t)) - -(typetransition test_attrib_1 self file test_b_t) -(typetransition test_a_t test_a_t file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te deleted file mode 100644 index 7be110a..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te +++ /dev/null @@ -1,11 +0,0 @@ -policy_module(test_self_tt_bad3,1.0) - -attribute test_attrib_1; - -type test_a_t, test_attrib_1; -type test_b_t, test_attrib_1; -type test_c_t; -type test_d_t; - -type_transition test_attrib_1 self:file test_c_t; -type_transition test_a_t test_a_t:file test_d_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil deleted file mode 100644 index 0474094..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil +++ /dev/null @@ -1,11 +0,0 @@ -(typeattribute test_attrib_1) - -(type test_a_t) -(type test_b_t) -(type test_c_t) -(type test_d_t) - -(typeattributeset test_attrib_1 (test_a_t test_b_t)) - -(typetransition test_a_t self file test_b_t) -(typetransition test_attrib_1 test_attrib_1 file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te deleted file mode 100644 index 2a2cd1e..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te +++ /dev/null @@ -1,11 +0,0 @@ -policy_module(test_self_tt_bad4,1.0) - -attribute test_attrib_1; - -type test_a_t, test_attrib_1; -type test_b_t, test_attrib_1; -type test_c_t; -type test_d_t; - -type_transition test_a_t self:file test_c_t; -type_transition test_attrib_1 test_attrib_1:file test_d_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil deleted file mode 100644 index 6bd03d0..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil +++ /dev/null @@ -1,6 +0,0 @@ -(type test_a_t) -(type test_b_t) -(type test_c_t) - -(typetransition test_a_t self file "filename" test_b_t) -(typetransition test_a_t self file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te deleted file mode 100644 index 53391c7..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te +++ /dev/null @@ -1,8 +0,0 @@ -policy_module(test_self_tt_bad1,1.0) - -type test_a_t; -type test_b_t; -type test_c_t; - -type_transition test_a_t self:file test_b_t "filename"; -type_transition test_a_t self:file test_c_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil deleted file mode 100644 index c7c9a12..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil +++ /dev/null @@ -1,6 +0,0 @@ -(type test_a_t) -(type test_b_t) -(type test_c_t) - -(typetransition test_a_t self file "filename" test_b_t) -(typetransition test_a_t test_a_t file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te deleted file mode 100644 index e2c273d..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te +++ /dev/null @@ -1,8 +0,0 @@ -policy_module(test_self_tt_bad6,1.0) - -type test_a_t; -type test_b_t; -type test_c_t; - -type_transition test_a_t self:file test_b_t "filename"; -type_transition test_a_t test_a_t:file test_c_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil deleted file mode 100644 index e84100f..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil +++ /dev/null @@ -1,11 +0,0 @@ -(typeattribute test_attrib_1) - -(type test_a_t) -(type test_b_t) -(type test_c_t) -(type test_d_t) - -(typeattributeset test_attrib_1 (test_a_t test_b_t)) - -(typetransition test_attrib_1 self file "filename" test_b_t) -(typetransition test_a_t test_a_t file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te deleted file mode 100644 index 7b2f74e..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te +++ /dev/null @@ -1,11 +0,0 @@ -policy_module(test_self_tt_bad7,1.0) - -attribute test_attrib_1; - -type test_a_t, test_attrib_1; -type test_b_t, test_attrib_1; -type test_c_t; -type test_d_t; - -type_transition test_attrib_1 self:file test_c_t "filename"; -type_transition test_a_t test_a_t:file test_d_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil deleted file mode 100644 index b90d5a3..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil +++ /dev/null @@ -1,11 +0,0 @@ -(typeattribute test_attrib_1) - -(type test_a_t) -(type test_b_t) -(type test_c_t) -(type test_d_t) - -(typeattributeset test_attrib_1 (test_a_t test_b_t)) - -(typetransition test_a_t self file "filename" test_b_t) -(typetransition test_attrib_1 test_attrib_1 file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te deleted file mode 100644 index c649ec1..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te +++ /dev/null @@ -1,11 +0,0 @@ -policy_module(test_self_tt_bad8,1.0) - -attribute test_attrib_1; - -type test_a_t, test_attrib_1; -type test_b_t, test_attrib_1; -type test_c_t; -type test_d_t; - -type_transition test_a_t self:file test_c_t "filename"; -type_transition test_attrib_1 test_attrib_1:file test_d_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil deleted file mode 100644 index 48dc17c..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil +++ /dev/null @@ -1,56 +0,0 @@ -(typeattribute test_attrib_1) - -(type test_a_t) -(type test_b_t) -(type test_c_t) -(type test_d_t) -(type test_e_t) -(type test_f_t) -(type test_g_t) -(type test_h_t) - -(typeattributeset test_attrib_1 (test_a_t test_b_t test_c_t)) - -(classmap file_dir (set_1)) -(classmapping file_dir set_1 (file (all))) -(classmapping file_dir set_1 (dir (all))) - -(typetransition test_d_t self file_dir test_e_t) -(typetransition test_d_t self file_dir "filename1" test_f_t) -(typetransition test_d_t self file_dir "filename2" test_g_t) - -; duplicate equivalent rules should be allowed -(typetransition test_d_t test_d_t file_dir test_e_t) -(typetransition test_d_t test_d_t file_dir "filename1" test_f_t) -(typetransition test_d_t test_d_t file_dir "filename2" test_g_t) - -(typetransition test_attrib_1 self file_dir test_e_t) -(typetransition test_attrib_1 self file_dir "filename1" test_f_t) -(typetransition test_attrib_1 self file_dir "filename2" test_g_t) - -; CIL doesn't support inline type sets, so just add these rules -; to match the TE version -(typetransition test_h_t test_d_t file_dir test_e_t) -(typetransition test_h_t test_attrib_1 file_dir test_e_t) -(typetransition test_h_t self file_dir test_e_t) -(typetransition test_h_t test_d_t file_dir "filename1" test_f_t) -(typetransition test_h_t test_attrib_1 file_dir "filename1" test_f_t) -(typetransition test_h_t self file_dir "filename1" test_f_t) -(typetransition test_h_t test_d_t file_dir "filename2" test_g_t) -(typetransition test_h_t test_attrib_1 file_dir "filename2" test_g_t) -(typetransition test_h_t self file_dir "filename2" test_g_t) - -; test typechange and typemember as well -(typechange test_d_t self file_dir test_e_t) -(typechange test_d_t test_d_t file_dir test_e_t) -(typechange test_attrib_1 self file_dir test_e_t) -(typechange test_h_t test_d_t file_dir test_e_t) -(typechange test_h_t test_attrib_1 file_dir test_e_t) -(typechange test_h_t self file_dir test_e_t) - -(typemember test_d_t self file_dir test_e_t) -(typemember test_d_t test_d_t file_dir test_e_t) -(typemember test_attrib_1 self file_dir test_e_t) -(typemember test_h_t test_d_t file_dir test_e_t) -(typemember test_h_t test_attrib_1 file_dir test_e_t) -(typemember test_h_t self file_dir test_e_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_good.te b/libsepol/self-keyword-in-type-rules/test_self_tt_good.te deleted file mode 100644 index 4028741..0000000 --- a/libsepol/self-keyword-in-type-rules/test_self_tt_good.te +++ /dev/null @@ -1,42 +0,0 @@ -policy_module(test_self_tt_good,1.0) - -attribute test_attrib_1; - -type test_a_t, test_attrib_1; -type test_b_t, test_attrib_1; -type test_c_t, test_attrib_1; -type test_d_t; -type test_e_t; -type test_f_t; -type test_g_t; -type test_h_t; - -type_transition test_d_t self:{ file dir } test_e_t; -type_transition test_d_t self:{ file dir } test_f_t "filename1"; -type_transition test_d_t self:{ file dir } test_g_t "filename2"; - -# duplicate equivalent rules should be allowed -type_transition test_d_t test_d_t:{ file dir } test_e_t; -# ...but not for _filename_ transitions ¯\_(ツ)_/¯ -#type_transition test_d_t test_d_t:{ file dir } test_f_t "filename1"; -#type_transition test_d_t test_d_t:{ file dir } test_g_t "filename2"; - -type_transition test_attrib_1 self:{ file dir } test_e_t; -type_transition test_attrib_1 self:{ file dir } test_f_t "filename1"; -type_transition test_attrib_1 self:{ file dir } test_g_t "filename2"; - -# check this fancy syntax as well -type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t; -type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_f_t "filename1"; -type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_g_t "filename2"; - -# test type_change and type_member as well -type_change test_d_t self:{ file dir } test_e_t; -type_change test_d_t test_d_t:{ file dir } test_e_t; -type_change test_attrib_1 self:{ file dir } test_e_t; -type_change test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t; - -type_member test_d_t self:{ file dir } test_e_t; -type_member test_d_t test_d_t:{ file dir } test_e_t; -type_member test_attrib_1 self:{ file dir } test_e_t; -type_member test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t; diff --git a/libsepol/sepol_check_context/main.fmf b/libsepol/sepol_check_context/main.fmf index f0e3b5e..3410cea 100644 --- a/libsepol/sepol_check_context/main.fmf +++ b/libsepol/sepol_check_context/main.fmf @@ -1,30 +1,2 @@ -summary: Does sepol_check_context() work as expected? -description: |+ - Does sepol_check_context() work as expected? - -contact: Milos Malik -component: - - libsepol -recommend: - - libsepol - - libsepol-devel - - gcc - - policycoreutils - - selinux-policy-devel -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - f32friendly - - f33friendly - - targeted - - avoidImageMode +path: /libsepol/sepol_check_context tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0554157 -extra-summary: /CoreOS/libsepol/Sanity/sepol_check_context -extra-task: /CoreOS/libsepol/Sanity/sepol_check_context diff --git a/libsepol/sepol_check_context/runtest.sh b/libsepol/sepol_check_context/runtest.sh old mode 100755 new mode 100644 index 66519cd..6742dd9 --- a/libsepol/sepol_check_context/runtest.sh +++ b/libsepol/sepol_check_context/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libsepol" diff --git a/libsepol/user-declaration-in-module/Makefile b/libsepol/user-declaration-in-module/Makefile deleted file mode 100644 index a649d44..0000000 --- a/libsepol/user-declaration-in-module/Makefile +++ /dev/null @@ -1,64 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/libsepol/Sanity/user-declaration-in-module -# Description: Can libsepol handle users declared in modules? -# Author: Petr Lautrbach -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/libsepol/Sanity/user-declaration-in-module -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) test.sh foo.te Makefile - -.PHONY: all install download clean - -run: $(FILES) build - ./test.sh - -build: $(BUILT_FILES) - test -x test.sh || chmod a+x test.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Petr Lautrbach " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Can libsepol handle users declared in modules?" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: libsepol" >> $(METADATA) - @echo "Requires: libsepol-devel selinux-policy-devel" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Bug: 2136212" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/libsepol/user-declaration-in-module/foo.te b/libsepol/user-declaration-in-module/foo.te deleted file mode 100644 index 74ee9c9..0000000 --- a/libsepol/user-declaration-in-module/foo.te +++ /dev/null @@ -1,8 +0,0 @@ -module foo 0.0.1; -require { - role staff_r; - sensitivity s0; - category c0; - category c1023; -} -user foo_u roles staff_r level s0 range s0 - s0:c0.c1023; diff --git a/libsepol/user-declaration-in-module/main.fmf b/libsepol/user-declaration-in-module/main.fmf deleted file mode 100644 index 265e20f..0000000 --- a/libsepol/user-declaration-in-module/main.fmf +++ /dev/null @@ -1,13 +0,0 @@ -summary: Can libsepol handle users declared in modules? -test: ./test.sh -framework: beakerlib -component: - - libsepol -require: - - libsepol-devel - - selinux-policy-devel -tier: 1 -enabled: true -link: - - https://bugzilla.redhat.com/show_bug.cgi?id=2136212 -extra-nitrate: TC#0614379 diff --git a/libsepol/user-declaration-in-module/test.sh b/libsepol/user-declaration-in-module/test.sh deleted file mode 100755 index 90ab796..0000000 --- a/libsepol/user-declaration-in-module/test.sh +++ /dev/null @@ -1,29 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Petr Lautrbach - -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" - rlRun "cp foo.te $tmp" - rlRun "pushd $tmp" - rlRun "set -o pipefail" - rlAssertRpm "libsepol" - rlAssertRpm "selinux-policy-devel" - rlPhaseEnd - - rlPhaseStartTest - rlRun "make -f /usr/share/selinux/devel/Makefile foo.pp" 0 "Build a module with user declaration" - rlRun "semodule -i foo.pp" 0 - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "semodule -r foo" 0 - rlRun "popd" - rlRun "rm -r $tmp" 0 "Remove tmp directory" - rlPhaseEnd -rlJournalEnd diff --git a/main.fmf b/main.fmf index 0af284f..1be570e 100644 --- a/main.fmf +++ b/main.fmf @@ -6,6 +6,8 @@ framework: beakerlib #contact: Petr Lautrbach #requires: [policycoreutils, libselinux-utils] +tags: [generic] + /checkpolicy: component: checkpolicy @@ -21,18 +23,11 @@ framework: beakerlib /libsepol: component: libsepol -/mcstrans: - component: mcstrans - /policycoreutils: component: policycoreutils /selinux-policy: component: selinux-policy -/setools: - component: setools - -adjust+: - - duration+: '*15' - when: rhivos_preload is defined and rhivos_preload == true +/other: + component: selinux-policy diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile b/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile deleted file mode 100644 index ae8a25f..0000000 --- a/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile +++ /dev/null @@ -1,76 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context -# Description: setfscreatecon with invalid context can mistakenly succeed -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: setfscreatecon with invalid context can mistakenly succeed" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: mcstrans" >> $(METADATA) - @echo "Requires: mcstrans" >> $(METADATA) - @echo "Requires: /usr/sbin/service" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: mktemp" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 442327" >> $(METADATA) # Fedora 9 - - rhts-lint $(METADATA) - diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE b/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE deleted file mode 100644 index 4ecdd5e..0000000 --- a/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context -Author: Milos Malik - -Description: setfscreatecon with invalid context can mistakenly succeed - diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf deleted file mode 100644 index fc979e6..0000000 --- a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf +++ /dev/null @@ -1,45 +0,0 @@ -summary: setfscreatecon with invalid context can mistakenly succeed -description: |+ - Description: setfscreatecon with invalid context can mistakenly succeed - -contact: Milos Malik -component: - - mcstrans -test: ./runtest.sh -framework: beakerlib -recommend: - - mcstrans - - /usr/sbin/service - - selinux-policy - - selinux-policy-targeted - - libselinux - - libselinux-utils - - mktemp - - grep - - audit - - policycoreutils -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail -duration: 5m -enabled: true -tag: - - NoRHEL4 - - TIPpass_Security - - f31friendly - - f32friendly - - failinrhel8ci - - targeted -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=442327 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=800470 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0062266 -extra-summary: /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context -extra-task: /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh b/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh deleted file mode 100755 index 6a9cbc3..0000000 --- a/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh +++ /dev/null @@ -1,85 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context -# Description: setfscreatecon with invalid context can mistakenly succeed -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="mcstrans" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm selinux-policy - rlAssertRpm libselinux - OUTPUT_FILE=`mktemp` - if rlIsRHEL 5 6 ; then - rlServiceStop mcstrans - else - rlServiceStop mcstransd - fi - - rlRun "setenforce 1" - rlRun "sestatus" - START_DATE_TIME=`date "+%m/%d/%Y %T"` - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#442327" - if rlIsRHEL 5 6 ; then - rlRun "service mcstrans start" - else - rlRun "service mcstransd start" - fi - sleep 1 - rlRun "for I in \`seq 1 1 5000\` ; do mkdir d --context=xyz 2>/dev/null && { t=X ; rmdir d ; } || t=. ; printf \$t ; done >& ${OUTPUT_FILE}" - rlRun "grep -ci x ${OUTPUT_FILE}" 1 - sleep 1 - if rlIsRHEL 5 6 ; then - rlRun "service mcstrans stop" - else - rlRun "service mcstransd stop" - fi - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlRun "ausearch -m AVC -m USER_AVC -ts ${START_DATE_TIME} > ${OUTPUT_FILE}" 0,1 - LINE_COUNT=`grep 'type=AVC' ${OUTPUT_FILE} | grep -v 'type=AVC.*denied.*mac_admin.*mkdir' | wc -l` - rlAssert0 "number of unexpected AVCs in ${OUTPUT_FILE} should be 0" ${LINE_COUNT} - - if rlIsRHEL 5 6 ; then - rlServiceRestore mcstrans - else - rlServiceRestore mcstransd - fi - - rm -f ${OUTPUT_FILE} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/mcstrans/internal-examples-testsuite/Makefile b/mcstrans/internal-examples-testsuite/Makefile deleted file mode 100644 index b6fc4e1..0000000 --- a/mcstrans/internal-examples-testsuite/Makefile +++ /dev/null @@ -1,65 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/mcstrans/Sanity/internal-examples-testsuite -# Description: Wrapper for internal examples used as testsuite -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/mcstrans/Sanity/internal-examples-testsuite -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Wrapper for internal examples used as testsuite" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: mcstrans" >> $(METADATA) - @echo "Requires: mcstrans selinux-policy-targeted libselinux-python sed platform-python-devel python3-libselinux /usr/sbin/service" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) - @echo "Bug: 1656304" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/mcstrans/internal-examples-testsuite/PURPOSE b/mcstrans/internal-examples-testsuite/PURPOSE deleted file mode 100644 index 85fecad..0000000 --- a/mcstrans/internal-examples-testsuite/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/mcstrans/Sanity/internal-examples-testsuite -Author: Milos Malik - -Internal examples and scripts are used as mcstrans testsuite. - diff --git a/mcstrans/internal-examples-testsuite/main.fmf b/mcstrans/internal-examples-testsuite/main.fmf deleted file mode 100644 index ec20c6b..0000000 --- a/mcstrans/internal-examples-testsuite/main.fmf +++ /dev/null @@ -1,38 +0,0 @@ -summary: Wrapper for internal examples used as testsuite -description: |+ - Internal examples and scripts are used as mcstrans testsuite. - -contact: Milos Malik -component: - - mcstrans -test: ./runtest.sh -framework: beakerlib -recommend: - - mcstrans - - selinux-policy-targeted - - libselinux-python - - sed - - platform-python-devel - - python3-libselinux - - /usr/sbin/service -duration: 10m -enabled: true -tier: 1 -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - f32friendly - - f33friendly - - targeted - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1656304 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0520362 -extra-summary: /CoreOS/mcstrans/Sanity/internal-examples-testsuite -extra-task: /CoreOS/mcstrans/Sanity/internal-examples-testsuite diff --git a/mcstrans/internal-examples-testsuite/runtest.sh b/mcstrans/internal-examples-testsuite/runtest.sh deleted file mode 100755 index 01ae3e3..0000000 --- a/mcstrans/internal-examples-testsuite/runtest.sh +++ /dev/null @@ -1,181 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/mcstrans/Sanity/internal-examples-testsuite -# Description: Wrapper for internal examples used as testsuite -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="mcstrans" -if rlIsRHEL 5 6 ; then - SERVICE_NAME="mcstrans" -else - SERVICE_NAME="mcstransd" -fi - -if rlIsRHEL 5 6 7 ; then - PYTHON="python2" - SERVICE_START_LIMIT="[Service] -StartLimitIntervalSec=0 -StartLimitBurst=50 -" -else - PYTHON="python3" - SERVICE_START_LIMIT="[Unit] -StartLimitIntervalSec=0 -" -fi - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm selinux-policy-targeted - rlRun "mkdir -p /etc/systemd/system/mcstrans.service.d/" - rlRun "mkdir -p /etc/systemd/system/mcstransd.service.d/" - echo "${SERVICE_START_LIMIT}" > /etc/systemd/system/mcstrans.service.d/limit.conf - rlRun "cp /etc/systemd/system/mcstrans.service.d/limit.conf /etc/systemd/system/mcstransd.service.d/limit.conf" - rlRun "systemctl daemon-reload" - rlServiceStop ${SERVICE_NAME} - rlRun "mkdir -p /etc/selinux/targeted/setrans.d" - rlFileBackup /etc/selinux/targeted/secolor.conf - rlFileBackup /etc/selinux/targeted/setrans.conf - rlFileBackup /usr/share/mcstrans/util/mlscolor-test - rlFileBackup /usr/share/mcstrans/util/mlstrans-test - rlRun "sed -i 's/^verbose.*$/verbose=1/' /usr/share/mcstrans/util/mlscolor-test" - rlRun "sed -i 's/^verbose.*$/verbose=1/' /usr/share/mcstrans/util/mlstrans-test" - if ! rlIsRHEL 5 6 7 && ! rlIsFedora ; then - # convert the python2 scripts to python3 syntax - rlRun "2to3 -w --no-diffs /usr/share/mcstrans/util/mlscolor-test" - rlRun "2to3 -w --no-diffs /usr/share/mcstrans/util/mlstrans-test" - fi - rlPhaseEnd - - rlPhaseStartTest "default" - rlRun "pushd /usr/share/mcstrans/examples/default" - rlRun "rm -f /etc/selinux/targeted/secolor.conf" - rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" - rlRun "service ${SERVICE_NAME} restart" - sleep 1 - rlRun "service ${SERVICE_NAME} status" - rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test default.test" - rlRun "popd" - rlPhaseEnd - - rlPhaseStartTest "include" - rlRun "pushd /usr/share/mcstrans/examples/include" - rlRun "rm -f /etc/selinux/targeted/secolor.conf" - rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" - rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" - rlRun "cp -f setrans.d/* /etc/selinux/targeted/setrans.d" - rlRun "service ${SERVICE_NAME} restart" - sleep 1 - rlRun "service ${SERVICE_NAME} status" - rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test default.test" - rlRun "popd" - rlPhaseEnd - - rlPhaseStartTest "non-mls-color" - rlRun "pushd /usr/share/mcstrans/examples/non-mls-color" - rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf" - rlRun "rm -f /etc/selinux/targeted/setrans.conf" - rlRun "touch /etc/selinux/targeted/setrans.conf" - rlRun "service ${SERVICE_NAME} restart" - sleep 1 - rlRun "service ${SERVICE_NAME} status" - rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test non-mls.color" - rlRun "popd" - rlPhaseEnd - - rlPhaseStartTest "urcsts" - rlRun "pushd /usr/share/mcstrans/examples/urcsts" - rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf" - rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" - rlRun "service ${SERVICE_NAME} restart" - sleep 1 - rlRun "service ${SERVICE_NAME} status" - #rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test urcsts.color" - rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test urcsts.test" - rlRun "popd" - rlPhaseEnd - - rlPhaseStartTest "urcsts-via-include" - rlRun "pushd /usr/share/mcstrans/examples/urcsts-via-include" - rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf" - rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" - rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" - rlRun "rm -f /etc/selinux/targeted/setrans.d/*" - rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d" - rlRun "service ${SERVICE_NAME} restart" - sleep 1 - rlRun "service ${SERVICE_NAME} status" - #rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test urcsts.color" - rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test urcsts.test" - rlRun "popd" - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "nato" - rlRun "pushd /usr/share/mcstrans/examples/nato" - rlRun "rm -f /etc/selinux/targeted/secolor.conf" - rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" - rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" - rlRun "rm -f /etc/selinux/targeted/setrans.d/*" - rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d" - rlRun "service ${SERVICE_NAME} restart" - sleep 1 - rlRun "service ${SERVICE_NAME} status" - ${PYTHON} /usr/share/mcstrans/util/mlstrans-test nato.test - rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test nato.test" - rlRun "popd" - rlPhaseEnd - - rlPhaseStartTest "pipes" - rlRun "pushd /usr/share/mcstrans/examples/pipes" - rlRun "rm -f /etc/selinux/targeted/secolor.conf" - rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" - rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" - rlRun "rm -f /etc/selinux/targeted/setrans.d/*" - rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d" - rlRun "service ${SERVICE_NAME} restart" - sleep 1 - rlRun "service ${SERVICE_NAME} status" - ${PYTHON} /usr/share/mcstrans/util/mlstrans-test pipes.test - rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test pipes.test" - rlRun "popd" - rlPhaseEnd - fi - - rlPhaseStartCleanup - rlRun "rm -rf /etc/systemd/system/mcstrans.service.d/" - rlRun "rm -rf /etc/systemd/system/mcstransd.service.d/" - rlRun "rm -f /etc/selinux/targeted/secolor.conf /etc/selinux/targeted/setrans.conf" - rlRun "rm -rf /etc/selinux/targeted/setrans.d" - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile deleted file mode 100644 index dc15dc2..0000000 --- a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile +++ /dev/null @@ -1,67 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C -# Description: mcstrans daemon segfaults when secon -C asks for incomplete context -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE secolor.conf - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: mcstrans daemon segfaults when secon -C asks for incomplete context" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: mcstrans" >> $(METADATA) - @echo "Requires: mcstrans selinux-policy-targeted policycoreutils libselinux-python python3-libselinux /usr/sbin/service" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) - @echo "Bug: 1315996" >> $(METADATA) # RHEL-7 - @echo "Bug: 1316680" >> $(METADATA) # RHEL-6 - @echo "Bug: 1699784" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE deleted file mode 100644 index 49f8afd..0000000 --- a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C -Author: Milos Malik - -Description: mcstrans daemon segfaults when secon -C asks for incomplete context - diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf deleted file mode 100644 index 7d3bd93..0000000 --- a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf +++ /dev/null @@ -1,38 +0,0 @@ -summary: mcstrans daemon segfaults when secon -C asks for incomplete context -description: |+ - Description: mcstrans daemon segfaults when secon -C asks for incomplete context - -contact: Milos Malik -component: - - mcstrans -test: ./runtest.sh -framework: beakerlib -recommend: - - mcstrans - - selinux-policy-targeted - - policycoreutils - - libselinux-python - - python3-libselinux - - /usr/sbin/service -duration: 10m -enabled: true -tier: 1 -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - f32friendly - - f33friendly - - targeted -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1315996 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1316680 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699784 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0520380 -extra-summary: /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C -extra-task: /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh deleted file mode 100755 index 5b089dc..0000000 --- a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh +++ /dev/null @@ -1,87 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C -# Description: mcstrans daemon segfaults when secon -C asks for incomplete context -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="mcstrans" -if rlIsRHEL 6 ; then - SERVICE_NAME="mcstrans" -else # RHEL-7 and above - SERVICE_NAME="mcstransd" -fi -if rlIsRHEL 6 7 ; then - if which python3 >& /dev/null ; then - PYTHON="python3" - else - PYTHON="python2" - fi -else # RHEL-8 - if which python3 >& /dev/null ; then - PYTHON="python3" - else - PYTHON="/usr/libexec/platform-python" - fi -fi - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm policycoreutils - rlAssertRpm selinux-policy-targeted - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/selinux/targeted/secolor.conf - rlPhaseEnd - - rlPhaseStartTest "bz#1315996 + bz#1316680 + bz#1699784" - rlRun "dmesg > before-secon-C.txt" - rlRun "cp -f secolor.conf /etc/selinux/targeted/" - for CONTEXT in ":::" "xyz_u:xyz_r:xyz_t:" "user_u:" "user_u:user_r:" "user_u:user_r:user_t:" ; do - rlRun "service ${SERVICE_NAME} restart" - sleep 1 - rlRun "service ${SERVICE_NAME} status" - set -x - echo -en "import selinux\nselinux.selinux_raw_context_to_color(\"${CONTEXT}\")\n" | ${PYTHON} - set +x - # rlRun "secon -C ${CONTEXT}" 0,1 - sleep 1 - rlRun "service ${SERVICE_NAME} status" - done - rlRun "dmesg > after-secon-C.txt" - rlRun "diff before-secon-C.txt after-secon-C.txt | grep \"mcstransd.*segfault\"" 1 - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f before-secon-C.txt after-secon-C.txt" - rlRun "rm -f /etc/selinux/targeted/secolor.conf" - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf deleted file mode 100644 index 17abaaf..0000000 --- a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf +++ /dev/null @@ -1,24 +0,0 @@ -color black = #000000 -color green = #008000 -color yellow = #ffff00 -color blue = #0000ff -color white = #ffffff -color red = #ff0000 -color orange = #ffa500 -color tan = #d2b48c - -user unconfined_u = #ff0000 green -role unconfined_r = red #ffffff -type unconfined_t = red orange -user user_u = black green -role user_r = white black -type user_t = tan red -user xguest_u = black yellow -role xguest_r = black red -type xguest_t = black green -user sysadm_u = white black -range s0:c0.c1023 = black white -user * = black white -role * = black white -type * = black white - diff --git a/other/collect-denials/main.fmf b/other/collect-denials/main.fmf deleted file mode 100644 index 6d6aa03..0000000 --- a/other/collect-denials/main.fmf +++ /dev/null @@ -1,13 +0,0 @@ -summary: collect SELinux denials which appeared since boot -contact: Milos Malik -test: ./runtest.sh -framework: beakerlib -recommend: - - audit - - /usr/sbin/service - - policycoreutils -duration: 5m -enabled: true -tag: - - failinfedora - - avoidImageMode diff --git a/other/collect-denials/runtest.sh b/other/collect-denials/runtest.sh deleted file mode 100755 index ff52732..0000000 --- a/other/collect-denials/runtest.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "sestatus" - rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" - rlPhaseEnd - - rlPhaseStartTest - rlRun "service auditd status -l" - rlRun "ausearch -m avc -m selinux_err -i -ts boot" 1 - rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400" - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalEnd - diff --git a/other/collect-denials/test.sh b/other/collect-denials/test.sh deleted file mode 100755 index f8845e4..0000000 --- a/other/collect-denials/test.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "sestatus" - rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" - rlPhaseEnd - - rlPhaseStartTest - rlRun "service auditd status -l" - rlRun "ausearch -m avc -m selinux_err -i -ts boot" - rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400" - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalEnd - diff --git a/other/mounting/Makefile b/other/mounting/Makefile index 541f560..d2bedf4 100644 --- a/other/mounting/Makefile +++ b/other/mounting/Makefile @@ -41,6 +41,7 @@ build: $(BUILT_FILES) clean: rm -f *~ $(BUILT_FILES) + include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile @@ -60,7 +61,6 @@ $(METADATA): Makefile @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) rhts-lint $(METADATA) - diff --git a/other/mounting/main.fmf b/other/mounting/main.fmf index 2ee20f9..bf52899 100644 --- a/other/mounting/main.fmf +++ b/other/mounting/main.fmf @@ -1,25 +1,9 @@ -summary: Mount various filesystems, test context options. -description: '' -contact: Milos Malik -component: - - selinux-policy -recommend: - - selinux-policy - - util-linux - - e2fsprogs - - dosfstools -enabled: true -duration: 5m -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - failinfedora - - targeted -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0571362 -extra-summary: /CoreOS/selinux-policy/Sanity/mounting -extra-task: /CoreOS/selinux-policy/Sanity/mounting +path: /other/mounting +summary: Mount various filesystems, test context options +description: | + Test the context and defcontext options of the mount command. Test + different filesystems: ext2, ext3, ext4. XFS, FAT32. Requires + e2fsprogs and dosfstools. +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/other/mounting/runtest.sh b/other/mounting/runtest.sh index 34b6815..d012460 100755 --- a/other/mounting/runtest.sh +++ b/other/mounting/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -38,7 +39,7 @@ rlJournalStart rlAssertRpm "dosfstools" # create a loopback device - rlRun "fallocate -l 400M loop_file" + rlRun "fallocate -l 100M loop_file" rlRun "losetup -f loop_file" rlRun "losetup -l | grep loop_file" DEV="$(losetup -l | tail -n 1 | cut -f1 -d' ')" diff --git a/other/swig-deprecation-warnings/main.fmf b/other/swig-deprecation-warnings/main.fmf deleted file mode 100644 index 3517e20..0000000 --- a/other/swig-deprecation-warnings/main.fmf +++ /dev/null @@ -1,32 +0,0 @@ -summary: test if python code produces deprecation messages -contact: Milos Malik -test: ./runtest.sh -framework: beakerlib -component: - - libselinux - - libsemanage - - policycoreutils - - setools -recommend: - - python3 - - python3-libselinux - - python3-libsemanage - - python3-policycoreutils - - python3-setools -duration: 5m -enabled: true -link: - - verifies: https://issues.redhat.com/browse/RHEL-118812 - - verifies: https://issues.redhat.com/browse/RHEL-138405 - - verifies: https://issues.redhat.com/browse/RHEL-138406 -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 - continue: false - diff --git a/other/swig-deprecation-warnings/runtest.sh b/other/swig-deprecation-warnings/runtest.sh deleted file mode 100755 index 16af69a..0000000 --- a/other/swig-deprecation-warnings/runtest.sh +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "sestatus" - rlRun "rpm -qa | grep -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils -e setools | sort" - rlPhaseEnd - - rlPhaseStartTest "libselinux - RHEL-118812" - rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import selinux\"" - rlRun "grep -i deprecation $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlPhaseEnd - - rlPhaseStartTest "libsemanage - RHEL-138405" - rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import semanage\"" - rlRun "grep -i deprecation $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlPhaseEnd - - rlPhaseStartTest "policycoreutils - RHEL-138406" - rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import seobject ; import sepolgen ; import sepolicy\"" - rlRun "grep -i deprecation $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlPhaseEnd - - rlPhaseStartTest "setools" - rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import setools\"" - rlRun "grep -i deprecation $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalEnd - diff --git a/other/update-packages/main.fmf b/other/update-packages/main.fmf deleted file mode 100644 index 179a2e4..0000000 --- a/other/update-packages/main.fmf +++ /dev/null @@ -1,8 +0,0 @@ -summary: update packages to the latest versions available -contact: Milos Malik -test: ./runtest.sh -framework: beakerlib -duration: 15m -enabled: true -tag: - - avoidImageMode diff --git a/other/update-packages/runtest.sh b/other/update-packages/runtest.sh deleted file mode 100755 index bcdf7d6..0000000 --- a/other/update-packages/runtest.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" - rlPhaseEnd - - rlPhaseStartTest - rlRun "dnf clean all" - rlRun "dnf -y update --nobest --allowerasing" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" - rlPhaseEnd -rlJournalEnd - diff --git a/other/update-packages/test.sh b/other/update-packages/test.sh deleted file mode 100755 index 967588e..0000000 --- a/other/update-packages/test.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" - rlPhaseEnd - - rlPhaseStartTest - rlRun "dnf clean all" - rlRun "dnf -y update --skip-broken --allowerasing" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" - rlPhaseEnd -rlJournalEnd - diff --git a/plans/ci.fmf b/plans/ci.fmf deleted file mode 100644 index 454574d..0000000 --- a/plans/ci.fmf +++ /dev/null @@ -1,9 +0,0 @@ -summary: CI test plan that runs only modified tests -discover: - how: fmf - modified-only: true - modified-url: https://src.fedoraproject.org/tests/selinux - modified-ref: reference/main -execute: - how: tmt - diff --git a/plans/failing.fmf b/plans/failing.fmf deleted file mode 100644 index 178ab77..0000000 --- a/plans/failing.fmf +++ /dev/null @@ -1,11 +0,0 @@ -summary: test plan which contains failing tests -adjust+: -- when: trigger == commit - enabled: false - because: do not run this plan on changes caused by a PR/MR -discover: - how: fmf - filter: "tag:failinfedora" -execute: - how: tmt - diff --git a/plans/gating.fmf b/plans/gating.fmf deleted file mode 100644 index a2c97ba..0000000 --- a/plans/gating.fmf +++ /dev/null @@ -1,11 +0,0 @@ -summary: Gating test plan -adjust+: -- when: trigger == commit - enabled: false - because: do not run this plan on changes caused by a PR/MR -discover: - how: fmf - filter: "tag:CI-Tier-1 & tag:-failinfedora" -execute: - how: tmt - diff --git a/plans/image-mode.fmf b/plans/image-mode.fmf deleted file mode 100644 index 2b074df..0000000 --- a/plans/image-mode.fmf +++ /dev/null @@ -1,17 +0,0 @@ -summary: general test plan for image mode -enabled: true -adjust+: -- when: trigger == build - enabled: false - because: do not run this plan on a new build -- when: trigger == commit - enabled: false - because: do not run this plan on changes caused by a PR/MR -discover: - how: fmf - filter: 'tag:-tf_broken & tag:-multihost & tag:-reboot & tag:-avoidImageMode' -prepare: -- how: install - package: https://download.copr.fedorainfracloud.org/results/mmalik/mnt-tests/epel-10-x86_64/09597416-mnt-tests/mnt-tests-1.0-1.el10.noarch.rpm -execute: - how: tmt diff --git a/plans/main.fmf b/plans/main.fmf deleted file mode 100644 index 9459ca0..0000000 --- a/plans/main.fmf +++ /dev/null @@ -1,3 +0,0 @@ -# do not inherit test-specific metadata from toplevel -/: - inherit: false diff --git a/plans/notier.fmf b/plans/notier.fmf deleted file mode 100644 index 790b033..0000000 --- a/plans/notier.fmf +++ /dev/null @@ -1,15 +0,0 @@ -summary: no tier test plan -adjust+: -- when: trigger == commit - enabled: false - because: do not run this plan on changes caused by a PR/MR -discover: - how: fmf - filter: "tag:-Tier1 & tag:-Tier2 & tag:-Tier3 & tag:-CI-Tier-1 & tag:-failinfedora" -execute: - how: tmt -provision: - hardware: - cpu: - cores: '>= 2' - diff --git a/plans/reboot.fmf b/plans/reboot.fmf deleted file mode 100644 index cb304d0..0000000 --- a/plans/reboot.fmf +++ /dev/null @@ -1,11 +0,0 @@ -summary: update, reboot and check for denials -discover: - how: fmf - url: https://src.fedoraproject.org/tests/selinux - test: - - /other/update-packages - - /selinux-policy/bz533007-unable-to-start-kdump-service - - /other/collect-denials -execute: - how: tmt - diff --git a/plans/tier1.fmf b/plans/tier1.fmf deleted file mode 100644 index bf35d2d..0000000 --- a/plans/tier1.fmf +++ /dev/null @@ -1,11 +0,0 @@ -summary: Tier1 test plan -adjust+: -- when: trigger == commit - enabled: false - because: do not run this plan on changes caused by a PR/MR -discover: - how: fmf - filter: "tier:1 & tag:-failinfedora" -execute: - how: tmt - diff --git a/plans/tier2.fmf b/plans/tier2.fmf deleted file mode 100644 index ab9f339..0000000 --- a/plans/tier2.fmf +++ /dev/null @@ -1,11 +0,0 @@ -summary: Tier2 test plan -adjust+: -- when: trigger == commit - enabled: false - because: do not run this plan on changes caused by a PR/MR -discover: - how: fmf - filter: "tier:2 & tag:-failinfedora" -execute: - how: tmt - diff --git a/plans/tier3.fmf b/plans/tier3.fmf deleted file mode 100644 index b57f030..0000000 --- a/plans/tier3.fmf +++ /dev/null @@ -1,11 +0,0 @@ -summary: Tier3 test plan -adjust+: -- when: trigger == commit - enabled: false - because: do not run this plan on changes caused by a PR/MR -discover: - how: fmf - filter: "tier:3 & tag:-failinfedora" -execute: - how: tmt - diff --git a/policycoreutils/CIL-modules-without-compilation/Makefile b/policycoreutils/CIL-modules-without-compilation/Makefile index a16e88d..2d8a660 100644 --- a/policycoreutils/CIL-modules-without-compilation/Makefile +++ b/policycoreutils/CIL-modules-without-compilation/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: /usr/sbin/semodule /usr/sbin/semanage" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/policycoreutils/CIL-modules-without-compilation/main.fmf b/policycoreutils/CIL-modules-without-compilation/main.fmf index 38386d3..02538f7 100644 --- a/policycoreutils/CIL-modules-without-compilation/main.fmf +++ b/policycoreutils/CIL-modules-without-compilation/main.fmf @@ -1,29 +1 @@ -summary: What the test does -description: |+ - Is it possible to manage policy modules written in CIL without any compilation? Does semanage and semodule understand them? - -contact: Milos Malik -component: - - policycoreutils -recommend: - - /usr/sbin/semodule - - /usr/sbin/semanage -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted -tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0535087 -extra-summary: /CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation -extra-task: /CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation +path: /policycoreutils/CIL-modules-without-compilation diff --git a/policycoreutils/CIL-modules-without-compilation/runtest.sh b/policycoreutils/CIL-modules-without-compilation/runtest.sh index f47e67f..451461a 100755 --- a/policycoreutils/CIL-modules-without-compilation/runtest.sh +++ b/policycoreutils/CIL-modules-without-compilation/runtest.sh @@ -27,21 +27,18 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" -PACKAGE_VERSION=`rpm -q --queryformat '%{version}' ${PACKAGE}` rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE rlRun "echo '()' > empty.cil" - rlRun "echo '( auditallow init_t security_t ( security ( setsecparam )))' > valid.cil" rlRun "echo '(())' > invalid.cil" rlPhaseEnd - # version 3.3 of SELinux user-space does not accept empty CIL module - if rlTestVersion "${PACKAGE_VERSION}" "<" "3.3" ; then rlPhaseStartTest "empty CIL module" rlRun "semodule -lfull | grep '400.*empty.*cil'" 1 rlRun "semodule -i empty.cil" @@ -54,20 +51,6 @@ rlJournalStart rlRun "semanage module -r empty" rlRun "semanage module -l | grep 'empty.*400.*cil'" 1 rlPhaseEnd - fi - - rlPhaseStartTest "valid CIL module" - rlRun "semodule -lfull | grep '400.*valid.*cil'" 1 - rlRun "semodule -i valid.cil" - rlRun "semodule -lfull | grep '400.*valid.*cil'" - rlRun "semodule -r valid" - rlRun "semodule -lfull | grep '400.*valid.*cil'" 1 - rlRun "semanage module -l | grep 'valid.*400.*cil'" 1 - rlRun "semanage module -a valid.cil" - rlRun "semanage module -l | grep 'valid.*400.*cil'" - rlRun "semanage module -r valid" - rlRun "semanage module -l | grep 'valid.*400.*cil'" 1 - rlPhaseEnd rlPhaseStartTest "invalid CIL module" rlRun "semodule -lfull | grep '400.*invalid.*cil'" 1 @@ -83,7 +66,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartCleanup - rlRun "rm -f empty.cil valid.cil invalid.cil" + rlRun "rm -f empty.cil invalid.cil" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/policycoreutils/booleans/main.fmf b/policycoreutils/booleans/main.fmf index 9b3f7d4..2b7a3ac 100644 --- a/policycoreutils/booleans/main.fmf +++ b/policycoreutils/booleans/main.fmf @@ -1,26 +1,9 @@ -summary: Basic operations with booleans -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted +path: /policycoreutils/booleans +summary: Test basic operations with booleans +description: | + The test defines its own booleans and tests setting it on and off + using setsebool and semanage boolean. tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0571350 -extra-summary: /CoreOS/policycoreutils/Sanity/booleans -extra-task: /CoreOS/policycoreutils/Sanity/booleans +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/policycoreutils/booleans/runtest.sh b/policycoreutils/booleans/runtest.sh index ab3760e..925d3d9 100755 --- a/policycoreutils/booleans/runtest.sh +++ b/policycoreutils/booleans/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/file-contexts/Makefile b/policycoreutils/file-contexts/Makefile index 37dce15..fde8428 100644 --- a/policycoreutils/file-contexts/Makefile +++ b/policycoreutils/file-contexts/Makefile @@ -60,6 +60,5 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) - @echo "Bug: 1822100" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/policycoreutils/file-contexts/main.fmf b/policycoreutils/file-contexts/main.fmf index 7f3dfa1..4c27a2c 100644 --- a/policycoreutils/file-contexts/main.fmf +++ b/policycoreutils/file-contexts/main.fmf @@ -1,29 +1,8 @@ +path: /policycoreutils/file-contexts summary: Test semanage fcontext, restorecon, fixfiles, chcon -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - policycoreutils-python-utils -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1822100 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0576069 -extra-summary: /CoreOS/policycoreutils/Sanity/file-contexts -extra-task: /CoreOS/policycoreutils/Sanity/file-contexts +description: | + The test adds custom file contexts, runs restorecon and checks file + contexts. The chcon command is also tested. +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/policycoreutils/file-contexts/runtest.sh b/policycoreutils/file-contexts/runtest.sh index b736e5a..d421ec8 100755 --- a/policycoreutils/file-contexts/runtest.sh +++ b/policycoreutils/file-contexts/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -54,11 +55,7 @@ rlJournalStart rlAssertGrep "/run/\.\* *all files *$RUN_CON" stdout rlAssertGrep "/run *directory *$RUN_CON" stdout rlAssertGrep "/home/\[\^/\]+/bin(/\.\*)? *all files *$HOME_BIN_CON" stdout - if rlIsFedora '>= 40' || rlIsCentOS '>= 10' || rlIsRHEL '>= 10' ; then - rlAssertGrep "/var/run = /run" stdout - else - rlAssertGrep "/run = /var/run" stdout - fi + rlAssertGrep "/run = /var/run" stdout rlPhaseEnd rlPhaseStartTest "semanage fcontext add and delete" @@ -208,15 +205,6 @@ rlJournalStart rlRun "rm -rf /tmp/test" rlPhaseEnd - rlPhaseStartTest "semanage loses sys.stderr bz#1822100" - rlRun "semanage fcontext -l | egrep -s -q -e '^/home'" 0 - # Capture Broken pipe error - rlRun "semanage fcontext -l 2> /tmp/output_file | egrep -s -q -e '^/home'" - rlAssertGrep "Broken pipe" /tmp/output_file - rlAssertNotGrep "lost sys.stderr" /tmp/output_file - rlRun "rm -f /tmp/output_file" - rlPhaseEnd - rlPhaseStartCleanup rlRun "rm -rf stdout" rlPhaseEnd diff --git a/policycoreutils/fixfiles-F-B-N/main.fmf b/policycoreutils/fixfiles-F-B-N/main.fmf index ace6639..70e58e3 100644 --- a/policycoreutils/fixfiles-F-B-N/main.fmf +++ b/policycoreutils/fixfiles-F-B-N/main.fmf @@ -1,10 +1,7 @@ -summary: Tests fixfiles -F | -B | -N options -description: '' -contact: Petr Lautrbach -component: - - policycoreutils -extra-summary: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N -extra-task: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N -id: d70961fa-6c8b-442d-9706-c8ef47969685 -tag: - - avoidImageMode +path: /policycoreutils/fixfiles-F-B-N +summary: Test fixfiles [-F] [-B] onboot +description: | + Run fixfiles with -F and -B options and check /.autorelabel +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/policycoreutils/fixfiles-F-B-N/runtest.sh b/policycoreutils/fixfiles-F-B-N/runtest.sh index 34eb5fc..ab401df 100755 --- a/policycoreutils/fixfiles-F-B-N/runtest.sh +++ b/policycoreutils/fixfiles-F-B-N/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/linux-system-roles.selinux-tests/Makefile b/policycoreutils/linux-system-roles.selinux-tests/Makefile index 15c1ff0..eed0222 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/Makefile +++ b/policycoreutils/linux-system-roles.selinux-tests/Makefile @@ -50,7 +50,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 40m" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) @echo "Requires: policycoreutils ansible git" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/policycoreutils/linux-system-roles.selinux-tests/main.fmf b/policycoreutils/linux-system-roles.selinux-tests/main.fmf index 6498f6d..df9c7a2 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/main.fmf +++ b/policycoreutils/linux-system-roles.selinux-tests/main.fmf @@ -1,18 +1,2 @@ -summary: Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) - Ansible role tests -description: | - Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests -contact: Petr Lautrbach -component: - - policycoreutils -recommend: - - policycoreutils - - ansible - - git -duration: 40m -tag: - - NoRHIVOS - - avoidImageMode -extra-summary: linux-system-roles.selinux-tests -extra-task: linux-system-roles.selinux-tests -id: 4889350b-d9fa-4cbf-86ff-f16a1c729f9e +path: /policycoreutils/linux-system-roles.selinux-tests +tags: [fedora] diff --git a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh index 83fc6cc..5332b8e 100755 --- a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh +++ b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh @@ -25,6 +25,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -33,14 +34,8 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE rlAssertRpm "git" - if ! rpm -q ansible; then - rlLog "There's no ansible rpm, trying: pip3 install ansible" - rlRun "dnf -y install python3-pip" - rlRun "pip3 install ansible" - rlRun "ansible-playbook --version" 0 - else - rlAssertRpm "ansible" - fi + rlAssertRpm "ansible" + rlPhaseEnd rlPhaseStartTest @@ -51,7 +46,7 @@ rlJournalStart if [ $ansible_test = "tests_all_transitions.yml" ]; then continue fi - rlRun "ansible-playbook --skip-tags tests::bootc-e2e -i localhost, -c local -v $ansible_test" + rlRun "ansible-playbook -i localhost, -c local -v $ansible_test" done rlPhaseEnd diff --git a/policycoreutils/load_policy/main.fmf b/policycoreutils/load_policy/main.fmf index aae0df7..e375cb8 100644 --- a/policycoreutils/load_policy/main.fmf +++ b/policycoreutils/load_policy/main.fmf @@ -1,37 +1 @@ -summary: Does load_policy work as expected? Does it produce correct audit messages? -description: |+ - Does load_policy work as expected? Does it produce correct audit messages? - -contact: Milos Malik -component: - - policycoreutils -recommend: - - audit - - policycoreutils - - selinux-policy-targeted - - initscripts -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - TIPpass - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - failinrhel8ci - - targeted - - avoidImageMode -tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false - - when: distro >= rhel-10 - recommend+: - - audit-rules - because: since RHEL 10 package audit was split and early packages have wrong dependency -extra-nitrate: TC#0542457 -extra-summary: /CoreOS/policycoreutils/Sanity/load_policy -extra-task: /CoreOS/policycoreutils/Sanity/load_policy +path: /policycoreutils/load_policy diff --git a/policycoreutils/load_policy/runtest.sh b/policycoreutils/load_policy/runtest.sh index c7809c3..2698d94 100755 --- a/policycoreutils/load_policy/runtest.sh +++ b/policycoreutils/load_policy/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -63,13 +64,13 @@ rlJournalStart rlRun "grep -i selinux /proc/mounts" sleep 1 if rlIsRHEL ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep load_policy" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep load_policy" fi if rlIsRHEL 5 6 7 ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'policy loaded'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'policy loaded'" else # we assume that audit message has a different format now (does not contain "policy loaded") - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'type=MAC_POLICY_LOAD'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'type=MAC_POLICY_LOAD'" fi rlRun "umount --lazy ${SELINUX_FS_MOUNT}" 0,32 if [ $? -eq 0 ] ; then @@ -80,13 +81,13 @@ rlJournalStart rlRun "grep -i selinux /proc/mounts" sleep 1 if rlIsRHEL ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep load_policy" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep load_policy" fi if rlIsRHEL 5 6 7 ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'policy loaded'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'policy loaded'" else # we assume that audit message has a different format now (does not contain "policy loaded") - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'type=MAC_POLICY_LOAD'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'type=MAC_POLICY_LOAD'" fi fi rlRun "dmesg | grep -i selinux" diff --git a/policycoreutils/modules/main.fmf b/policycoreutils/modules/main.fmf index cde2ca0..dc4e4a5 100644 --- a/policycoreutils/modules/main.fmf +++ b/policycoreutils/modules/main.fmf @@ -1,27 +1,12 @@ -summary: Test module compiling and loading -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - selinux-policy-devel +path: /policycoreutils/modules +summary: test basic module functionality +description: | + The test compiles a TE module, loads it via semodule, and checks + that the rules are enforced. The same is done with a CIL module. + Module overriding using priorities and module disabling is also + tested. This test requires policycoreutils and selinux-policy-devel + packages. duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly -tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0571503 -extra-summary: /CoreOS/policycoreutils/Sanity/modules -extra-task: /CoreOS/policycoreutils/Sanity/modules +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/policycoreutils/modules/runtest.sh b/policycoreutils/modules/runtest.sh index 408d04c..280c831 100755 --- a/policycoreutils/modules/runtest.sh +++ b/policycoreutils/modules/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/org-selinux-dbus-interfaces/Makefile b/policycoreutils/org-selinux-dbus-interfaces/Makefile index 6f00b43..92c8af6 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/Makefile +++ b/policycoreutils/org-selinux-dbus-interfaces/Makefile @@ -51,7 +51,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Do the D-bus interfaces/methods of /org/selinux/object work as expected?" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 20m" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) @echo "Requires: dbus-tools policycoreutils-dbus selinux-policy-minimum selinux-policy-mls selinux-policy-targeted" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -63,4 +63,3 @@ $(METADATA): Makefile @echo "Bug: 1754873" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) - diff --git a/policycoreutils/org-selinux-dbus-interfaces/main.fmf b/policycoreutils/org-selinux-dbus-interfaces/main.fmf index 1a6c054..8ecc4af 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/main.fmf +++ b/policycoreutils/org-selinux-dbus-interfaces/main.fmf @@ -1,34 +1,9 @@ +path: /policycoreutils/org-selinux-dbus-interfaces summary: Do the D-bus interfaces/methods of /org/selinux/object work as expected? -description: '' -contact: Milos Malik +description: | + Do the D-bus interfaces/methods of /org/selinux/object work as expected? component: - - policycoreutils -recommend: - - dbus-tools - - policycoreutils-dbus - - selinux-policy-minimum - - selinux-policy-mls - - selinux-policy-targeted -duration: 20m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPfail - - TIPfail_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1415988 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754873 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0546187 -extra-summary: /CoreOS/policycoreutils/Sanity/org-selinux-dbus-interfaces -extra-task: /CoreOS/policycoreutils/Sanity/org-selinux-dbus-interfaces +- policycoreutils +adjust: +- enabled: false + when: distro < rhel-8 diff --git a/policycoreutils/org-selinux-dbus-interfaces/runtest.sh b/policycoreutils/org-selinux-dbus-interfaces/runtest.sh index 720fe5a..458c695 100755 --- a/policycoreutils/org-selinux-dbus-interfaces/runtest.sh +++ b/policycoreutils/org-selinux-dbus-interfaces/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -90,16 +91,13 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "org.selinux.change_default_policy" - # 1 argument is missing rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy" 1 - # test existing policies - for POLICY_KIND in minimum mls targeted ; do - if rpm -q selinux-policy-${POLICY_KIND} ; then - rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:${POLICY_KIND}" - rlRun "grep SELINUXTYPE=${POLICY_KIND} /etc/selinux/config" - fi - done - # test a non-existent policy + rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:minimum" + rlRun "grep SELINUXTYPE=minimum /etc/selinux/config" + rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:mls" + rlRun "grep SELINUXTYPE=mls /etc/selinux/config" + rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:targeted" + rlRun "grep SELINUXTYPE=targeted /etc/selinux/config" rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:xyz" 1 rlPhaseEnd diff --git a/policycoreutils/python-module-precedence-issue/Makefile b/policycoreutils/python-module-precedence-issue/Makefile deleted file mode 100644 index a5c30d3..0000000 --- a/policycoreutils/python-module-precedence-issue/Makefile +++ /dev/null @@ -1,65 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Regression/python-module-precedence-issue -# Description: Tools like semanage must be hardened to avoid loading -# rogue python modules that could lead to unexpected failures. -# Author: Amith Kumar -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Regression/python-module-precedence-issue -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Amith Kumar " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Tools must be hardened to block unwanted python modules" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 1m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils /usr/sbin/semanage" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Bug: 2128976" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/policycoreutils/python-module-precedence-issue/PURPOSE b/policycoreutils/python-module-precedence-issue/PURPOSE deleted file mode 100644 index b392571..0000000 --- a/policycoreutils/python-module-precedence-issue/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Regression/python-module-precedence-issue -Description: Tools like semanage must be hardened to avoid loading rogue python modules that - could lead to unexpected failures. -Author: Amith Kumar diff --git a/policycoreutils/python-module-precedence-issue/main.fmf b/policycoreutils/python-module-precedence-issue/main.fmf deleted file mode 100644 index a84f7f9..0000000 --- a/policycoreutils/python-module-precedence-issue/main.fmf +++ /dev/null @@ -1,31 +0,0 @@ -summary: Harden tools to avoid loading of unchecked python modules. -description: Tools like semanage must be hardened to avoid loading rogue python modules that could lead to unexpected failures. -contact: Amith Kumar -component: - - policycoreutils -test: ./runtest.sh -framework: beakerlib -recommend: - - policycoreutils - - /usr/sbin/semanage -duration: 1m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - avoidImageMode -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2128976 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0614726 diff --git a/policycoreutils/python-module-precedence-issue/runtest.sh b/policycoreutils/python-module-precedence-issue/runtest.sh deleted file mode 100755 index 7e91592..0000000 --- a/policycoreutils/python-module-precedence-issue/runtest.sh +++ /dev/null @@ -1,59 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Regression/python-module-precedence-issue -# Description: Tools like semanage must be hardened to avoid loading -# rogue python modules that could lead to unexpected failures. -# Author: Amith Kumar -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "tmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $tmpDir" - rlPhaseEnd - - rlPhaseStartTest "bz2128976 Tools must be hardened to not load rogue python modules" - # Create a custom python script in /usr/sbin -cat > /usr/sbin/audit.py << EOF -import sys -print("BAD GUY!", file=sys.stderr) -sys.exit(1) -EOF - # List all boolean records - rlRun "semanage boolean -l > /dev/null" 0 - rlPhaseEnd - - rlPhaseStartCleanup - # Remove irrelevant files - rlRun "rm /usr/sbin/audit.py" - rlRun "popd" - rlRun "rm -r $tmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/policycoreutils/restorecon-ignores-missing/main.fmf b/policycoreutils/restorecon-ignores-missing/main.fmf deleted file mode 100644 index 9c00dc1..0000000 --- a/policycoreutils/restorecon-ignores-missing/main.fmf +++ /dev/null @@ -1,30 +0,0 @@ -summary: restorecon -i should ignore missing files/directories -description: Does restorecon -i work as expected? -contact: Milos Malik -component: - - libselinux - - policycoreutils -recommend: - - libselinux - - policycoreutils -duration: 5m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted -tier: 1 -link: - - verifies: https://issues.redhat.com/browse/RHEL-110181 - - verifies: https://issues.redhat.com/browse/RHEL-123884 - - verifies: https://issues.redhat.com/browse/RHEL-123885 -adjust+: - - enabled: false - when: distro < rhel-8 or distro ~< rhel-9.8 or distro ~< rhel-10.2 - continue: false - because: Fixed in RHEL-8.10, RHEL-10.2, RHEL-9 fix expected in RHEL-9.8 -extra-nitrate: TC#0619904 -id: baf5db72-ac2b-4d70-90a2-806073285d7c diff --git a/policycoreutils/restorecon-ignores-missing/runtest.sh b/policycoreutils/restorecon-ignores-missing/runtest.sh deleted file mode 100755 index f7e0049..0000000 --- a/policycoreutils/restorecon-ignores-missing/runtest.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh - -rlJournalStart - rlPhaseStartSetup - rlRun "rpm -qa | grep -e libselinux -e policycoreutils | sort" - rlRun "man restorecon | col -b | grep -i 'ignore.*exist'" - rlRun "mkdir -p tmp" - OUTPUT_FILE=`mktemp` - rlPhaseEnd - - rlPhaseStartTest "RHEL-110181 + RHEL-123884" - rlRun "pushd tmp" - rlLog "starting the creator process" - ( while true ; do - mkdir dir - mkfifo fifo - touch file - chcon -t etc_t dir fifo file - rm -rf dir fifo file - done ) & - CREATOR_PID=$! - rlRun "popd" - - rlLog "starting the restorecon process" - ( while true ; do restorecon -RFivv tmp ; done ) >& ${OUTPUT_FILE} & - RESTORECON_PID=$! - - rlRun "sleep 30s" - rlRun "kill ${CREATOR_PID}" 0,1 - rlRun "kill ${RESTORECON_PID}" 0,1 - rlRun "ls -l ${OUTPUT_FILE}" - rlRun "grep -i -e 'no such file' -e 'not set context' ${OUTPUT_FILE}" 1 - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf tmp ${OUTPUT_FILE}" - rlPhaseEnd -rlJournalEnd - diff --git a/policycoreutils/restorecon/main.fmf b/policycoreutils/restorecon/main.fmf index 9d6fcb9..90bf595 100644 --- a/policycoreutils/restorecon/main.fmf +++ b/policycoreutils/restorecon/main.fmf @@ -1,55 +1,2 @@ -summary: does restorecon work correctly ? -description: | - Does restorecon work correctly? - - - Description: does restorecon work correctly ? - - Author: Milos Malik - - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=736153 - - Description: - touch test - chcon -u staff_u -t shadow_t -l s0:c1 test - restorecon test - ls -lZ test - You should still see the user as staff_u and the level as s0:c1 but the type should be changed. - restorecon -F test - You should see the user become system_u and the level become s0 -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - grep - - e2fsprogs - - libselinux - - selinux-policy-devel - - libselinux-utils -duration: 15m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - TIPpass_Security - - f31friendly - - f32friendly - - targeted - - avoidImageMode +path: /policycoreutils/restorecon tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739587 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=767568 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=741555 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=736153 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=741371 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=740669 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0111587 -extra-summary: /CoreOS/policycoreutils/Sanity/restorecon -extra-task: /CoreOS/policycoreutils/Sanity/restorecon -id: 72bbba2d-1a9e-4009-ae20-145046b8f234 diff --git a/policycoreutils/restorecon/runtest.sh b/policycoreutils/restorecon/runtest.sh index 115b612..9ab71d7 100755 --- a/policycoreutils/restorecon/runtest.sh +++ b/policycoreutils/restorecon/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" diff --git a/policycoreutils/restorecond-service-timeouts/main.fmf b/policycoreutils/restorecond-service-timeouts/main.fmf deleted file mode 100644 index 64b970e..0000000 --- a/policycoreutils/restorecond-service-timeouts/main.fmf +++ /dev/null @@ -1,32 +0,0 @@ -summary: the restorecond service fails to start because of timeout -description: the restorecond service fails to start because of timeout -contact: Milos Malik -component: - - policycoreutils -recommend: - - e2fsprogs - - policycoreutils - - policycoreutils-restorecond -duration: 5m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted -tier: 1 -link: - - verifies: https://issues.redhat.com/browse/RHEL-142541 - - verifies: https://issues.redhat.com/browse/RHEL-165247 -adjust: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the test is not relevant there - - enabled: false - when: distro == rhel-8, centos-stream-8 - because: the bug is not yet fixed there -id: 24e8b000-43ab-4db7-8066-502cfc6ec48a - diff --git a/policycoreutils/restorecond-service-timeouts/runtest.sh b/policycoreutils/restorecond-service-timeouts/runtest.sh deleted file mode 100755 index d0e2058..0000000 --- a/policycoreutils/restorecond-service-timeouts/runtest.sh +++ /dev/null @@ -1,37 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh - -rlJournalStart - rlPhaseStartSetup - rlRun "rpm -qa | grep policycoreutils | sort" - rlServiceStop restorecond - rlRun "rm -f /run/restorecond.pid" - rlPhaseEnd - - rlPhaseStartTest "RHEL-142541 + RHEL-165247" - rlRun "grep ^Type=simple /usr/lib/systemd/system/restorecond.service" - rlRun "touch /run/restorecond.pid" - rlRun "chattr +i /run/restorecond.pid" - rlRun "systemctl start restorecond.service" - sleep 2 - rlRun -s "systemctl status restorecond.service -l" - rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1 - rm -f $rlRun_LOG - - rlRun "chattr -i /run/restorecond.pid" - rlRun "rm -f /run/restorecond.pid" - rlRun "systemctl restart restorecond.service" - sleep 2 - rlRun -s "systemctl status restorecond.service -l" - rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlAssertNotExists /run/restorecond.pid - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f /run/restorecond.pid" - rlServiceRestore restorecond - rlPhaseEnd -rlJournalEnd - diff --git a/policycoreutils/restorecond_pointer_abuse/Makefile b/policycoreutils/restorecond_pointer_abuse/Makefile index bb3ac2c..253e7f3 100644 --- a/policycoreutils/restorecond_pointer_abuse/Makefile +++ b/policycoreutils/restorecond_pointer_abuse/Makefile @@ -55,7 +55,6 @@ $(METADATA): Makefile @echo "Requires: /usr/sbin/sestatus" >> $(METADATA) @echo "Requires: /usr/bin/systemctl" >> $(METADATA) @echo "Requires: /usr/bin/journalctl" >> $(METADATA) - @echo "Requires: /usr/sbin/setenforce" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/policycoreutils/restorecond_pointer_abuse/main.fmf b/policycoreutils/restorecond_pointer_abuse/main.fmf index b4f30c1..d96f84a 100644 --- a/policycoreutils/restorecond_pointer_abuse/main.fmf +++ b/policycoreutils/restorecond_pointer_abuse/main.fmf @@ -11,17 +11,7 @@ description: | Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1626468 component: - - policycoreutils -recommend: - - git-core - - policycoreutils-restorecond - - coreutils - - systemd - - policycoreutils - - libselinux-utils -adjust+: - - enabled: false +- policycoreutils +adjust: +- enabled: false when: distro < rhel-7 -id: a900e46c-6cf9-49e1-9625-5beb609760c5 -tag: - - avoidImageMode diff --git a/policycoreutils/restorecond_pointer_abuse/runtest.sh b/policycoreutils/restorecond_pointer_abuse/runtest.sh index 57463a3..465b1f2 100755 --- a/policycoreutils/restorecond_pointer_abuse/runtest.sh +++ b/policycoreutils/restorecond_pointer_abuse/runtest.sh @@ -36,6 +36,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -44,7 +45,6 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE - rlServiceStart restorecond # backup restorecond configuration file rlRun "rlFileBackup /etc/selinux/restorecond.conf" 0 rlRun "echo '/usr/*' > /etc/selinux/restorecond.conf" 0-255 @@ -59,7 +59,7 @@ rlJournalStart for i in {1..15} do # create misslabeled files - for folder in share games tmp + for folder in share games tmp do rlRun "touch /usr/$folder/$i" rlRun "chcon -t unlabeled_t /usr/$folder/$i" @@ -80,9 +80,6 @@ rlJournalStart rlPhaseStartCleanup rlRun "rlFileRestore" 0 - rlServiceStop restorecond - rm -f ${OUTPUT_FILE} rlPhaseEnd rlJournalPrintText rlJournalEnd - diff --git a/policycoreutils/sctp_test/main.fmf b/policycoreutils/sctp_test/main.fmf index 8b2d0ea..dad2354 100644 --- a/policycoreutils/sctp_test/main.fmf +++ b/policycoreutils/sctp_test/main.fmf @@ -1,19 +1,12 @@ -summary: Test for BZ#1563742 (RFE add SCTP protocol support to semanage port) -contact: vmojzis -recommend: - - git - - libselinux-utils - - policycoreutils - - lksctp-tools - - psmisc - - /usr/sbin/semanage - - /usr/sbin/semodule -duration: 10m -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1563742 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1770238 -extra-summary: /selinux/policycoreutils/sctp_test -extra-task: /selinux/policycoreutils/sctp_test -extra-nitrate: TC#0614834 -tag: - - avoidImageMode +path: /policycoreutils/sctp_test +summary: Is SCTP supported by "semanage port"? +description: | + Simulates a use case where a user wants to confine a client-server application communicating over SCTP + Bug summary: semanage port does not support SCTP protocol + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1563742 +component: +- policycoreutils +- libsemanage +adjust: +- enabled: false + when: distro < rhel-8 diff --git a/policycoreutils/sctp_test/runtest.sh b/policycoreutils/sctp_test/runtest.sh index 39572be..ee18ced 100755 --- a/policycoreutils/sctp_test/runtest.sh +++ b/policycoreutils/sctp_test/runtest.sh @@ -29,6 +29,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/selinux-autorelabel-service/main.fmf b/policycoreutils/selinux-autorelabel-service/main.fmf index 0243f14..6b8d0eb 100644 --- a/policycoreutils/selinux-autorelabel-service/main.fmf +++ b/policycoreutils/selinux-autorelabel-service/main.fmf @@ -1,34 +1,2 @@ -summary: incorrectly set StandardInput and StandardOutput of selinux-autorelabel service -description: |+ - Description: incorrectly set StandardInput and StandardOutput of selinux-autorelabel service - - Bugzilla links: - * https://bugzilla.redhat.com/show_bug.cgi?id=1766578 - * https://bugzilla.redhat.com/show_bug.cgi?id=1778094 - -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - TIPpass - - TIPpass_Security - - f32friendly - - f33friendly - - targeted -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1766578 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1778094 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0605819 -extra-summary: /CoreOS/policycoreutils/Regression/selinux-autorelabel-service -extra-task: /CoreOS/policycoreutils/Regression/selinux-autorelabel-service +path: /policycoreutils/selinux-autorelabel-service +tier: 2 diff --git a/policycoreutils/selinux-autorelabel-service/runtest.sh b/policycoreutils/selinux-autorelabel-service/runtest.sh index 2244e2c..49fca5b 100755 --- a/policycoreutils/selinux-autorelabel-service/runtest.sh +++ b/policycoreutils/selinux-autorelabel-service/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/selinux-info/main.fmf b/policycoreutils/selinux-info/main.fmf index 1c05e99..a3a9057 100644 --- a/policycoreutils/selinux-info/main.fmf +++ b/policycoreutils/selinux-info/main.fmf @@ -1,27 +1,9 @@ -summary: Test sestatus, avcstat, getenforce and other information gathering tools -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils -duration: 1m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted -tier: 1 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0571360 -extra-summary: /CoreOS/policycoreutils/Sanity/selinux-info -extra-task: /CoreOS/policycoreutils/Sanity/selinux-info +path: /policycoreutils/selinux-info +summary: test sestatus, avcstat, getenforce +description: | + Test that output of sestatus matches information in /sys/fs/selinux. + Test that avcstat works. Test getenforce. Warning: this tests runs + setenforce. +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/policycoreutils/selinux-info/runtest.sh b/policycoreutils/selinux-info/runtest.sh index 5e71cb2..13a92e6 100755 --- a/policycoreutils/selinux-info/runtest.sh +++ b/policycoreutils/selinux-info/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/semanage-imports-port-defs/Makefile b/policycoreutils/semanage-imports-port-defs/Makefile deleted file mode 100644 index d977007..0000000 --- a/policycoreutils/semanage-imports-port-defs/Makefile +++ /dev/null @@ -1,67 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Regression/semanage-imports-port-defs -# Description: Can semanage import SELinux port definitions correctly? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Regression/semanage-imports-port-defs -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Can semanage import SELinux port definitions correctly?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils /usr/sbin/semanage" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 2063353" >> $(METADATA) # RHEL-8 - @echo "Bug: 2108174" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/policycoreutils/semanage-imports-port-defs/main.fmf b/policycoreutils/semanage-imports-port-defs/main.fmf deleted file mode 100644 index 9de2dc9..0000000 --- a/policycoreutils/semanage-imports-port-defs/main.fmf +++ /dev/null @@ -1,23 +0,0 @@ -summary: Can semanage import SELinux port definitions correctly? -description: |+ - Can semanage import SELinux port definitions correctly? - -test: ./runtest.sh -contact: Milos Malik -framework: beakerlib -component: - - policycoreutils -recommend: - - policycoreutils - - /usr/sbin/semanage -duration: 10m -enabled: true -tier: 1 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2063353 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2108174 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - because: the test is not relevant there -extra-nitrate: TC#0614161 diff --git a/policycoreutils/semanage-imports-port-defs/runtest.sh b/policycoreutils/semanage-imports-port-defs/runtest.sh deleted file mode 100755 index bdd7d52..0000000 --- a/policycoreutils/semanage-imports-port-defs/runtest.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Regression/semanage-imports-port-defs -# Description: Can semanage import SELinux port definitions correctly? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm policycoreutils - rlRun "rpm -qf /usr/sbin/semanage" - rlRun "semanage port -a -t http_cache_port_t -r s0 -p tcp 3024" - rlPhaseEnd - - rlPhaseStartTest "bz#2063353 + bz#2108174" - rlRun "semanage port -E" - rlRun "echo -e 'port -D\nport -a -t http_cache_port_t -r s0 -p tcp 3024' | semanage import" - rlRun "semanage port -E" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "semanage port -d -t http_cache_port_t -r s0 -p tcp 3024" - rlPhaseEnd -rlJournalEnd - diff --git a/policycoreutils/semanage-interface/main.fmf b/policycoreutils/semanage-interface/main.fmf index d961f08..4fd3a5e 100644 --- a/policycoreutils/semanage-interface/main.fmf +++ b/policycoreutils/semanage-interface/main.fmf @@ -1,33 +1 @@ -summary: Does semanage interface ... work correctly? -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - policycoreutils-python-utils - - grep - - selinux-policy-minimum - - selinux-policy-mls - - selinux-policy-targeted -duration: 20m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - avoidImageMode -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0092119 -extra-summary: /CoreOS/policycoreutils/Regression/semanage-interface -extra-task: /CoreOS/policycoreutils/Regression/semanage-interface +path: /policycoreutils/semanage-interface diff --git a/policycoreutils/semanage-interface/runtest.sh b/policycoreutils/semanage-interface/runtest.sh index ed99caf..ba8608b 100755 --- a/policycoreutils/semanage-interface/runtest.sh +++ b/policycoreutils/semanage-interface/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -34,7 +35,6 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} - rlRun "rpm -qa | grep selinux-policy" rlPhaseEnd rlPhaseStartTest @@ -43,9 +43,6 @@ rlJournalStart if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then continue fi - if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then - continue - fi rlRun "semanage interface -l -S ${POLICY_TYPE}" done if ! rlIsRHEL 5; then diff --git a/policycoreutils/semanage-login/main.fmf b/policycoreutils/semanage-login/main.fmf index e883371..9a2165f 100644 --- a/policycoreutils/semanage-login/main.fmf +++ b/policycoreutils/semanage-login/main.fmf @@ -1,34 +1 @@ -summary: Does semanage login ... work correctly? -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - policycoreutils-python-utils - - grep - - shadow-utils - - selinux-policy-minimum - - selinux-policy-mls - - selinux-policy-targeted -duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - avoidImageMode -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0092123 -extra-summary: /CoreOS/policycoreutils/Regression/semanage-login -extra-task: /CoreOS/policycoreutils/Regression/semanage-login +path: /policycoreutils/semanage-login diff --git a/policycoreutils/semanage-login/runtest.sh b/policycoreutils/semanage-login/runtest.sh index 0986fc5..a69d21a 100755 --- a/policycoreutils/semanage-login/runtest.sh +++ b/policycoreutils/semanage-login/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -34,7 +35,6 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} - rlRun "rpm -qa | grep selinux-policy" rlPhaseEnd rlPhaseStartTest @@ -43,9 +43,6 @@ rlJournalStart if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then continue fi - if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then - continue - fi rlRun "semanage login -l -S ${POLICY_TYPE}" done if ! rlIsRHEL 5; then diff --git a/policycoreutils/semanage-permissive-d-problems/main.fmf b/policycoreutils/semanage-permissive-d-problems/main.fmf index cea9905..50e8c68 100644 --- a/policycoreutils/semanage-permissive-d-problems/main.fmf +++ b/policycoreutils/semanage-permissive-d-problems/main.fmf @@ -1,19 +1 @@ -summary: semanage permissive -d accepts more than domain types, its behavior is not - reliable -description: |+ - Does semanage permissive work correctly? - -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - policycoreutils-python-utils - - policycoreutils-devel - - selinux-policy-devel - - grep - - coreutils -duration: 20m -extra-summary: /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems -extra-task: /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems -id: f9d05e51-8ec4-4b3c-a016-bbdf79775d64 +path: /policycoreutils/semanage-permissive-d-problems diff --git a/policycoreutils/semanage-permissive-d-problems/runtest.sh b/policycoreutils/semanage-permissive-d-problems/runtest.sh index 1d33e4c..67a5b3e 100755 --- a/policycoreutils/semanage-permissive-d-problems/runtest.sh +++ b/policycoreutils/semanage-permissive-d-problems/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" diff --git a/policycoreutils/semanage-port-add-delete-problems/Makefile b/policycoreutils/semanage-port-add-delete-problems/Makefile index 36cdf85..263da02 100644 --- a/policycoreutils/semanage-port-add-delete-problems/Makefile +++ b/policycoreutils/semanage-port-add-delete-problems/Makefile @@ -54,14 +54,13 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: coreutils" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) @echo "Requires: policycoreutils" >> $(METADATA) @echo "Requires: policycoreutils-python-utils" >> $(METADATA) @echo "Requires: setools-console" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: coreutils" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/policycoreutils/semanage-port-add-delete-problems/main.fmf b/policycoreutils/semanage-port-add-delete-problems/main.fmf index f9c20d5..f2655dc 100644 --- a/policycoreutils/semanage-port-add-delete-problems/main.fmf +++ b/policycoreutils/semanage-port-add-delete-problems/main.fmf @@ -1,22 +1 @@ -summary: semanage accepts invalid port numbers and then cannot delete them -description: |+ - semanage accepts invalid port numbers and then cannot delete them - -contact: Milos Malik -component: - - policycoreutils -recommend: - - audit - - coreutils - - grep - - libselinux - - libselinux-utils - - policycoreutils - - policycoreutils-python-utils - - setools-console -duration: 15m -extra-summary: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems -extra-task: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems -id: 3db01ce3-7cf2-4f3a-9b71-412d7cd7ce64 -tag: - - avoidImageMode +path: /policycoreutils/semanage-port-add-delete-problems diff --git a/policycoreutils/semanage-port-add-delete-problems/runtest.sh b/policycoreutils/semanage-port-add-delete-problems/runtest.sh index 835b043..ef13e5f 100755 --- a/policycoreutils/semanage-port-add-delete-problems/runtest.sh +++ b/policycoreutils/semanage-port-add-delete-problems/runtest.sh @@ -26,6 +26,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -82,7 +83,7 @@ rlJournalStart sleep 2 # Check for MAC_POLICY_LOAD - rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME} --input-logs" 0 + rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME}" 0 # deleting a port number from a type START_DATE_TIME=`date "+%m/%d/%Y %T"` @@ -91,7 +92,7 @@ rlJournalStart sleep 2 # Check for MAC_POLICY_LOAD - rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME} --input-logs" 0 + rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME}" 0 rlPhaseEnd fi @@ -115,12 +116,8 @@ rlJournalStart rlRun "semanage port -a -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" rlAssertGrep "port .* already defined" ${OUTPUT_FILE} -i rlRun "semanage port -l | grep 'smtp_port_t.*tcp.*25'" - rm -f ${OUTPUT_FILE} rlRun "semanage port -d -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" - # the error may not appear because the local customization can be deleted always - if [ -s ${OUTPUT_FILE} ] ; then - rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i - fi + rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i rlRun "semanage port -d -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i rlRun "semanage port -l | grep 'smtp_port_t.*tcp.*25'" diff --git a/policycoreutils/semanage-user/main.fmf b/policycoreutils/semanage-user/main.fmf index 4ef5dbd..0111538 100644 --- a/policycoreutils/semanage-user/main.fmf +++ b/policycoreutils/semanage-user/main.fmf @@ -1,36 +1 @@ -summary: Does semanage user ... work correctly? -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - policycoreutils-python-utils - - grep - - selinux-policy-devel - - selinux-policy-minimum - - selinux-policy-mls - - selinux-policy-targeted - - selinux-policy-devel -duration: 20m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - avoidImageMode -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=987444 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0092120 -extra-summary: /CoreOS/policycoreutils/Regression/semanage-user -extra-task: /CoreOS/policycoreutils/Regression/semanage-user +path: /policycoreutils/semanage-user diff --git a/policycoreutils/semanage-user/runtest.sh b/policycoreutils/semanage-user/runtest.sh index 6326db6..b2413fb 100755 --- a/policycoreutils/semanage-user/runtest.sh +++ b/policycoreutils/semanage-user/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -34,7 +35,6 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} - rlRun "rpm -qa | grep selinux-policy" rlRun "make -f /usr/share/selinux/devel/Makefile" rlRun "ls -l testpolicy.pp" rlPhaseEnd @@ -51,9 +51,6 @@ rlJournalStart if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then continue fi - if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then - continue - fi rlRun "semanage user -l -S ${POLICY_TYPE}" done if ! rlIsRHEL 5; then diff --git a/policycoreutils/semodule-l-checksum/Makefile b/policycoreutils/semodule-l-checksum/Makefile deleted file mode 100644 index 875a9b8..0000000 --- a/policycoreutils/semodule-l-checksum/Makefile +++ /dev/null @@ -1,64 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum -# Description: Test semodule -l --checksum -# Author: Petr Lautrbach -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Petr Lautrbach " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Test semodule -l --checksum" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils selinux-policy-devel" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Bug: 1731501 2026680" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA) - - rhts-lint $(METADATA) diff --git a/policycoreutils/semodule-l-checksum/PURPOSE b/policycoreutils/semodule-l-checksum/PURPOSE deleted file mode 100644 index a11f95a..0000000 --- a/policycoreutils/semodule-l-checksum/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum -Description: Test semodule -l --checksum -Author: Petr Lautrbach diff --git a/policycoreutils/semodule-l-checksum/main.fmf b/policycoreutils/semodule-l-checksum/main.fmf deleted file mode 100644 index bb39ac8..0000000 --- a/policycoreutils/semodule-l-checksum/main.fmf +++ /dev/null @@ -1,13 +0,0 @@ -summary: Test semodule -l --checksum -description: '' -contact: Petr Lautrbach -component: - - policycoreutils -recommend: - - policycoreutils - - selinux-policy-devel -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1731501 -extra-summary: /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum -extra-task: /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum -id: 115f6c6a-426a-4f92-9ea3-9dfca5624c6e diff --git a/policycoreutils/semodule-l-checksum/runtest.sh b/policycoreutils/semodule-l-checksum/runtest.sh deleted file mode 100755 index b16ef6d..0000000 --- a/policycoreutils/semodule-l-checksum/runtest.sh +++ /dev/null @@ -1,87 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum -# Description: Test semodule -l --checksum -# Author: Petr Lautrbach -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - # create new type, allow reading, do not allow writing - rlRun "cat << EOF >test_module.te -module test_module 1.0; - -require { - type unconfined_t; - attribute filesystem_type; - class file { getattr ioctl lock open read relabelto write }; - class filesystem { associate }; -} - -type test_t; - -allow test_t filesystem_type:filesystem { associate }; -allow unconfined_t test_t:file { getattr ioctl lock open read relabelto}; -dontaudit unconfined_t test_t:file { write }; -EOF" - # compile the module - rlRun "make -f /usr/share/selinux/devel/Makefile test_module.pp" - # load it - rlRun "semodule -X 500 -i test_module.pp" - rlRun "/usr/libexec/selinux/hll/pp test_module.pp test_module.cil" - - rlPhaseEnd - - rlPhaseStartTest "semodule -lfull --checksum" - rlRun "semodule -lfull --checksum | grep test_module" - module=($(semodule -lfull --checksum | grep test_module) ) - sha256=($(sha256sum test_module.cil)) - rlAssertEquals "Is the module name 'test_module'?" ${module[1]} "test_module" - rlAssertEquals "Is the module priority '500'?" ${module[0]} "500" - rlAssertEquals "Is the loaded module checksum same as the file checksum? " ${module[3]} "sha256:${sha256[0]}" - rlPhaseEnd - - rlPhaseStartTest "is the checksum option listed?" - if [ -e "/usr/share/man/man8/semodule.8.gz" ]; then - rlRun "man semodule | col -b | grep checksum" - rlRun "man semodule | col -b | grep 'SHA256.*checksum'" - fi - rlRun "semodule --help | grep checksum" - rlRun "semodule --help | grep 'checksum.*SHA256'" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "semodule -X 500 -r test_module" - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/Makefile b/policycoreutils/semodule-rebuild-if-modules-changed/Makefile deleted file mode 100644 index 313928c..0000000 --- a/policycoreutils/semodule-rebuild-if-modules-changed/Makefile +++ /dev/null @@ -1,7 +0,0 @@ -# Minimal Makefile for standard-test-roles-beakerlib - -R="RhtsRequires: policycoreutils checkpolicy setools-console selinux-policy-targeted" - -run: - chmod +x runtest.sh - ./runtest.sh diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf deleted file mode 100644 index b9115c7..0000000 --- a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf +++ /dev/null @@ -1,31 +0,0 @@ -summary: Test rebuild-on-change support in semodule -description: | - Verifies that semodule --rebuild-if-modules-changed command-line option - works as it should. -contact: Ondrej Mosnacek -component: - - policycoreutils - - libsemanage -framework: beakerlib -require: - - policycoreutils - - checkpolicy - - setools-console - - selinux-policy-targeted -duration: 15m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < rhel-8 - because: RHEL-7 and below are not expected to support this - - enabled: false - when: distro < fedora-36 - because: This feature may not be available in F35 and below -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049186 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049189 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049191 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049193 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173959 -extra-nitrate: TC#0613060 diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh deleted file mode 100755 index 8291323..0000000 --- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh +++ /dev/null @@ -1,152 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2021 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -if grep -q ^store-root /etc/selinux/semanage.conf ; then - STORE_ROOT=`grep ^store-root /etc/selinux/semanage.conf | cut -d = -f 2` -else - STORE_ROOT=/var/lib/selinux -fi -STORE_TYPE=targeted -MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules" -STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern" -STORE_BOOLS="$STORE_ROOT/$STORE_TYPE/active/booleans.local" -STORE_DISABLE_DONTAUDIT="$STORE_ROOT/$STORE_TYPE/active/disable_dontaudit" -TEST_MODULE_DIR="$MODULES_ROOT/400/test_module" -TEST_BOOLEAN="xguest_exec_content" -TEST_BOOLEAN_VALUE="0" -TEST_BOOLEAN_VALUE_TEXT="false" - -CHECKSUM_CMD=sha256sum - -function policy_checksum() { - local policyvers="$1" - - "$CHECKSUM_CMD" "/etc/selinux/$STORE_TYPE/policy/policy.$policyvers" -} - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm "libsemanage" - rlAssertRpm "policycoreutils" - rlAssertRpm "selinux-policy" - - policyvers="$(checkpolicy -V | cut -f 1 -d ' ')" - policyvers_kernel="$(cat /sys/fs/selinux/policyvers)" - if [ "$policyvers" -lt "$policyvers_kernel" ]; then - policyvers="$policyvers_kernel" - fi - - rlRun "semodule -N -B" 0 \ - "Make sure policy store is in a consistent state initially" - - refresh_opt="" - for opt in --refresh --rebuild-if-modules-changed; do - if semodule --help | grep -q -- "$opt"; then - refresh_opt="$opt" - rlLog "$opt command-line option detected for semodule" - break - fi - done - rlPhaseEnd - - if [ -n "$refresh_opt" ]; then - rlPhaseStartTest "No change behavior" - # The resulting binary policy will be different (albeit - # equivalent) after a full rebuild vs. when only local - # changes are applied to existing policy.linked file, so - # toggle a boolean twice to get the expected binary form. - rlRun "setsebool -P xguest_exec_content $TEST_BOOLEAN_VALUE" - rlRun "setsebool -P xguest_exec_content $(( ! $TEST_BOOLEAN_VALUE ))" - - checksum_before="$(policy_checksum "$policyvers")" - rlRun "semodule -N $refresh_opt" - checksum_after="$(policy_checksum "$policyvers")" - rlAssertEquals "Binary policy must not change after rebuild" \ - "$checksum_before" "$checksum_after" - - # Make sure policy is restored regardless of any previous failures - rlRun "semodule -N -B" 0 \ - "Force a rebuild to clean things up" - rlPhaseEnd - - rlPhaseStartTest "Module injected" - rlLog "Inject a new module into the store" - rlRun "mkdir -p '$TEST_MODULE_DIR'" - rlRun "echo -n cil >'$TEST_MODULE_DIR/lang_ext'" - rlRun "echo '(type test_module_type_t)' >'$TEST_MODULE_DIR/cil'" - rlRun "semodule -N $refresh_opt" 0 \ - "Do a conditional rebuild" - rlRun "semodule -l | grep test_module" 0 \ - "Verify that the module has been picked up" - rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 0 \ - "Verify that the new type is included in the built policy" - - rlLog "Now remove the module" - rlRun "rm -rf '$TEST_MODULE_DIR'" - rlRun "semodule -N $refresh_opt" - rlRun "semodule -l | grep test_module" 1 \ - "Verify that the module has been removed" - rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 1 \ - "Verify that the new type is NOT included in the built policy" - - # Make sure policy is restored regardless of any previous failures - rlRun "semodule -N -B" 0 \ - "Force a rebuild to clean things up" - rlPhaseEnd - - # --refresh option implies fixed boolean/etc. behavior - if [ "$refresh_opt" = "--refresh" ]; then - rlPhaseStartTest "Boolean setting injected" - rlLog "Inject a boolean setting into the store" - rlRun "echo '$TEST_BOOLEAN=$TEST_BOOLEAN_VALUE' >'$STORE_BOOLS'" - rlRun "semodule -N $refresh_opt" 0 \ - "Do a conditional rebuild" - rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 0 \ - "Verify that the boolean setting has been picked up" - - rlLog "Now remove the setting" - rlRun "rm -f '$STORE_BOOLS'" - rlRun "semodule -N $refresh_opt" - rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 1 \ - "Verify that the boolean setting has been reset back" - - # Make sure policy is restored regardless of any previous failures - rlRun "semodule -N -B" 0 \ - "Force a rebuild to clean things up" - rlPhaseEnd - - # https://bugzilla.redhat.com/show_bug.cgi?id=2173959 - if ! { rlIsRHEL && rlIsRHEL '<9.3'; }; then - rlPhaseStartTest "Disable dontaudit injected" - rlLog "Inject disable_dontaudit flag into the store" - rlRun "touch '$STORE_DISABLE_DONTAUDIT'" - rlRun "semodule -N $refresh_opt" 0 \ - "Do a conditional rebuild" - rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -eq 0" 0 \ - "Verify that the flag has been picked up" - - rlLog "Now remove the flag" - rlRun "rm -f '$STORE_DISABLE_DONTAUDIT'" - rlRun "semodule -N $refresh_opt" - rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -gt 0" 0 \ - "Verify that the dontaudit rules are back" - - # Make sure policy is restored regardless of any previous failures - rlRun "semodule -N -B" 0 \ - "Force a rebuild to clean things up" - rlPhaseEnd - fi - fi - else - rlPhaseStartTest "Test skipped" - rlLog "--rebuild-if-modules-changed/--refresh command-line option not supported; skipping tests..." - rlPhaseEnd - fi -rlJournalPrintText -rlJournalEnd diff --git a/policycoreutils/sepolicy-generate-application/main.fmf b/policycoreutils/sepolicy-generate-application/main.fmf deleted file mode 100644 index 3b95b9c..0000000 --- a/policycoreutils/sepolicy-generate-application/main.fmf +++ /dev/null @@ -1,16 +0,0 @@ -summary: Does `sepolicy generate --application ...` detect writeable locations? -test: ./test.sh -framework: beakerlib -component: - - policycoreutils -require: - - policycoreutils - - policycoreutils-devel - - mariadb-server -recommend: - - abrt -tier: '3' -tag: - - failinfedora -enabled: true -extra-nitrate: TC#0615932 diff --git a/policycoreutils/sepolicy-generate-application/test.sh b/policycoreutils/sepolicy-generate-application/test.sh deleted file mode 100755 index 50ac0cc..0000000 --- a/policycoreutils/sepolicy-generate-application/test.sh +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" - rlRun "pushd $tmp" - rlRun "set -o pipefail" - rlPhaseEnd - - rlPhaseStartTest "/usr/bin/mysqld_safe" - rlRun "mkdir policy" - rlRun "sepolicy generate -p policy --application /usr/bin/mysqld_safe" - rlRun "cat policy/*fc" - for dir in `rpm -ql --dump mariadb-server | sed -n -E '\%\/var\/(log|run|lib)[[:graph:]]* [[:alnum:]]* [[:alnum:]]* [[:alnum:]]* 04.*%s%^([^ ]*).*%\1%p'`; do - rlRun "grep $dir policy/*.fc" - done - rlRun "rm -rf policy" - rlPhaseEnd - - if [ -x /usr/sbin/abrtd ] ; then - rlPhaseStartTest "/usr/sbin/abrtd" - rlRun "mkdir policy" - rlRun "sepolicy generate -p policy --application /usr/sbin/abrtd" - rlRun "cat policy/*fc" - for dir in `rpm -ql --dump abrt | sed -n -E '\%\/var\/(log|run|lib)[[:graph:]]* [[:alnum:]]* [[:alnum:]]* [[:alnum:]]* 04.*%s%^([^ ]*).*%\1%p'`; do - rlRun "grep $dir policy/*.fc" - done - rlRun "rm -rf policy" - rlPhaseEnd - fi - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $tmp" 0 "Remove tmp directory" - rlPhaseEnd -rlJournalEnd diff --git a/policycoreutils/sepolicy-generate/main.fmf b/policycoreutils/sepolicy-generate/main.fmf index fc31e47..29abfee 100644 --- a/policycoreutils/sepolicy-generate/main.fmf +++ b/policycoreutils/sepolicy-generate/main.fmf @@ -1,38 +1 @@ -summary: sepolicy generate sanity test -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - policycoreutils-devel - - rpm-build -duration: 115m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_FIPS - - TIPpass_Security - - TipWaived7 - - f31friendly - - f32friendly - - targeted - - avoidImageMode -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271324 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924686 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1512590 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924696 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=962752 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924107 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924121 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0248603 -extra-summary: /CoreOS/policycoreutils/Sanity/sepolicy-generate -extra-task: /CoreOS/policycoreutils/Sanity/sepolicy-generate +path: /policycoreutils/sepolicy-generate diff --git a/policycoreutils/sepolicy-generate/runtest.sh b/policycoreutils/sepolicy-generate/runtest.sh index f79213f..e318ecc 100755 --- a/policycoreutils/sepolicy-generate/runtest.sh +++ b/policycoreutils/sepolicy-generate/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" @@ -106,10 +107,16 @@ rlJournalStart rlRun "rm -rf mypolicy" rlPhaseEnd + rlPhaseStartTest "sepolicy manpage --web, bz1854639" + rlRun "sepolicy manpage --web -d zebra_t" + rlRun "ls /tmp/*release*" 0 "Html file with OS name exists." + rlRun "cat /tmp/*release* > /tmp/testfile" + rlAssertGrep "href=zebra.html" "/tmp/testfile" + rlPhaseEnd + rlPhaseStartCleanup rlRun "popd" rlRun "rm -r $TmpDir" 0 "Removing tmp directory" rlPhaseEnd rlJournalPrintText rlJournalEnd - diff --git a/policycoreutils/sepolicy-manpage/main.fmf b/policycoreutils/sepolicy-manpage/main.fmf deleted file mode 100644 index ab89152..0000000 --- a/policycoreutils/sepolicy-manpage/main.fmf +++ /dev/null @@ -1,22 +0,0 @@ -summary: sepolicy manpage sanity test -description: Does the sepolicy manpage command work correctly? -contact: Milos Malik -component: - - policycoreutils -framework: beakerlib -recommend: - - /usr/bin/sepolicy - - setools-console -duration: 1h -enabled: true -tier: 3 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1416372 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1854639 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1989840 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - because: the sepolicy command is not available there -extra-nitrate: TC#0614751 - diff --git a/policycoreutils/sepolicy-manpage/runtest.sh b/policycoreutils/sepolicy-manpage/runtest.sh deleted file mode 100755 index 5c0f22b..0000000 --- a/policycoreutils/sepolicy-manpage/runtest.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "rpm -qa | grep policycoreutils" - rlPhaseEnd - - rlPhaseStartTest "bz#1416372" - rlRun -s "sepolicy manpage -a" - rlRun "grep -i -e invalid -e error -e traceback ${rlRun_LOG}" 1 - rm -f ${rlRun_LOG} - rlRun -s "sepolicy manpage -d crond_t" - rlRun "grep -i -e invalid -e error -e traceback ${rlRun_LOG}" 1 - rm -f ${rlRun_LOG} - rlPhaseEnd - - rlPhaseStartTest "sepolicy manpage --web, bz#1854639 + bz#1989840" - if seinfo -a domain -x | grep -q zebra ; then - DOMAIN_PREFIX="zebra" - else - DOMAIN_PREFIX="xserver" - fi - rlRun "sepolicy manpage --web -d ${DOMAIN_PREFIX}_t" - if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then - rlRun "ls -l /tmp/*release*" 0 "Html file with OS name exists." - rlRun "cat /tmp/*release* > /tmp/testfile" - else - rlRun "ls -l /tmp/index.html" 0 "HTML file exists" - rlRun "cat /tmp/index.html > /tmp/testfile" - fi - rlAssertGrep "href=${DOMAIN_PREFIX}.html" "/tmp/testfile" - rlRun "ls -l /tmp/${DOMAIN_PREFIX}.html" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f /tmp/${DOMAIN_PREFIX}* /tmp/index.html /tmp/*release*" - rlPhaseEnd -rlJournalEnd - diff --git a/policycoreutils/sestatus/main.fmf b/policycoreutils/sestatus/main.fmf index 436e656..0ca1ec2 100644 --- a/policycoreutils/sestatus/main.fmf +++ b/policycoreutils/sestatus/main.fmf @@ -1,30 +1 @@ -summary: tests everything about sestatus -description: |4 - -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - grep - - man -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - TIPpass_Security - - f31friendly - - f32friendly - - targeted -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705027 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705031 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1723859 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0103609 -extra-summary: /CoreOS/policycoreutils/Sanity/sestatus -extra-task: /CoreOS/policycoreutils/Sanity/sestatus +path: /policycoreutils/sestatus diff --git a/policycoreutils/sestatus/runtest.sh b/policycoreutils/sestatus/runtest.sh old mode 100755 new mode 100644 index 1ddd4d5..14ad828 --- a/policycoreutils/sestatus/runtest.sh +++ b/policycoreutils/sestatus/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" @@ -94,18 +95,14 @@ rlJournalStart # This bug is not worth fixing in RHEL-5 if ! rlIsRHEL 5 ; then rlPhaseStartTest - rlRun "rpm -ql ${PACKAGE} | grep -E '/usr/s?bin/sestatus'" + rlRun "rpm -ql ${PACKAGE} | grep /usr/sbin/sestatus" rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/man8/sestatus.8" for OPTION in b v ; do rlRun "sestatus --help 2>&1 | grep -- -${OPTION}" - if [ -e "/usr/share/man/man8/sestatus.8.gz" ]; then - rlRun "man sestatus | col -b | grep -- -${OPTION}" - fi + rlRun "man sestatus | col -b | grep -- -${OPTION}" done if ! rlIsRHEL 6 ; then - if [ -e "/usr/share/man/man5/sestatus.conf.5.gz" ]; then - rlRun "man -w sestatus.conf" - fi + rlRun "man -w sestatus.conf" fi rlPhaseEnd fi diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile deleted file mode 100644 index 6e1a5af..0000000 --- a/policycoreutils/setfiles/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Sanity/setfiles -# Description: Basic sanity tests for setfiles -# Author: Michal Trunecka -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Sanity/setfiles -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Michal Trunecka " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Basic sanity tests for setfiles" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 30m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Bug: 1098062" >> $(METADATA) # RHEL-6 - @echo "Bug: 1086572" >> $(METADATA) # RHEL-6 - @echo "Bug: 1086456" >> $(METADATA) # RHEL-6 - @echo "Bug: 1271326" >> $(METADATA) # RHEL-7 - @echo "Bug: 1271327" >> $(METADATA) # RHEL-7 - @echo "Bug: 1584116" >> $(METADATA) # RHEL-7 - @echo "Bug: 1794518" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) diff --git a/policycoreutils/setfiles/PURPOSE b/policycoreutils/setfiles/PURPOSE deleted file mode 100644 index eb93ba3..0000000 --- a/policycoreutils/setfiles/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Sanity/setfiles -Description: Basic sanity tests for setfiles -Author: Michal Trunecka diff --git a/policycoreutils/setfiles/main.fmf b/policycoreutils/setfiles/main.fmf deleted file mode 100644 index d4e2cce..0000000 --- a/policycoreutils/setfiles/main.fmf +++ /dev/null @@ -1,29 +0,0 @@ -summary: Basic sanity tests for setfiles -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils -require: - - e2fsprogs -duration: 30m -enabled: true -tag: - - CI-Tier-1 - - TIPfail_Security - - f31friendly - - f32friendly - - targeted -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1098062 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1086572 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1086456 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271326 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271327 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1584116 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1794518 -extra-nitrate: TC#0392756 -extra-summary: /CoreOS/policycoreutils/Sanity/setfiles -extra-task: /CoreOS/policycoreutils/Sanity/setfiles diff --git a/policycoreutils/setfiles/runtest.sh b/policycoreutils/setfiles/runtest.sh deleted file mode 100755 index a760694..0000000 --- a/policycoreutils/setfiles/runtest.sh +++ /dev/null @@ -1,109 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Sanity/setfiles -# Description: Basic sanity tests for setfiles -# Author: Michal Trunecka -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - OUTPUT=`mktemp` - rlPhaseEnd - - rlPhaseStartTest "bz1086456 + bz1086572 + bz1098062 + bz1584116" - rlLog "Check for bz#1086456" - rlRun "touch /tmp/file" - rlRun "cat > spec_file < ${USERTMP}/spec_file < -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Sanity/setfiles_binary -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Vit Mojzis " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: setfiles should allow checking given path against binary policy" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils rpm cpio" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 1973754" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) diff --git a/policycoreutils/setfiles_binary/PURPOSE b/policycoreutils/setfiles_binary/PURPOSE deleted file mode 100644 index 57f484f..0000000 --- a/policycoreutils/setfiles_binary/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Sanity/setfiles_binary -Description: setfiles should allow checking given path against binary policy -Author: Vit Mojzis diff --git a/policycoreutils/setfiles_binary/main.fmf b/policycoreutils/setfiles_binary/main.fmf deleted file mode 100644 index e00f7b1..0000000 --- a/policycoreutils/setfiles_binary/main.fmf +++ /dev/null @@ -1,25 +0,0 @@ -summary: setfiles should allow checking given path against binary policy -description: '' -contact: Milos Malik -component: - - policycoreutils -recommend: - - policycoreutils - - rpm - - cpio -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1973754 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0611169 -extra-summary: /CoreOS/policycoreutils/Sanity/setfiles_binary -extra-task: /CoreOS/policycoreutils/Sanity/setfiles_binary diff --git a/policycoreutils/setfiles_binary/runtest.sh b/policycoreutils/setfiles_binary/runtest.sh deleted file mode 100755 index 7221573..0000000 --- a/policycoreutils/setfiles_binary/runtest.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Sanity/setfiles_binary -# Description: setfiles should allow checking given path against binary policy -# Author: Vit Mojzis -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - OUTPUT=`mktemp` - rlRun "mkdir policy" - rlRun "pushd policy" - # download and extract selinux-policy-targeted - rlRun "dnf download selinux-policy-targeted" - rlRun "rpm2cpio *.rpm | cpio -idm" - rlRun "popd" - # create a mockup of root directory structure - DIRS="bin boot dev etc home lib lib64 media mnt opt proc root run sbin snap srv sys tmp usr var" - rlRun " -mkdir testroot -for DIR in ${DIRS}; do - mkdir -p testroot/\${DIR} -done -" - rlRun "ls -lZ testroot" - rlPhaseEnd - - rlPhaseStartTest "setfiles should allow checking given path against binary policy - bz#1973754" - DIR=$(pwd) - # run setfiles using system policy - rlRun "setfiles -r '$DIR/testroot' -nvF /etc/selinux/targeted/contexts/files/file_contexts '$DIR/testroot' &> setfilesout" - POLICY=$(find "$DIR/policy/etc/selinux/targeted/policy/" -name "policy.*") - # run the same command using the extracted policy - rlRun "setfiles -r '$DIR/testroot' -nvF -c '$POLICY' '$DIR/policy/etc/selinux/targeted/contexts/files/file_contexts' '$DIR/testroot' &> setfilesout2" - rlRun "diff setfilesout setfilesout2" 0 - if [ ! $? -eq 0 ] ; then - rlRun "cat setfilesout" - rlRun "cat setfilesout2" - fi - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/policycoreutils/setsebool/main.fmf b/policycoreutils/setsebool/main.fmf index e12bcec..7da7113 100644 --- a/policycoreutils/setsebool/main.fmf +++ b/policycoreutils/setsebool/main.fmf @@ -1,43 +1 @@ -summary: does setsebool work correctly ? -description: |+ - Does setsebool work as expected? Does it produce correct audit messages? - -contact: Milos Malik -component: - - policycoreutils -recommend: - - audit - - policycoreutils - - libselinux-utils - - shadow-utils - - grep -duration: 45m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - TIPpass - - TIPpass_FIPS - - TIPpass_Security - - TipWaived7 - - f31friendly - - f33friendly - - failinrhel8ci - - targeted - - avoidImageMode -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1002529 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=856550 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1029965 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953917 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=825176 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=666365 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=998974 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0078073 -extra-summary: /CoreOS/policycoreutils/Sanity/setsebool -extra-task: /CoreOS/policycoreutils/Sanity/setsebool +path: /policycoreutils/setsebool diff --git a/policycoreutils/setsebool/runtest.sh b/policycoreutils/setsebool/runtest.sh index 04878f9..202d641 100755 --- a/policycoreutils/setsebool/runtest.sh +++ b/policycoreutils/setsebool/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" @@ -114,14 +115,9 @@ rlJournalStart for LINE in `cat /etc/selinux/*/booleans.subs_dist | sort | uniq | tr -s ' ' | tr ' ' ':'` ; do OLD_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 1` NEW_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 2` - # do not test this if the new boolean does not exist in the policy - if getsebool ${NEW_BOOLEAN_NAME} &> /dev/null; then - rlRun "getsebool ${OLD_BOOLEAN_NAME} 2>&1 | tee ${OUTPUT_FILE}" - rlRun "getsebool ${NEW_BOOLEAN_NAME} 2>&1 | tee -a ${OUTPUT_FILE}" - rlRun "uniq -c ${OUTPUT_FILE} | grep '2 '" - else - rlLog "$NEW_BOOLEAN_NAME does not exist, skip" - fi + rlRun "getsebool ${OLD_BOOLEAN_NAME} 2>&1 | tee ${OUTPUT_FILE}" + rlRun "getsebool ${NEW_BOOLEAN_NAME} 2>&1 | tee -a ${OUTPUT_FILE}" + rlRun "uniq -c ${OUTPUT_FILE} | grep '2 '" done rlPhaseEnd fi @@ -133,10 +129,10 @@ rlJournalStart rlRun "setsebool ${BOOLEAN} off" rlRun "setsebool ${BOOLEAN} on" sleep 1 - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} --input-logs | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=1 old_val=0\"" - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} --input-logs | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=0 old_val=1\"" + rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=1 old_val=0\"" + rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=0 old_val=1\"" if rlIsRHEL ; then - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} --input-logs | grep \"type=SYSCALL.*comm=setsebool\"" + rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=SYSCALL.*comm=setsebool\"" fi rlPhaseEnd diff --git a/policycoreutils/seunshare-drop-system-calls/main.fmf b/policycoreutils/seunshare-drop-system-calls/main.fmf deleted file mode 100644 index 2dbcac1..0000000 --- a/policycoreutils/seunshare-drop-system-calls/main.fmf +++ /dev/null @@ -1,25 +0,0 @@ -summary: Test that seunshare/sandbox doesn't execute shell commands when given - filenames with special characters. -contact: Veronika Syncakova -component: - - policycoreutils -require: - - policycoreutils - - policycoreutils-sandbox -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 -link: - - verifies: https://redhat.atlassian.net/browse/RHEL-144055 - - verifies: https://redhat.atlassian.net/browse/RHEL-144041 -adjust+: - - enabled: false - when: distro < rhel-8 - continue: false -id: cd507040-e105-4873-972b-7fe10bb597fa - diff --git a/policycoreutils/seunshare-drop-system-calls/runtest.sh b/policycoreutils/seunshare-drop-system-calls/runtest.sh deleted file mode 100755 index 79cfb87..0000000 --- a/policycoreutils/seunshare-drop-system-calls/runtest.sh +++ /dev/null @@ -1,34 +0,0 @@ -#!/bin/bash - -# Include beakerlib environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="policycoreutils-sandbox" -TEST_DIR="/tmp/mytest" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlRun "mkdir -p ${TEST_DIR}" - rlPhaseEnd - - rlPhaseStartTest "RHEL-144055 + RHEL-144041" - # Create a file with malicious name - rlRun -s "seunshare -Z unconfined_u:unconfined_r:sandbox_x_t:s0 \ - -t ${TEST_DIR} \ - -- /bin/bash -c \"touch \\\"/tmp/' ; id -Z ; '\\\"\"" - rlRun "ls ${TEST_DIR} | grep '; id -Z ;' " - # Trigger rsync which processes filenames - rlRun -s "seunshare -Z unconfined_u:unconfined_r:sandbox_x_t:s0 \ - -t ${TEST_DIR} \ - -- /bin/bash -c \"touch \\\"/tmp/' ; id -Z ; '\\\"\" " - rlAssertNotGrep "command not found" $rlRun_LOG - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf ${TEST_DIR}" - rlRun "rm -f $rlRun_LOG" - rlPhaseEnd - - rlJournalPrintText -rlJournalEnd diff --git a/policycoreutils/spaces-in-fcontext-patterns/Makefile b/policycoreutils/spaces-in-fcontext-patterns/Makefile deleted file mode 100644 index b39090e..0000000 --- a/policycoreutils/spaces-in-fcontext-patterns/Makefile +++ /dev/null @@ -1,66 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns -# Description: Does semanage accept spaces in fcontext patterns? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does semanage accept spaces in fcontext patterns?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/semanage" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 1893545" >> $(METADATA) # Fedora 32 - - rhts-lint $(METADATA) - diff --git a/policycoreutils/spaces-in-fcontext-patterns/PURPOSE b/policycoreutils/spaces-in-fcontext-patterns/PURPOSE deleted file mode 100644 index db31d4a..0000000 --- a/policycoreutils/spaces-in-fcontext-patterns/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns -Author: Milos Malik - -Description: Does semanage accept spaces in fcontext patterns? - diff --git a/policycoreutils/spaces-in-fcontext-patterns/main.fmf b/policycoreutils/spaces-in-fcontext-patterns/main.fmf deleted file mode 100644 index 62bb7a3..0000000 --- a/policycoreutils/spaces-in-fcontext-patterns/main.fmf +++ /dev/null @@ -1,36 +0,0 @@ -summary: Does semanage accept spaces in fcontext patterns? -description: |+ - Does semanage accept spaces in fcontext patterns? - -contact: Milos Malik -component: - - policycoreutils -test: ./runtest.sh -framework: beakerlib -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - /usr/sbin/semanage -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1893545 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0614100 diff --git a/policycoreutils/spaces-in-fcontext-patterns/runtest.sh b/policycoreutils/spaces-in-fcontext-patterns/runtest.sh deleted file mode 100755 index ea57c89..0000000 --- a/policycoreutils/spaces-in-fcontext-patterns/runtest.sh +++ /dev/null @@ -1,56 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns -# Description: Does semanage accept spaces in fcontext patterns? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlRun "rpm -qf `which semanage`" - rlPhaseEnd - - rlPhaseStartTest "bz#1893545" - rlRun "semanage fcontext -l -C" - rlRun "semanage fcontext -a -t public_content_t '/mnt/media/My\ Dir(/.*)?'" 1 - rlRun "semanage fcontext -a -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 - rlRun "semanage fcontext -a -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 - rlRun "semanage fcontext -l -C" - rlRun "semanage fcontext -d -t public_content_t '/mnt/media/My\ Dir(/.*)?'" 1 - rlRun "semanage fcontext -d -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 - rlRun "semanage fcontext -d -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 - rlRun "semanage fcontext -l -C" - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/Library/common/Makefile b/selinux-policy/Library/common/Makefile index eecb818..8c2004f 100644 --- a/selinux-policy/Library/common/Makefile +++ b/selinux-policy/Library/common/Makefile @@ -1,7 +1,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Makefile of /CoreOS/selinux-policy/Library/common -# Description: Common library for SELinux related components +# Description: Wrapper library for /CoreOS/selinux-policy/common # Author: David Spurek # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -43,19 +43,19 @@ $(METADATA): Makefile @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Common library for SELinux related components" >> $(METADATA) + @echo "Description: Common library for SELinux" >> $(METADATA) @echo "Type: Library" >> $(METADATA) @echo "TestTime: 120m" >> $(METADATA) + @echo "Requires: setools" >> $(METADATA) @echo "Requires: setools-console" >> $(METADATA) @echo "Requires: expect" >> $(METADATA) @echo "Requires: policycoreutils" >> $(METADATA) @echo "Requires: /usr/sbin/semanage" >> $(METADATA) - @echo "Requires: /usr/sbin/service" >> $(METADATA) @echo "Requires: selinux-policy-devel" >> $(METADATA) @echo "Requires: yum-utils" >> $(METADATA) @echo "Requires: python3 sqlite" >> $(METADATA) @echo "Provides: library(selinux-policy/common)" >> $(METADATA) - @echo "RhtsRequires: library(epel/epel)" >> $(METADATA) + @echo "RhtsRequires: library(distribution/epel)" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh old mode 100755 new mode 100644 index 61c8ca9..8d6785f --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -3,7 +3,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # lib.sh of /CoreOS/selinux-policy/Library/common -# Description: Common library for SELinux related components +# Description: Common library for selinux-policy component # Authors: Milos Malik # Michal Trunecka # David Spurek @@ -29,7 +29,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # library-prefix = rlSE -# library-version = 44 +# library-version = 40 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ : <<'=cut' @@ -49,6 +49,7 @@ selinux-policy/common - BeakerLib extension for managing SELinux =pod =head1 VARIABLES + =over =item rlSE_CACHE_DIR @@ -65,6 +66,9 @@ rlSE_CACHE_DIR="${rlSE_CACHE_DIR:-$__INTERNAL_PERSISTENT_TMP/BEAKERLIB-rlSE}" __INTERNAL_rlSE_CACHEFILE="$rlSE_CACHE_DIR/cache.db" __INTERNAL_rlSE_SUMFILE="$rlSE_CACHE_DIR/cache.policy-checksum" +SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` + + # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Functions # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -318,7 +322,6 @@ function rlSEMatchPathCon() { local FILE_PATH local LINK_PATH local REAL_TYPE=`rlSETranslateAlias $2` - rlLogDebug "$FUNCNAME(): REAL_TYPE=$REAL_TYPE" FILE_PATH=$1 if ! rlIsRHEL '<6'; then @@ -330,22 +333,16 @@ function rlSEMatchPathCon() { done fi - rlLogDebug "$FUNCNAME(): FILE_PATH=$FILE_PATH" - local ec=0 while [[ -n "$FILE_PATH" ]]; do if [ -L ${FILE_PATH} ] ; then - rlLogDebug "$FUNCNAME(): evaluating symlink" LINK_PATH=`readlink -f ${FILE_PATH}` - local out="$(matchpathcon ${FILE_PATH} ${LINK_PATH})" - echo "$out" - echo "$out" | grep -q ":${REAL_TYPE}:" + matchpathcon ${FILE_PATH} ${LINK_PATH} + matchpathcon ${FILE_PATH} ${LINK_PATH} | grep :${REAL_TYPE} > /dev/null rlAssert0 "Results of matchpathcon ${FILE_PATH} ${LINK_PATH} should contain ${REAL_TYPE}" $? || ec=1 else - rlLogDebug "$FUNCNAME(): evaluating file" - local out="$(matchpathcon ${FILE_PATH})" - echo "$out" - echo "$out" | grep -q ":${REAL_TYPE}:" + matchpathcon ${FILE_PATH} + matchpathcon ${FILE_PATH} | grep :${REAL_TYPE} > /dev/null rlAssert0 "Result of matchpathcon ${FILE_PATH} should contain ${REAL_TYPE}" $? || ec=1 fi FILE_PATH=( "${FILE_PATH[@]:1}" ) @@ -872,7 +869,7 @@ Pair functions to check AVC messages from the given moment. The starting timesta function rlSESetTimestamp() { - local STAMP=`LC_ALL=en_US.UTF-8 date "+%x %T"` + local STAMP=`date "+%m/%d/%Y %T"` local NAME="TIMESTAMP" [ -z "$1" ] || NAME="${NAME}_$1" @@ -930,7 +927,7 @@ function rlSEAVCCheck() { return 1 else rlLog "$FUNCNAME: Search for AVCs, USER_AVCs, SELINUX_ERRs, and USER_SELINUX_ERRs since timestamp '$NAME' [$STAMP]" - local ausearch_output=$(LC_ALL='en_US.UTF-8' ausearch --input-logs -i -m AVC -m USER_AVC -m SELINUX_ERR -m USER_SELINUX_ERR -ts $STAMP 2>&1) + local ausearch_output=$(LC_TIME='en_US.UTF-8' ausearch -i -m AVC -m USER_AVC -m SELINUX_ERR -m USER_SELINUX_ERR -ts $STAMP 2>&1) echo "$ausearch_output" >&2 local res=0 # filter out ignored patterns @@ -1285,16 +1282,6 @@ function rlSERunWithContext() { } -function rlSEConfigureSSH () { - rlFileBackup /etc/ssh/sshd_config - rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" - rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - if [ -d /etc/ssh/sshd_config.d ] ; then - rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" - fi - rlRun "service sshd restart" -} - true <<'=cut' =pod @@ -1384,7 +1371,6 @@ function rlSETranslateBoolean() { staff_exec_content allow_staff_exec_content sysadm_exec_content allow_sysadm_exec_content user_exec_content allow_user_exec_content - virt_use_nfs virt_sandbox_use_nfs xguest_exec_content allow_xguest_exec_content xserver_clients_write_xshm allow_write_xshm xserver_execmem allow_xserver_execmem @@ -1416,59 +1402,41 @@ Limitation: seinfo does not report aliases on RHEL-5 and RHEL-6 now. =cut function rlSETranslateAlias { - local res if rlIsRHEL 5 ; then - rlLogDebug "$FUNCNAME(): RHEL5 - no translation, using $1" echo $1 return 0 elif rlIsRHEL 6 ; then - rlLogDebug "$FUNCNAME(): RHEL6" if seinfo -t$1 2>&1 | grep -q "ERROR:" ; then - rlLogDebug "$FUNCNAME(): got an error - no translation, using $1" echo $1 return 1 elif seinfo -t$1 2>&1 | grep -q " $1" ; then - rlLogDebug "$FUNCNAME(): seinfo confirmed the name - no translation, using $1" echo $1 return 0 - else - rlLogDebug "$FUNCNAME(): the type should be used either as a source or as a target in an allow rule" - res="$(( sesearch -s $1 -A | tr -s ' ' | cut -d ' ' -f 3 ; sesearch -t $1 -A | tr -s ' ' | cut -d ' ' -f 4 ) | sort | uniq | grep "^.*_t$")" - rlLogDebug "$FUNCNAME(): translated name: $res" - echo "$res" + else # the type should be used either as a source or as a target in an allow rule + ( sesearch -s $1 -A | tr -s ' ' | cut -d ' ' -f 3 ; sesearch -t $1 -A | tr -s ' ' | cut -d ' ' -f 4 ) | sort | uniq | grep "^.*_t$" return 0 fi else - rlLogDebug "$FUNCNAME(): RHEL>6 && Fedora" - rlLogDebug "$FUNCNAME(): setools version ${SETOOLS_MAJOR_VERSION}" local seinfo_out seinfo_out="$(seinfo -t$1 2>&1 )" - rlLogDebug "$FUNCNAME(): seinfo_out='$seinfo_out'" if echo "$seinfo_out" | grep -q "ERROR:" ; then - rlLogDebug "$FUNCNAME(): the type was not recognized - no translation, using $1" + # the type was not recognized echo $1 return 1 elif echo "$seinfo_out" | grep -q "TypeName " ; then - rlLogDebug "$FUNCNAME(): translation done using TypeName" - res="$(seinfo -t$1 2>/dev/null | grep TypeName | tr -s ' ' | cut -d ' ' -f 3)" - rlLogDebug "$FUNCNAME(): translated name: $res" - echo "$res" + seinfo -t$1 2>/dev/null | grep TypeName | tr -s ' ' | cut -d ' ' -f 3 return 0 elif echo "$seinfo_out" | grep -q "Types: 0" ; then - rlLogDebug "$FUNCNAME(): # cannot translate alias, if setools v.4 are used then BZ#1581761 - no translation, using $1" + # cannot translate alias, if setools v.4 are used then BZ#1581761 echo $1 return 1 elif [[ ${SETOOLS_MAJOR_VERSION} == "4" ]] ; then - rlLogDebug "$FUNCNAME(): translation done using seinfo v.4 parsing" - res="$(seinfo -t$1 2>/dev/null | tail -n 1 | tr -s ' ' | cut -d ' ' -f 2)" - rlLogDebug "$FUNCNAME(): translated name: $res" - echo "$res" + # setools v.4 + seinfo -t$1 2>/dev/null | tail -n 1 | tr -s ' ' | cut -d ' ' -f 2 return 0 else - rlLogDebug "$FUNCNAME(): translation done using seinfo v.3 parsing" - res="$(seinfo -t$1 2>/dev/null | head -n 1 | tr -s ' ' | cut -d ' ' -f 2)" - rlLogDebug "$FUNCNAME(): translated name: $res" - echo "$res" + # setools v.3 + seinfo -t$1 2>/dev/null | head -n 1 | tr -s ' ' | cut -d ' ' -f 2 return 0 fi fi @@ -1495,7 +1463,7 @@ function rlSEListServices() { SERVICES_ARRAY[21]='vsftpd proftpd pure-ftpd lighttpd' # FTP servers SERVICES_ARRAY[25]='exim postfix sendmail' # SMTP servers - SERVICES_ARRAY[53]='named named-sdb unbound yadifad nsd pdns systemd-resolved dnsmasq' # DNS servers + SERVICES_ARRAY[53]='named named-sdb unbound yadifad nsd pdns' # DNS servers SERVICES_ARRAY[80]='httpd cherokee lighttpd nginx thttpd' # HTTP servers SERVICES_ARRAY[123]='ntpd chronyd' # NTP servers @@ -1528,46 +1496,7 @@ function rlSESetEnforce() { } -true <<'=cut' -=pod -=head2 rlSESatisfyRequires - -The function attempts to install all packages required in Makefile and all packa -ges given as arguments. -The function will be used to install packages from any repository we want. - -=cut - -function rlSESatisfyRequires() { - local FILE_NAME="./Makefile" - local PACKAGE_LIST - local PACKAGE_LIST2 - - if [ "x$COLLECTIONS" != "x" ] ; then - # do not install any packages when running in RHSCL environment - # because that would most likely break the environment or fail - return - fi - - which yum >& /dev/null - if [ $? -ne 0 ] ; then - rlLog "The yum is not present. Don't know how to install required packages." - return - fi - - if [ $# -gt 0 ] ; then - PACKAGE_LIST2="$*" - fi - PACKAGE_LIST=`grep '"Requires:' ${FILE_NAME} | cut -d : -f 2 | cut -d '"' -f 1 | tr '\n' ' ' | tr -s ' '` - # check if all required packages are really installed - if rpm -q ${PACKAGE_LIST} ${PACKAGE_LIST2} >& /dev/null ; then - rlPass "all required packages are really installed" - return 0 - fi - - rlRun "epelyum install -y --nobest --nogpgcheck --skip-broken ${PACKAGE_LIST} ${PACKAGE_LIST2}" 0,1 -} __INTERNAL_rlSEModuleList() { local semodule_list @@ -1813,7 +1742,7 @@ __INTERNAL_rlSEenable_full_auditing() { fi local final_rules=/etc/audit/audit.rules local config_file=/etc/audit/auditd.conf - local auditd_need_restart=1 + local auditd_need_restart=0 local rules="-D"$'\n'"-w /etc/shadow -p w" local res=0 if ! diff -u <(grep -v -e '^$' -e '^#' $final_rules) <(echo "$rules") > /dev/null; then @@ -1839,7 +1768,7 @@ __INTERNAL_rlSEenable_full_auditing() { } [[ $auditd_need_restart -eq 1 ]] && { rlLog "stop the audit daemon first" - rlRun "service auditd stop" 0,2 + rlRun "service auditd stop" sleep 5 rlLog "audit daemon configuration file is updated, starting the audit service" rlServiceStart auditd || { @@ -1972,98 +1901,11 @@ __INTERNAL_rlSEcache_sesearch() { esac } - rlSELibraryLoaded() { - __INTERNAL_SEMODULE_LISTING="semodule -lfull" - local tmp - eval tmp="\$($__INTERNAL_SEMODULE_LISTING 2>&1 )" - if [[ "$tmp" =~ invalid\ option ]]; then - __INTERNAL_SEMODULE_LISTING='semodule -l' - fi - rlLogInfo "SELinux: using '$__INTERNAL_SEMODULE_LISTING' to list modules" - __INTERNAL_POLICY_NAME="$(sestatus | grep -i 'Loaded policy name' | sed -r 's/.*:\s*([^:]+)\s*/\1/')" - __INTERNAL_POLICY_NAME="${__INTERNAL_POLICY_NAME:-$(sestatus | grep -i 'Policy from config file' | sed -r 's/.*:\s*([^:]+)\s*/\1/')}" - __INTERNAL_POLICY_NAME="${__INTERNAL_POLICY_NAME:-targeted}" - __INTERNAL_POLICY_ROOT="$(sestatus | grep -i 'SELinux root directory' | sed -r 's/.*:\s*([^:]+)\s*/\1/')" - __INTERNAL_POLICY_ROOT="${__INTERNAL_POLICY_ROOT:-/etc/selinux}" - __INTERNAL_POLICY_PATH="$__INTERNAL_POLICY_ROOT/$__INTERNAL_POLICY_NAME" - __INTERNAL_POLICY_FILE="$__INTERNAL_POLICY_PATH/policy/policy.$(ls -1 -d $__INTERNAL_POLICY_PATH/policy/policy.* | sed -r 's/[^.]*\.//' | sort -nr | head -n 1)" - __INTERNAL_POLICY_STORE_ROOT="/var/lib/selinux" - rlIsRHEL '<8' && __INTERNAL_POLICY_STORE_ROOT="/etc/selinux" - export rlSEpolicyRoot="$__INTERNAL_POLICY_ROOT" - export rlSEstoreRoot="$__INTERNAL_POLICY_STORE_ROOT" - export rlSEpolicyName="$__INTERNAL_POLICY_NAME" - rlLogInfo "Running with policy located in $__INTERNAL_POLICY_FILE" - if rlIsRHEL 4 5; then - rlSE_REQUIRES="setools expect policycoreutils" - elif rlIsRHEL 6 ; then - rlSE_REQUIRES="setools-console expect policycoreutils-python" - elif rlIsRHEL 7 ; then - rlSE_REQUIRES="setools-console expect policycoreutils-python selinux-policy-devel" - elif rlIsRHEL 8 9 || rlIsCentOS 8 9 ; then - rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel" - else - rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel audit-rules" - fi - - # make sure that these directories exist in home directories of - # tested users since the time they were created - rlRun "mkdir -p /etc/skel/.{cache,config,local}" - - # make sure the /etc directory is labeled correctly - rlRun "restorecon -Rv /etc" - - __INTERNAL_rlSEenable_full_auditing - - local t=$(date +%s) - rlLogInfo "SELinux related packages listing:" - rlLogInfo "$(rpm -qa | grep -e ^selinux-policy -e ^libsemanage -e ^policycoreutils -e ^setools -e ^libselinux -e ^libsepol -e ^checkpolicy -e ^mcstrans -e ^setroubleshoot | sort | sed 's/^/ /')" - rlLogInfo " listing took $(($(date +%s)-$t)) second(s)" - - if rlCheckRequirements $rlSE_REQUIRES; then - SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` - rlLogDebug "FUNCNAME(): sesearch --version: $(sesearch --version 2>&1)" - rlLogDebug "FUNCNAME(): SETOOLS_MAJOR_VERSION=$SETOOLS_MAJOR_VERSION" - rlLogDebug "rlSE Library: Requires installed." - return 0 - fi - - if rlIsRHEL 7 ; then - if uname -r | grep -q x86_64 ; then - local LIBSEPOL_VER_REL=`rpm -q --queryformat "%{version},%{release}" libsepol` - local LIBSELINUX_VER_REL=`rpm -q --queryformat "%{version},%{release}" libselinux` - local SETOOLS_VER_REL=`rpm -q --queryformat "%{version},%{release}" setools-libs` - # remove all i686 setools* packages - rlRun "yum -y remove setools\*.i686" - # install necessary packages - rlRun "yum -y install setools-libs setools-console libsepol libselinux libselinux-python libselinux-utils -x \*.i686" 0,1 - fi - fi - - if rlIsRHEL; then - rlRun "yum install -y --skip-broken $rlSE_REQUIRES" - else - rlRun "dnf install -y --skip-broken $rlSE_REQUIRES" - fi - - # make sure that restorecon does not change SELinux contexts under /var/ARTIFACTS - # otherwise SELinux context of backed up files/directories will be affected - if matchpathcon /var/ARTIFACTS/something | grep -q :var_t: ; then - semanage fcontext -a -e /proc /var/ARTIFACTS - fi - - if rlCheckRequirements $rlSE_REQUIRES; then - SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` - rlLogDebug "FUNCNAME(): sesearch --version: $(sesearch --version 2>&1)" - rlLogDebug "FUNCNAME(): SETOOLS_MAJOR_VERSION=$SETOOLS_MAJOR_VERSION" - rlLogDebug "rlSE Library: Requires installed." - return 0 - fi - - rlLogError "rlSE Library: Not all required packages installed." - return 1 + return 0 } + # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Authors # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/selinux-policy/Library/common/main.fmf b/selinux-policy/Library/common/main.fmf deleted file mode 100644 index e7dfd5f..0000000 --- a/selinux-policy/Library/common/main.fmf +++ /dev/null @@ -1,15 +0,0 @@ -summary: selinux-policy Beakerlib library -require: -- type: library - url: https://github.com/beakerlib/epel.git - name: /epel -recommend: -- audit -- setools-console -- expect -- policycoreutils -- /usr/sbin/semanage -- selinux-policy-devel -- yum-utils -- python3 -- sqlite diff --git a/selinux-policy/Library/common/runtest.sh b/selinux-policy/Library/common/runtest.sh index 9f2f5a9..46d5d95 100755 --- a/selinux-policy/Library/common/runtest.sh +++ b/selinux-policy/Library/common/runtest.sh @@ -3,6 +3,7 @@ # This is a test file # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh list_booleans() { @@ -16,9 +17,7 @@ rlIsRHEL 5 && { rlJournalStart rlPhaseStartSetup - rlRun "rlImport selinux-policy/common" 0,1 - rlRun "uname -a" - rlRun "sestatus" + rlRun "rlImport selinux-policy/common" rlPhaseEnd rlPhaseStartTest "rlSEBoolean test" @@ -179,7 +178,7 @@ rlJournalStart rlSESearchRule "allow unconfined_t smbcontrol_t : fd use mls" 1 rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write }" rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write } [ rsync_client ]" 1 - rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write } [ ftpd_anon_write ]" 0 + rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write } [ allow_ftpd_anon_write ]" 0 rlPhaseEnd if rlIsRHEL '>=8'; then diff --git a/selinux-policy/ModemManager-and-similar/Makefile b/selinux-policy/ModemManager-and-similar/Makefile deleted file mode 100644 index e1470f1..0000000 --- a/selinux-policy/ModemManager-and-similar/Makefile +++ /dev/null @@ -1,85 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/ModemManager-and-similar -# Description: SELinux interferes with ModemManager and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/ModemManager-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with ModemManager and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: ModemManager" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 ModemManager /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) - @echo "Bug: 1120152" >> $(METADATA) # RHEL-7 - @echo "Bug: 1362273" >> $(METADATA) # RHEL-7 - @echo "Bug: 1365214" >> $(METADATA) # RHEL-7 - @echo "Bug: 1676810" >> $(METADATA) # RHEL-7 - @echo "Bug: 1697868" >> $(METADATA) # RHEL-7 - @echo "Bug: 1961571" >> $(METADATA) # Fedora 35 - @echo "Bug: 1996903" >> $(METADATA) # Fedora 35 - @echo "Bug: 1996905" >> $(METADATA) # Fedora 35 - @echo "Bug: 2000196" >> $(METADATA) # RHEL-9 - @echo "Bug: 2001141" >> $(METADATA) # Fedora 35 - @echo "Bug: 2001143" >> $(METADATA) # Fedora 35 - @echo "Bug: 2001144" >> $(METADATA) # Fedora 35 - @echo "Bug: 2001145" >> $(METADATA) # Fedora 35 - @echo "Bug: 2036582" >> $(METADATA) # RHEL-9 - @echo "Bug: 2145005" >> $(METADATA) # Fedora 36 - @echo "Bug: 2149560" >> $(METADATA) # RHEL-9 - @echo "Bug: 2149954" >> $(METADATA) # Fedora 37 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/ModemManager-and-similar/PURPOSE b/selinux-policy/ModemManager-and-similar/PURPOSE deleted file mode 100644 index ee44526..0000000 --- a/selinux-policy/ModemManager-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/ModemManager-and-similar -Author: Milos Malik - -SELinux interferes with ModemManager and related programs. - diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf deleted file mode 100644 index 3157e2f..0000000 --- a/selinux-policy/ModemManager-and-similar/main.fmf +++ /dev/null @@ -1,63 +0,0 @@ -summary: SELinux interferes with ModemManager and related programs -description: |+ - SELinux interferes with ModemManager and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - glib2 - - ModemManager - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1120152 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1362273 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1365214 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1676810 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697868 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961571 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1996903 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1996905 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2000196 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001141 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001143 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001144 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001145 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2036582 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2145005 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149560 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149954 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0075515 -extra-summary: /CoreOS/selinux-policy/Regression/ModemManager-and-similar -extra-task: /CoreOS/selinux-policy/Regression/ModemManager-and-similar -id: 7caff9dc-87ff-4e55-ad78-32312f7f1c99 diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh deleted file mode 100755 index 266f354..0000000 --- a/selinux-policy/ModemManager-and-similar/runtest.sh +++ /dev/null @@ -1,153 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/ModemManager-and-similar -# Description: SELinux interferes with ModemManager and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -if rlIsRHEL 6 ; then - FILE_PATH="/usr/sbin/modem-manager" - PROCESS_NAME="modem-manager" -else - FILE_PATH="/usr/sbin/ModemManager" - PROCESS_NAME="ModemManager" -fi -FILE_CONTEXT="modemmanager_exec_t" -SERVICE_PACKAGE="ModemManager" -SERVICE_NAME="ModemManager" -PROCESS_CONTEXT="modemmanager_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="system_dbusd_t" # D-bus daemon runs the process - else # RHEL-7 etc. - for SOURCE_TYPE in system_dbusd_t init_t ; do - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition }" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" - done - fi - rlPhaseEnd - - DESTINATION="org.freedesktop.ModemManager1" - if busctl | grep -iq ${DESTINATION} ; then - rlPhaseStartTest "real scenario -- DBus service" - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" 0,1 - sleep 1 - rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" - rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1120152" - rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" - rlSESearchRule "allow modemmanager_t modemmanager_t : unix_stream_socket { connectto }" - rlPhaseEnd - - rlPhaseStartTest "bz#1362273 + bz#1365214" - rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" - rlSEMatchPathCon "/run/systemd/inhibit/7.ref" "systemd_logind_inhibit_var_run_t" - rlSESearchRule "allow modemmanager_t systemd_logind_t : dbus { send_msg }" - rlSESearchRule "allow systemd_logind_t modemmanager_t : dbus { send_msg }" - rlSESearchRule "allow modemmanager_t systemd_logind_inhibit_var_run_t : fifo_file { write }" - rlPhaseEnd - - rlPhaseStartTest "bz#1676810 + bz#1697868" - rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" - rlSESearchRule "allow modemmanager_t sysfs_t : file { append write } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - sleep 1 - rlRun "service systemd-logind restart" - sleep 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - if ! rlIsRHEL 6 7 8 && ! rlIsCentOS 6 7 8 ; then - rlPhaseStartTest "bz#1996903 + bz#1996905 + bz#2001141 + bz#2001143 + bz#2001144 + bz#2001145 + bz#2036582" - rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" - rlSESearchRule "allow modemmanager_t modemmanager_t : qipcrtr_socket { create getattr getopt } [ ]" - rlSESearchRule "allow modemmanager_t kernel_t : system { module_request } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1961571 + bz#2000196" - rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" - rlSEMatchPathCon "/dev/wwan0p1QCDM" "modem_device_t" - rlSEMatchPathCon "/dev/wwan0p2MBIM" "modem_device_t" - rlRun "semanage fcontext -l | grep '^/dev/wwan.*char.*modem_device_t'" - rlSESearchRule "allow modemmanager_t modem_device_t : chr_file { getattr open read write ioctl } [ ]" - rlSESearchRule "allow modemmanager_t unconfined_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2145005 + bz#2149560 + bz#2149954" - rlSESearchRule "allow modemmanager_t modemmanager_t : netlink_route_socket { create getopt getattr nlmsg_write } [ ]" - rlSESearchRule "allow modemmanager_t sysfs_t : dir { write add_name } [ ]" - rlSESearchRule "allow modemmanager_t sysfs_t : file { create } [ ]" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlFileRestore - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/abrt-services/Makefile b/selinux-policy/abrt-services/Makefile deleted file mode 100644 index 1984edd..0000000 --- a/selinux-policy/abrt-services/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/abrt-services -# Description: SELinux interferes with various ABRT services -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/abrt-services -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with various ABRT services" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: abrt" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console psmisc abrt abrt-addon-ccpp abrt-addon-coredump-helper abrt-addon-kerneloops abrt-addon-pstoreoops abrt-addon-upload-watch abrt-addon-vmcore abrt-addon-xorg /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL9" >> $(METADATA) - @echo "Bug: 2274709" >> $(METADATA) # Fedora 40 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/abrt-services/PURPOSE b/selinux-policy/abrt-services/PURPOSE deleted file mode 100644 index 0416559..0000000 --- a/selinux-policy/abrt-services/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/abrt-services -Author: Milos Malik - -SELinux interferes with various ABRT services. - diff --git a/selinux-policy/abrt-services/main.fmf b/selinux-policy/abrt-services/main.fmf deleted file mode 100644 index d58ecaf..0000000 --- a/selinux-policy/abrt-services/main.fmf +++ /dev/null @@ -1,54 +0,0 @@ -summary: SELinux interferes with various ABRT services -description: |+ - SELinux interferes with various ABRT services - -contact: Milos Malik -component: - - abrt - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - psmisc - - abrt - - abrt-addon-ccpp - - abrt-addon-coredump-helper - - abrt-addon-kerneloops - - abrt-addon-pstoreoops - - abrt-addon-upload-watch - - abrt-addon-vmcore - - abrt-addon-xorg - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL9 - - targeted - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2274709 -adjust+: - - enabled: false - when: distro >= rhel-9 - because: the abrt* packages are not available there - - enabled: false - when: distro >= centos-stream-9 - because: the abrt* packages are not available there -extra-summary: /CoreOS/selinux-policy/Regression/abrt-services -extra-task: /CoreOS/selinux-policy/Regression/abrt-services -extra-nitrate: TC#0617419 -id: ca742967-9ac5-4f16-be93-d95eb7932224 diff --git a/selinux-policy/abrt-services/runtest.sh b/selinux-policy/abrt-services/runtest.sh deleted file mode 100755 index abc6c85..0000000 --- a/selinux-policy/abrt-services/runtest.sh +++ /dev/null @@ -1,81 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/abrt-services -# Description: SELinux interferes with various ABRT services -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -qa | grep abrt | sort" - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlIsFedora ; then - rlPhaseStartTest "bz#2274709" - rlSEMatchPathCon "/usr/bin/abrt-dump-journal-core" "abrt_dump_oops_exec_t" - rlSEMatchPathCon "/run/systemd/userdb/io.systemd.DynamicUser" "systemd_userdbd_runtime_t" - rlSEMatchPathCon "/run/systemd/userdb/io.systemd.DropIn" "systemd_userdbd_runtime_t" - rlSEMatchPathCon "/run/systemd/userdb/io.systemd.Home" "systemd_userdbd_runtime_t" - rlSESearchRule "allow abrt_dump_oops_t systemd_userdbd_runtime_t : sock_file { write } [ ]" - rlSESearchRule "allow abrt_dump_oops_t systemd_userdbd_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow abrt_dump_oops_t init_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - fi - - if rpm -qa | grep -q abrt ; then - rlPhaseStartTest "real scenario -- bz#2274709" - for SERVICE_NAME in abrtd abrt-journal-core abrt-oops abrt-pstoreoops abrt-upload-watch abrt-vmcore abrt-xorg ; do - rlRun "service ${SERVICE_NAME} start" - done - sleep 60 & - sleep 10 - rlRun "killall --signal SIGABRT sleep" - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 - for SERVICE_NAME in abrtd abrt-journal-core abrt-oops abrt-pstoreoops abrt-upload-watch abrt-vmcore abrt-xorg ; do - rlRun "service ${SERVICE_NAME} stop" - done - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/accounts-daemon-and-similar/Makefile b/selinux-policy/accounts-daemon-and-similar/Makefile deleted file mode 100644 index 249d054..0000000 --- a/selinux-policy/accounts-daemon-and-similar/Makefile +++ /dev/null @@ -1,92 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar -# Description: SELinux interferes with accounts daemon and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/accounts-daemon-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with accounts daemon and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: accountsservice" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console accountsservice glib2 procps-ng realmd initscripts gdm" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5 -RHEL6" >> $(METADATA) - @echo "Bug: 1456760" >> $(METADATA) # RHEL-7 - @echo "Bug: 1507089" >> $(METADATA) # RHEL-7 - @echo "Bug: 1518211" >> $(METADATA) # RHEL-7 - @echo "Bug: 1595667" >> $(METADATA) # RHEL-7 - @echo "Bug: 1792895" >> $(METADATA) # RHEL-8 - @echo "Bug: 1806126" >> $(METADATA) # Fedora 32 - @echo "Bug: 1811407" >> $(METADATA) # Fedora 32 - @echo "Bug: 1815312" >> $(METADATA) # Fedora 32 - @echo "Bug: 1818696" >> $(METADATA) # Fedora 32 - @echo "Bug: 1819040" >> $(METADATA) # Fedora 32 - @echo "Bug: 1820978" >> $(METADATA) # Fedora 32 - @echo "Bug: 1820992" >> $(METADATA) # Fedora 32 - @echo "Bug: 1821156" >> $(METADATA) # RHEL-8 - @echo "Bug: 1828809" >> $(METADATA) # RHEL-8 - @echo "Bug: 1829013" >> $(METADATA) # Fedora 32 - @echo "Bug: 1829075" >> $(METADATA) # Fedora 32 - @echo "Bug: 1829128" >> $(METADATA) # Fedora 32 - @echo "Bug: 1928546" >> $(METADATA) # Fedora 34 - @echo "Bug: 1928565" >> $(METADATA) # Fedora 34 - @echo "Bug: 1928567" >> $(METADATA) # Fedora 34 - @echo "Bug: 1933687" >> $(METADATA) # Fedora 34 - @echo "Bug: 1933842" >> $(METADATA) # RHEL-9 - @echo "Bug: 1934573" >> $(METADATA) # Fedora 34 - @echo "Bug: 1935232" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/accounts-daemon-and-similar/PURPOSE b/selinux-policy/accounts-daemon-and-similar/PURPOSE deleted file mode 100644 index 24bd6f7..0000000 --- a/selinux-policy/accounts-daemon-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar -Author: Milos Malik - -SELinux interferes with accounts daemon and related programs. - diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf deleted file mode 100644 index 0a9bd58..0000000 --- a/selinux-policy/accounts-daemon-and-similar/main.fmf +++ /dev/null @@ -1,77 +0,0 @@ -summary: SELinux interferes with accounts daemon and related programs -description: |+ - SELinux interferes with accounts daemon and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - accountsservice - - glib2 - - procps-ng - - realmd - - initscripts - - gdm -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass - - TIPpass_Security - - TierCandidatesPASS - - targeted - - NoRHIVOS -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1456760 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1507089 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1518211 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595667 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1792895 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1806126 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1811407 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1815312 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1818696 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1819040 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1820978 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1820992 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1821156 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1828809 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829013 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829075 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829128 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928546 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928565 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928567 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933687 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933842 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934573 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1935232 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false - - enabled: false - when: arch == aarch64, s390x - continue: false -extra-nitrate: TC#0075208 -extra-summary: /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar -extra-task: /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar -id: 553e648e-a295-4739-8e36-12a4f67a903c diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh deleted file mode 100755 index f658bad..0000000 --- a/selinux-policy/accounts-daemon-and-similar/runtest.sh +++ /dev/null @@ -1,158 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar -# Description: SELinux interferes with accounts daemon and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/libexec/accounts-daemon" -FILE_CONTEXT="accountsd_exec_t" -SERVICE_PACKAGE="accountsservice" -SERVICE_NAME="accounts-daemon" -PROCESS_NAME="accounts-daemon" -PROCESS_CONTEXT="accountsd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" # a boolean name - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition }" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" - rlPhaseEnd - - rlPhaseStartTest "bz#1456760 + bz#1518211" - rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" - rlSEMatchPathCon "/root" "admin_home_t" - rlSESearchRule "dontaudit accountsd_t admin_home_t : dir { write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1507089" - rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" - rlSESearchRule "allow accountsd_t accountsd_t : capability { dac_read_search } [ ]" - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1595667" - rlSEMatchPathCon "/usr/sbin/useradd" "useradd_exec_t" - rlSESearchRule "allow accountsd_t useradd_exec_t : file { map } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1792895 + bz#1821156" - rlSESearchRule "allow accountsd_t realmd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow realmd_t accountsd_t : dbus { send_msg } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1828809" - for USER_TYPE in user_t staff_t sysadm_t xguest_t unconfined_t ; do - rlSESearchRule "allow ${USER_TYPE} accountsd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow accountsd_t ${USER_TYPE} : dbus { send_msg } [ ]" - done - rlPhaseEnd - fi - - DESTINATION="org.freedesktop.Accounts" - if busctl | grep -iq ${DESTINATION} ; then - rlPhaseStartTest "real scenario -- DBus service" - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" - sleep 1 - rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" - rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" - rlPhaseEnd - fi - - if rlIsFedora ; then - rlPhaseStartTest "bz#1806126, bz#1811407, bz#1815312, bz#1818696, bz#1819040, bz#1820978, bz#1820992, bz#1829013, bz#1829075, bz#1829128" - rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" - rlSESearchRule "dontaudit accountsd_t accountsd_t : capability { sys_nice } [ daemons_dontaudit_scheduling ]" - rlPhaseEnd - fi - - if seinfo --common file -x | grep -q watch ; then - rlPhaseStartTest "bz#1928546 + bz#1933842 + bz#1935232" - rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" - rlSEMatchPathCon "/etc/gdm" "xdm_etc_t" - rlSESearchRule "allow accountsd_t xdm_etc_t : dir { watch } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlRun "mkdir -p /etc/gdm" - rlRun "restorecon -Rv /etc" - rlRun "service realmd start" # helps to reproduce BZ#1792895 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/acpid-and-similar/Makefile b/selinux-policy/acpid-and-similar/Makefile deleted file mode 100644 index b7df294..0000000 --- a/selinux-policy/acpid-and-similar/Makefile +++ /dev/null @@ -1,75 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/acpid-and-similar -# Description: SELinux interferes with acpid and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/acpid-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with acpid and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 30m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: acpid" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console acpid /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Architectures: i386 x86_64" >> $(METADATA) - @echo "Bug: 995898" >> $(METADATA) # RHEL-7 - @echo "Bug: 1358478" >> $(METADATA) # RHEL-7 - @echo "Bug: 1468548" >> $(METADATA) # RHEL-7 - @echo "Bug: 1622417" >> $(METADATA) # RHEL-7 - @echo "Bug: 1623342" >> $(METADATA) # RHEL-7 - @echo "Bug: 1932294" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/acpid-and-similar/PURPOSE b/selinux-policy/acpid-and-similar/PURPOSE deleted file mode 100644 index e4b9ffe..0000000 --- a/selinux-policy/acpid-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/acpid-and-similar -Author: Milos Malik - -SELinux interferes with acpid and related programs - diff --git a/selinux-policy/acpid-and-similar/main.fmf b/selinux-policy/acpid-and-similar/main.fmf deleted file mode 100644 index 21a6880..0000000 --- a/selinux-policy/acpid-and-similar/main.fmf +++ /dev/null @@ -1,54 +0,0 @@ -summary: SELinux interferes with acpid and related programs -description: |+ - SELinux interferes with acpid and related programs - -contact: Milos Malik -component: - - selinux-policy - - acpid -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - acpid - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 30m -enabled: true -tag: - - NoRHEL4 - - TIPpass - - TIPpass_Security - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=995898 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358478 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1468548 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1622417 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1623342 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932294 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919167 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false - - enabled: false - when: arch == ia64, ppc64, ppc64le, s390, s390x - continue: false -extra-nitrate: TC#0075209 -extra-summary: /CoreOS/selinux-policy/Regression/acpid-and-similar -extra-task: /CoreOS/selinux-policy/Regression/acpid-and-similar -id: beec2e51-5acf-4d66-aa05-dc183fbb7b46 diff --git a/selinux-policy/acpid-and-similar/runtest.sh b/selinux-policy/acpid-and-similar/runtest.sh deleted file mode 100755 index 5059ee2..0000000 --- a/selinux-policy/acpid-and-similar/runtest.sh +++ /dev/null @@ -1,134 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/acpid-and-similar -# Description: SELinux interferes with acpid and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/acpid" -FILE_CONTEXT="apmd_exec_t" -SERVICE_PACKAGE="acpid" -SERVICE_NAME="acpid" -PROCESS_NAME="acpid" -PROCESS_CONTEXT="apmd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSESearchRule "allow initrc_t ${FILE_CONTEXT} : file { getattr open read execute }" - rlSESearchRule "allow initrc_t ${PROCESS_CONTEXT} : process { transition }" - rlSESearchRule "type_transition initrc_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#995898" - rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" - rlSEMatchPathCon "/usr/lib/systemd/system/poweroff.target" "power_unit_file_t" - rlSESearchRule "allow apmd_t init_t : dbus { send_msg }" - rlSESearchRule "allow init_t apmd_t : dbus { send_msg }" - rlSESearchRule "allow apmd_t power_unit_file_t : service { start }" - rlPhaseEnd - - rlPhaseStartTest "bz#1358478 + bz#1468548" - rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" - rlSESearchRule "allow apmd_t apmd_t : netlink_generic_socket { create setopt bind } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1622417 + bz#1623342" - rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" - rlSEMatchPathCon "/dev/input/event20" "event_device_t" - rlSEMatchPathCon "/dev/input/event21" "event_device_t" - rlSEMatchPathCon "/dev/input/event22" "event_device_t" - rlSEMatchPathCon "/dev/input/event23" "event_device_t" - rlSEMatchPathCon "/dev/input/event24" "event_device_t" - rlSEMatchPathCon "/dev/input/event25" "event_device_t" - rlSEMatchPathCon "/dev/input/event26" "event_device_t" - rlSEMatchPathCon "/dev/input/event27" "event_device_t" - rlSEMatchPathCon "/dev/input/event28" "event_device_t" - rlSEMatchPathCon "/dev/input/event29" "event_device_t" - rlSEMatchPathCon "/dev/input/event30" "event_device_t" - rlSESearchRule "allow apmd_t event_device_t : chr_file { getattr open read } [ ]" - for I in `seq 20 1 30` ; do - rlRun "sesearch -T -s init_t -t device_t -c chr_file | grep \"event_device_t.*event$I\"" - rlRun "sesearch -T -s kernel_t -t device_t -c chr_file | grep \"event_device_t.*event$I\"" - rlRun "sesearch -T -s udev_t -t device_t -c chr_file | grep \"event_device_t.*event$I\"" - done - rlPhaseEnd - fi - - if seinfo --common file -x | grep -q watch ; then - rlPhaseStartTest "bz#1932294" - rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" - rlSEMatchPathCon "/dev/input" "device_t" - rlSESearchRule "allow apmd_t device_t : dir { watch } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile deleted file mode 100644 index 80b8415..0000000 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ /dev/null @@ -1,78 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/anon_inode-and-similar -# Description: Upstream coverage for SELinux issues with anon_inode tclass. -# Author: Author: Amith Kumar -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/anon_inode-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE reproducer.c - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Amith Kumar " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux AVC issues related to anon_inode tclass policies." >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 30m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers setools-console audit fio grubby stress-ng" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Architectures: aarch64 ppc64le x86_64" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 1954145" >> $(METADATA) # RHEL-9 - @echo "Bug: 1974559" >> $(METADATA) - @echo "Bug: 2027660" >> $(METADATA) # RHEL-9 - @echo "Bug: 2025714" >> $(METADATA) # Fedora 35 - @echo "Bug: 2187745" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-11792" >> $(METADATA) # RHEL-9 - @echo "Bug: 2270895" >> $(METADATA) # Fedora 41 - @echo "Bug: RHEL-60837" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-116154" >> $(METADATA) # RHEL-10 - @echo "Bug: RHELTEST-2022" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/anon_inode-and-similar/PURPOSE b/selinux-policy/anon_inode-and-similar/PURPOSE deleted file mode 100644 index 3267a57..0000000 --- a/selinux-policy/anon_inode-and-similar/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/anon_inode-and-similar -Author: Amith Kumar - -SELinux denials affect processes that deals with anon_inode and io_uring classes. diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf deleted file mode 100644 index 47dbdcf..0000000 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ /dev/null @@ -1,59 +0,0 @@ -summary: SELinux AVC issues related to anon_inode tclass policies. -description: | - SELinux denials affect processes that deals with anon_inode tclass. -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - libselinux - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - gcc - - glibc-headers - - setools-console - - audit - - fio - - grubby - - stress-ng -environment: - AVC_ERROR: +no_avc_check -duration: 30m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - reboot - - rhel9_broken - - rhel10_broken - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954145 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027660 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2025714 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187745 - - verifies: https://issues.redhat.com/browse/RHEL-11792 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270895 - - verifies: https://issues.redhat.com/browse/RHEL-60837 - - verifies: https://issues.redhat.com/browse/RHEL-116154 - - verifies: https://issues.redhat.com/browse/RHELTEST-2022 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - because: the anon_inode class is not defined there - - enabled: false - when: arch == s390, s390x - because: the automated test gets stuck there -extra-nitrate: TC#0612643 -extra-summary: /CoreOS/selinux-policy/Regression/anon_inode-and-similar -extra-task: /CoreOS/selinux-policy/Regression/anon_inode-and-similar -id: 4e70e1ec-d3ae-40df-aad6-dfc4a23bc081 diff --git a/selinux-policy/anon_inode-and-similar/reproducer.c b/selinux-policy/anon_inode-and-similar/reproducer.c deleted file mode 100644 index 9759c2c..0000000 --- a/selinux-policy/anon_inode-and-similar/reproducer.c +++ /dev/null @@ -1,84 +0,0 @@ -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -static void test_assert(int cond) { - if (!cond) { - abort(); - } -} - -static void do_child(int sock) { - int fd; - struct msghdr msg; - char mbuf; - struct iovec iov = { &mbuf, 1 }; - char cbuf[CMSG_SPACE(sizeof(fd))]; - const struct cmsghdr* cmsg; - - memset(&msg, 0, sizeof(msg)); - msg.msg_iov = &iov; - msg.msg_iovlen = 1; - msg.msg_control = cbuf; - msg.msg_controllen = sizeof(cbuf); - - test_assert(recvmsg(sock, &msg, 0) == 1); - test_assert(mbuf == 'x'); - - test_assert(!(msg.msg_flags & MSG_CTRUNC)); - test_assert(msg.msg_controllen == CMSG_SPACE(sizeof(fd))); - cmsg = CMSG_FIRSTHDR(&msg); - test_assert(SOL_SOCKET == cmsg->cmsg_level && SCM_RIGHTS == cmsg->cmsg_type); - memcpy(&fd, CMSG_DATA(cmsg), sizeof(fd)); - - printf("fd=%d\n", fd); -} - -#define USER_MODE_ONLY 1 - -int main(void) { - int sockfds[2]; - pid_t child; - int fd; - struct msghdr msg; - struct iovec iov = { "x", 1 }; - char cbuf[CMSG_SPACE(sizeof(fd))]; - struct cmsghdr* cmsg; - ssize_t nsent; - int status; - - test_assert(0 == socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds)); - - if (0 == (child = fork())) { - do_child(sockfds[1]); - return 0; - } - - fd = syscall(SYS_userfaultfd, USER_MODE_ONLY); - test_assert(fd >= 0); - - memset(&msg, 0, sizeof(msg)); - msg.msg_iov = &iov; - msg.msg_iovlen = 1; - msg.msg_control = cbuf; - msg.msg_controllen = sizeof(cbuf); - cmsg = CMSG_FIRSTHDR(&msg); - cmsg->cmsg_level = SOL_SOCKET; - cmsg->cmsg_type = SCM_RIGHTS; - cmsg->cmsg_len = CMSG_LEN(sizeof(fd)); - memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd)); - - test_assert(sendmsg(sockfds[0], &msg, 0) == 1); - - test_assert(child == waitpid(child, &status, 0)); - test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); - - return 0; -} diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh deleted file mode 100755 index 0732ea1..0000000 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ /dev/null @@ -1,122 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/anon_inode-and-similar -# Description: Test coverage for cases verifying avc denial issues related to anon_inode tclass. -# Author: Amith Kumar -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -if rlIsRHEL 9 || rlIsCentOS 9 ; then - if ! grep io_uring /proc/cmdline ; then - grubby --update-kernel ALL --args io_uring.enable=y - grubby --update-kernel ALL --args sysctl.kernel.io_uring_disabled=0 - sync - tmt-reboot - fi -fi - -PACKAGE="selinux-policy" - -rlJournalStart - if ! seinfo -c anon_inode | grep -q anon_inode ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm gcc - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1954145" - rlRun "seinfo -c | grep anon_inode" - rlRun "seinfo -c anon_inode -x" - rlRun "sesearch -s domain -t domain -c anon_inode -A -ds -dt" - rlPhaseEnd - - rlPhaseStartTest "SELinux policy prevents userfaultfds bz1974559" - rlRun "gcc -o reproducer reproducer.c" - tst_Time="$(date '+%T')" - rlRun "./reproducer" - sleep 3 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 - if rlIsFedora '<=39'; then - rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { write }" - fi - rlRun "rm -f reproducer" - rlPhaseEnd - - rlPhaseStartTest "mmap on io_uring - bz#2025714 + bz#2187745" - if rlIsFedora '<=39' || rlIsCentOS 9 || rlIsRHEL 9 ; then - rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { map } [ ]" - rlSESearchRule "allow svirt_t svirt_t : anon_inode { map } [ ]" - rlSESearchRule "allow virtd_t virtd_t : anon_inode { map } [ ]" - else - rlSESearchRule "allow unconfined_t io_uring_t : anon_inode { create getattr map read write } [ ]" - rlSESearchRule "allow svirt_t io_uring_t : anon_inode { create getattr map read write } [ ]" - rlSESearchRule "allow virtd_t io_uring_t : anon_inode { create getattr map read write } [ ]" - fi - - rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 - rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring_cmd --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 - rlPhaseEnd - - if ! rlIsRHEL "<9.4"; then - rlPhaseStartTest "RHEL-11792" - rlSESearchRule "allow unconfined_t unconfined_t : io_uring { cmd } [ ]" - rlSESearchRule "allow unconfined_service_t unconfined_service_t : io_uring { cmd } [ ]" - rlPhaseEnd - fi - - if seinfo -t | grep -q secretmem_t ; then - rlPhaseStartTest "bz#2270895 + RHEL-60837" - rlSESearchRule "allow unconfined_t secretmem_t : anon_inode { create } [ ]" - rlSESearchRule "allow sysadm_t secretmem_t : anon_inode { create } [ ]" - rlSESearchRule "type_transition unconfined_t unconfined_t : anon_inode secretmem_t [secretmem]" - rlSESearchRule "type_transition sysadm_t sysadm_t : anon_inode secretmem_t [secretmem]" - rlRun "stress-ng --resources 16 --timeout 5 --log-file /dev/null" - rlPhaseEnd - - rlPhaseStartTest "RHEL-116154 + RHELTEST-2022" - rlSESearchRule "allow unconfined_t secretmem_t : anon_inode { map read write } [ ]" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/bgpd-and-similar/Makefile b/selinux-policy/bgpd-and-similar/Makefile deleted file mode 100644 index 4abe755..0000000 --- a/selinux-policy/bgpd-and-similar/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/bgpd-and-similar -# Description: SELinux interferes with bgpd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/bgpd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with bgpd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console openbgpd /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 1830170" >> $(METADATA) # RHEL-8 - @echo "Bug: 2055578" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/bgpd-and-similar/PURPOSE b/selinux-policy/bgpd-and-similar/PURPOSE deleted file mode 100644 index 975ccf4..0000000 --- a/selinux-policy/bgpd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/bgpd-and-similar -Author: Milos Malik - -SELinux interferes with bgpd and related programs - diff --git a/selinux-policy/bgpd-and-similar/main.fmf b/selinux-policy/bgpd-and-similar/main.fmf deleted file mode 100644 index 7524230..0000000 --- a/selinux-policy/bgpd-and-similar/main.fmf +++ /dev/null @@ -1,48 +0,0 @@ -summary: SELinux interferes with bgpd and related programs -description: |+ - SELinux interferes with bgpd and related programs - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - openbgpd - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - epel - - rhel8-epel - - rhel9-epel - - rhel10-epel - - targeted - - NoRHIVOS -tier: 2 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1830170 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2055578 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0613221 -extra-summary: /CoreOS/selinux-policy/Regression/bgpd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/bgpd-and-similar -id: b6f956b3-645b-440b-ac06-f8cdb1f8fe80 diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh deleted file mode 100755 index 7cb5b26..0000000 --- a/selinux-policy/bgpd-and-similar/runtest.sh +++ /dev/null @@ -1,108 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/bgpd-and-similar -# Description: SELinux interferes with bgpd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/sbin/bgpd" -SERVICE_PACKAGE="openbgpd" -SERVICE_NAME="bgpd" -PROCESS_NAME="bgpd" -if rlIsRHEL 9 || rlIsCentOS 9 ; then - FILE_CONTEXT="bin_t" - PROCESS_CONTEXT="unconfined_service_t" -else - FILE_CONTEXT="zebra_exec_t" - PROCESS_CONTEXT="zebra_t" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/bgpd.conf - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1830170 + bz#2055578" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf" - if rlIsRHEL 8 || rlIsCentOS 8 ; then - # work around BZ#1830170 that was closed as WONTFIX - rlRun "chcon -t bin_t /usr/sbin/bgpd" - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - if rlIsRHEL 8 || rlIsCentOS 8 ; then - # work around BZ#1830170 that was closed as WONTFIX - rlRun "restorecon -v /usr/sbin/bgpd" - fi - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/blueman-and-similar/Makefile b/selinux-policy/blueman-and-similar/Makefile deleted file mode 100644 index 633c985..0000000 --- a/selinux-policy/blueman-and-similar/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/blueman-and-similar -# Description: SELinux interferes with blueman* programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/blueman-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with blueman* programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 gtk3 blueman python-cairo pygtk2 /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 1470501" >> $(METADATA) # Fedora - @echo "Bug: 2027044" >> $(METADATA) # Fedora 35 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/blueman-and-similar/PURPOSE b/selinux-policy/blueman-and-similar/PURPOSE deleted file mode 100644 index 585f5a1..0000000 --- a/selinux-policy/blueman-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/blueman-and-similar -Author: Milos Malik - -SELinux interferes with blueman* programs. - diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf deleted file mode 100644 index 11d9759..0000000 --- a/selinux-policy/blueman-and-similar/main.fmf +++ /dev/null @@ -1,47 +0,0 @@ -summary: SELinux interferes with blueman* programs -description: |+ - SELinux interferes with blueman* programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - glib2 - - gtk3 - - blueman - - python-cairo - - pygtk2 - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470501 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2027044 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10 - because: the blueman package is not available there -extra-nitrate: TC#0563638 -extra-summary: /CoreOS/selinux-policy/Regression/blueman-and-similar -extra-task: /CoreOS/selinux-policy/Regression/blueman-and-similar -id: 9466ffdd-be04-4b35-8e65-f866e23fcfad diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh deleted file mode 100755 index a5910b6..0000000 --- a/selinux-policy/blueman-and-similar/runtest.sh +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/blueman-and-similar -# Description: SELinux interferes with blueman* programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/libexec/blueman-mechanism" -FILE_CONTEXT="blueman_exec_t" -SERVICE_PACKAGE="blueman" -SERVICE_NAME="blueman-mechanism" -PROCESS_NAME="blueman-mechanism" -PROCESS_CONTEXT="blueman_t" - -rlJournalStart - if rlIsRHEL ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlRun "mkdir -p -Z ~/.cache" - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1470501" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow blueman_t policykit_t : dbus { send_msg }" - rlSESearchRule "allow policykit_t blueman_t : dbus { send_msg }" - rlPhaseEnd - - DESTINATION="org.blueman.Mechanism" - if busctl | grep -iq ${DESTINATION} ; then - rlPhaseStartTest "real scenario -- DBus service" - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" - sleep 1 - rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" - rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" - rlPhaseEnd - fi - - rlPhaseStartTest "bz#2027044" - rlSEMatchPathCon "/usr/libexec/blueman-mechanism" "blueman_exec_t" - rlSEMatchPathCon "/root/.local/lib/python3.10/site-packages" "gconf_home_t" - rlSESearchRule "allow blueman_t gconf_home_t : dir { read } [ ]" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="initrc_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - PYTHON_VERSION=`python --version | tr -d ' ' | cut -d . -f 1,2 | tr '[:upper:]' '[:lower:]'` - rlRun "mkdir -p ~/.local/lib/${PYTHON_VERSION}/site-packages/" - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/boinc-and-similar/Makefile b/selinux-policy/boinc-and-similar/Makefile deleted file mode 100644 index 467133b..0000000 --- a/selinux-policy/boinc-and-similar/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/boinc-and-similar -# Description: SELinux interferes with boinc and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/boinc-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with boinc and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: boinc-client" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console boinc-client /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 1618683" >> $(METADATA) # RHEL-7 - @echo "Bug: 1711682" >> $(METADATA) # Fedora 30 - @echo "Bug: 1779070" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/boinc-and-similar/PURPOSE b/selinux-policy/boinc-and-similar/PURPOSE deleted file mode 100644 index 5f8f3b6..0000000 --- a/selinux-policy/boinc-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/boinc-and-similar -Author: Milos Malik - -SELinux interferes with BOINC client (Berkeley Open Infrastructure Network Computing) and related programs. - diff --git a/selinux-policy/boinc-and-similar/main.fmf b/selinux-policy/boinc-and-similar/main.fmf deleted file mode 100644 index 5c18c33..0000000 --- a/selinux-policy/boinc-and-similar/main.fmf +++ /dev/null @@ -1,55 +0,0 @@ -summary: SELinux interferes with boinc and related programs -description: |+ - SELinux interferes with BOINC client (Berkeley Open Infrastructure Network Computing) and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - boinc-client - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - epel - - rhel8-epel - - rhel9-epel - - rhel10-epel - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618683 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1711682 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1779070 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false - - enabled: false - when: arch == aarch64, s390x - continue: false -extra-nitrate: TC#0563640 -extra-summary: /CoreOS/selinux-policy/Regression/boinc-and-similar -extra-task: /CoreOS/selinux-policy/Regression/boinc-and-similar -id: 024cde06-0e81-40fe-8901-e552f47f5ca4 diff --git a/selinux-policy/boinc-and-similar/runtest.sh b/selinux-policy/boinc-and-similar/runtest.sh deleted file mode 100755 index 3db917c..0000000 --- a/selinux-policy/boinc-and-similar/runtest.sh +++ /dev/null @@ -1,113 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/boinc-and-similar -# Description: SELinux interferes with boinc and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/bin/boinc_client" -FILE_CONTEXT="boinc_exec_t" -SERVICE_PACKAGE="boinc-client" -SERVICE_NAME="boinc-client" -PROCESS_NAME="boinc" -PROCESS_CONTEXT="boinc_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1618683" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow boinc_t boinc_exec_t : file { execute_no_trans }" - rlPhaseEnd - - rlPhaseStartTest "bz#1711682 + bz#1779070" - # /usr/bin/boinc and /usr/bin/boinc_client are hardlinks, share the same inode - rlSEMatchPathCon "/usr/bin/boinc_client" "boinc_exec_t" - rlSEMatchPathCon "/var/lib/boinc" "boinc_var_lib_t" - rlSEMatchPathCon "/run/systemd/unit-root/var/lib/boinc" "init_var_run_t" - rlSESearchRule "allow init_t boinc_var_lib_t : dir { mounton } [ ]" - # SELinux denials appear if the following line is in boinc-client system unit file - # ReadWritePaths=/var/lib/boinc - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/boltd-and-similar/Makefile b/selinux-policy/boltd-and-similar/Makefile deleted file mode 100644 index e1a39c5..0000000 --- a/selinux-policy/boltd-and-similar/Makefile +++ /dev/null @@ -1,74 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/boltd-and-similar -# Description: SELinux interferes with boltd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/boltd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh ssh.exp - chcon -t bin_t runtest.sh ssh.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with boltd and related programs." >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 30m" >> $(METADATA) - @echo "RunFor: bolt" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 expect openssh-clients bolt" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 1589086" >> $(METADATA) # RHEL-7 - @echo "Bug: 1625786" >> $(METADATA) # Fedora 28 - @echo "Bug: 1684103" >> $(METADATA) # RHEL-8 - @echo "Bug: 1685591" >> $(METADATA) # RHEL-7 - @echo "Bug: 1702243" >> $(METADATA) # RHEL-8 - @echo "Bug: 1704766" >> $(METADATA) # RHEL-7 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/boltd-and-similar/PURPOSE b/selinux-policy/boltd-and-similar/PURPOSE deleted file mode 100644 index 69f4521..0000000 --- a/selinux-policy/boltd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/boltd-and-similar -Author: Milos Malik - -SELinux interferes with boltd and related programs. - diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf deleted file mode 100644 index 9cb811e..0000000 --- a/selinux-policy/boltd-and-similar/main.fmf +++ /dev/null @@ -1,54 +0,0 @@ -summary: SELinux interferes with boltd and related programs. -description: |+ - SELinux interferes with boltd and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - /usr/sbin/service - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - glib2 - - expect - - openssh-clients - - bolt -environment: - AVC_ERROR: +no_avc_check -duration: 30m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TierCandidatesPASS - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1589086 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1625786 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1684103 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1685591 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1702243 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1704766 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0575292 -extra-summary: /CoreOS/selinux-policy/Regression/boltd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/boltd-and-similar -id: 008316f1-35ab-4eb6-9e70-92df795f9254 diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh deleted file mode 100755 index 0115c59..0000000 --- a/selinux-policy/boltd-and-similar/runtest.sh +++ /dev/null @@ -1,167 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/boltd-and-similar -# Description: SELinux interferes with boltd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/libexec/boltd" -FILE_CONTEXT="boltd_exec_t" -SERVICE_PACKAGE="bolt" -SERVICE_NAME="bolt" -PROCESS_NAME="boltd" -PROCESS_CONTEXT="boltd_t" -ALLOWED_USERS="staff_u user_u xguest_u sysadm_u unconfined_u" -DENIED_USERS="guest_u" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlSEConfigureSSH - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1589086 + bz#1684103 + bz#1685591" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/var/lib/boltd" "boltd_var_lib_t" - rlSEMatchPathCon "/var/run/dbus" "system_dbusd_var_run_t" - rlSEMatchPathCon "/var/run/dbus/system_bus_socket" "system_dbusd_var_run_t" - rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" - rlSEMatchPathCon "/run/udev" "udev_var_run_t" - rlSEMatchPathCon "/run/udev/control" "udev_var_run_t" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow unconfined_t boltd_t : dbus { send_msg }" - rlSESearchRule "allow boltd_t unconfined_t : dbus { send_msg }" - rlSESearchRule "allow boltd_t sssd_public_t : dir { search }" - rlSESearchRule "allow boltd_t sssd_public_t : file { getattr map open read }" - rlSESearchRule "allow boltd_t sssd_var_lib_t : sock_file { write }" - rlSESearchRule "allow boltd_t udev_var_run_t : dir { search }" - rlSESearchRule "allow boltd_t system_dbusd_var_run_t : dir { search }" - rlSESearchRule "allow boltd_t system_dbusd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow boltd_t system_dbusd_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1625786" - rlSESearchRule "allow boltd_t policykit_t : dbus { send_msg } [ ]" - rlSESearchRule "allow policykit_t boltd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow boltd_t system_dbusd_t : dbus { acquire_svc } [ ]" - rlSESearchRule "allow boltd_t xdm_t : dbus { send_msg } [ ]" - rlSESearchRule "allow xdm_t boltd_t : dbus { send_msg } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1702243 + bz#1704766" - rlSESearchRule "allow staff_t boltd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow boltd_t staff_t : dbus { send_msg } [ ]" - rlSESearchRule "allow user_t boltd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow boltd_t user_t : dbus { send_msg } [ ]" - rlSESearchRule "allow xguest_t boltd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow boltd_t xguest_t : dbus { send_msg } [ ]" - rlPhaseEnd - - DESTINATION="org.freedesktop.bolt" - if busctl | grep -iq ${DESTINATION} ; then - rlPhaseStartTest "real scenario -- system D-bus" - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" - sleep 2 - rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" - rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- confined users" - CREATED_USERS="" - rlRun "setsebool ssh_sysadm_login on" - rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "restorecon -RvF /home/${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost boltctl list" - sleep 2 - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" - done - rlRun "setsebool ssh_sysadm_login off" - for USER_NAME in ${CREATED_USERS} ; do - rlRun "userdel -rfZ ${USER_NAME}" - done - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/boltd-and-similar/ssh.exp b/selinux-policy/boltd-and-similar/ssh.exp deleted file mode 100755 index 58c9647..0000000 --- a/selinux-policy/boltd-and-similar/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname $command -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/boothd-and-similar/Makefile b/selinux-policy/boothd-and-similar/Makefile deleted file mode 100644 index fa8e9cf..0000000 --- a/selinux-policy/boothd-and-similar/Makefile +++ /dev/null @@ -1,72 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/boothd-and-similar -# Description: SELinux interferes with boothd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/boothd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with boothd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 20m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: booth" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console booth-arbitrator booth-core /usr/sbin/service net-tools systemd-container" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: RHEL-45907" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-57104" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-58060" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-75471" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/boothd-and-similar/PURPOSE b/selinux-policy/boothd-and-similar/PURPOSE deleted file mode 100644 index def5594..0000000 --- a/selinux-policy/boothd-and-similar/PURPOSE +++ /dev/null @@ -1,6 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/boothd-and-similar -Author: Milos Malik - -SELinux interferes with boothd and related programs. -Covers the booth-arbitrator service. - diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf deleted file mode 100644 index 45244b4..0000000 --- a/selinux-policy/boothd-and-similar/main.fmf +++ /dev/null @@ -1,52 +0,0 @@ -summary: SELinux interferes with boothd and related programs -description: |+ - SELinux interferes with boothd and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - booth-arbitrator - - booth-core - - /usr/sbin/service - - net-tools - - systemd-container -environment: - AVC_ERROR: +no_avc_check -duration: 20m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS - - avoidImageMode -link: - - verifies: https://issues.redhat.com/browse/RHEL-45907 - - verifies: https://issues.redhat.com/browse/RHEL-57104 - - verifies: https://issues.redhat.com/browse/RHEL-58060 - - verifies: https://issues.redhat.com/browse/RHEL-75471 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the booth package is not available there - - enabled: false - when: distro ~< rhel-9.6 - because: RHEL-57104 and other is fixed in RHEL-9.6, RHEL-8 not affected -extra-summary: /CoreOS/selinux-policy/Regression/boothd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/boothd-and-similar -extra-nitrate: TC#0617767 -id: 7d00eabe-6df9-4577-9b07-1b79ab62f21b diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh deleted file mode 100755 index e32dae0..0000000 --- a/selinux-policy/boothd-and-similar/runtest.sh +++ /dev/null @@ -1,108 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/boothd-and-similar -# Description: SELinux interferes with boothd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/sbin/boothd" -SERVICE_PACKAGE="booth-arbitrator" -SERVICE_NAME="booth-arbitrator" -PROCESS_NAME="boothd" -if seinfo -t | grep -q boothd ; then - FILE_CONTEXT="boothd_exec_t" - PROCESS_CONTEXT="boothd_t" -else - FILE_CONTEXT="bin_t" - PROCESS_CONTEXT="unconfined_service_t" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/booth/booth.conf - rlRun "service systemd-machined start" - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if seinfo -t | grep -q boothd && ! rlIsRHEL "<9.6" && ! rlIsCentOS "<9.6" ; then - rlPhaseStartTest "RHEL-45907" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/run/systemd/userdb" "systemd_userdbd_runtime_t" - rlSESearchRule "allow boothd_t systemd_userdbd_runtime_t : dir { read } [ ]" - rlSESearchRule "allow boothd_t systemd_userdbd_runtime_t : sock_file { write } [ ]" - rlSESearchRule "allow boothd_t systemd_userdbd_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-57104 + RHEL-58060" - rlSESearchRule "allow boothd_t kernel_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 8 9 && ! rlIsCentOS 8 9 ; then - rlPhaseStartTest "RHEL-75471" - rlSESearchRule "allow boothd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ]; then - rlPhaseStartTest "real scenario -- standalone service" - IF_NAME=`route | grep default | awk '{ print $8 }'` - IP_ADDRESS=`ip addr show ${IF_NAME} | grep 'inet ' | cut -d / -f 1 | awk '{ print $2 }' | head -n 1` - rlRun "cp -f /usr/share/doc/booth/booth.conf.example /etc/booth/booth.conf" - rlRun "sed -i 's/^arbitrator=.*$/arbitrator=\"${IP_ADDRESS}\"/' /etc/booth/booth.conf" - rlRun "grep ^arbitrator /etc/booth/booth.conf" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlWatchdog "booth list" 20 - rlWatchdog "booth status" 20 - rlWatchdog "booth peers" 20 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlFileRestore - rlRun "service systemd-machined stop" - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile deleted file mode 100644 index 68ea1c9..0000000 --- a/selinux-policy/bootupd-and-similar/Makefile +++ /dev/null @@ -1,75 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/bootupd-and-similar -# Description: SELinux interferes with the bootupd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/bootupd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service bootupd" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 2029478" >> $(METADATA) # RHEL-9 - @echo "Bug: 2044508" >> $(METADATA) # RHEL-9 - @echo "Bug: 2218106" >> $(METADATA) # Fedora rawhide - @echo "Bug: RHEL-36289" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-39514" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-66584" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-70849" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-174888" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/bootupd-and-similar/PURPOSE b/selinux-policy/bootupd-and-similar/PURPOSE deleted file mode 100644 index d1f7895..0000000 --- a/selinux-policy/bootupd-and-similar/PURPOSE +++ /dev/null @@ -1,6 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/bootupd-and-similar -Description: SELinux interferes with the bootupd service and related programs -Author: Milos Malik - -The TC needs a machine with EFI for a successful run. - diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf deleted file mode 100644 index 52e576e..0000000 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ /dev/null @@ -1,52 +0,0 @@ -summary: SELinux interferes with the bootupd service and related programs -description: |+ - SELinux interferes with the bootupd service and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - bootupd -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - NoRHIVOS - - avoidImageMode -tier: 3 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2029478 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2044508 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106 - - verifies: https://issues.redhat.com/browse/RHEL-36289 - - verifies: https://issues.redhat.com/browse/RHEL-39514 - - verifies: https://issues.redhat.com/browse/RHEL-66584 - - verifies: https://issues.redhat.com/browse/RHEL-70849 - - verifies: https://issues.redhat.com/browse/RHEL-174888 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - because: the package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/bootupd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/bootupd-and-similar -extra-nitrate: TC#0614833 -id: f6f4f1bc-b585-4199-8cde-d72424cadd52 diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh deleted file mode 100755 index f2b2767..0000000 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ /dev/null @@ -1,188 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/bootupd-and-similar -# Description: SELinux interferes with the bootupd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/libexec/bootupd" -SERVICE_PACKAGE="bootupd" -if rlIsFedora ; then - SERVICE_NAME="bootloader-update" -else - SERVICE_NAME="bootupd" -fi -PROCESS_NAME="bootupd" -if seinfo -t | grep -q bootupd ; then - FILE_CONTEXT="bootupd_exec_t" - PROCESS_CONTEXT="bootupd_t" -else - FILE_CONTEXT="bin_t" - PROCESS_CONTEXT="unconfined_service_t" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#2029478 + bz#2044508" - # both BZs were closed as WONTFIX, but the test is flexible enough - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - BOOLEANS="[ ]" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - - rlPhaseStartTest "bz#2218106" - rlSEMatchPathCon "/usr/libexec/bootupd" "${FILE_CONTEXT}" - if [ -d /boot/efi ] ; then - rlRun "ls -aRlZ /boot/efi" - fi - rlSESearchRule "allow ${PROCESS_CONTEXT} dosfs_t : dir { getattr search } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-36289 + RHEL-39514" - rlSEMatchPathCon "/usr/libexec/bootupd" "${FILE_CONTEXT}" - if [ -d /sys/firmware/efi/efivars ] ; then - rlRun "ls -aRlZ /sys/firmware/efi/efivars" - fi - rlSESearchRule "allow ${PROCESS_CONTEXT} efivarfs_t : dir { getattr search } [ ]" - rlPhaseEnd - - if rlSEDefined "bootupd_t" ; then - rlPhaseStartTest "RHEL-66584" - rlSEMatchPathCon "/boot/bootupd-state.json" "boot_t" - rlSESearchRule "allow bootupd_t boot_t : dir { write remove_name } [ ]" - rlSESearchRule "allow bootupd_t boot_t : file { unlink } [ ]" - rlSESearchRule "allow bootupd_t dosfs_t : dir { search } [ ]" - rlSESearchRule "allow bootupd_t dosfs_t : file { open } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-70849" - rlSEMatchPathCon "/usr/bin/findmnt" "bin_t" - rlSEMatchPathCon "/usr/bin/lsblk" "bin_t" - rlSEMatchPathCon "/usr/bin/udevadm" "udev_exec_t" - rlSEMatchPathCon "/usr/bin/mount" "mount_exec_t" - rlSEMatchPathCon "/usr/sbin/grub2-install" "bootloader_exec_t" - rlSESearchRule "allow bootupd_t fixed_disk_device_t : blk_file { getattr } [ ]" - rlSESearchRule "allow bootupd_t bin_t : file { execute execute_no_trans map } [ ]" - rlSESearchRule "allow bootupd_t sysfs_t : dir { read } [ ]" - rlSESearchRule "allow bootupd_t sysfs_t : file { getattr open read } [ ]" - rlSESearchRule "allow bootupd_t sysfs_t : lnk_file { read } [ ]" - rlSESearchRule "allow bootupd_t cert_t : dir { getattr open read search } [ ]" - rlSESearchRule "allow bootupd_t cert_t : file { getattr open read } [ ]" - - rlSESearchRule "allow bootupd_t udev_exec_t : file { getattr open read map execute } [ ]" - rlSESearchRule "type_transition bootupd_t udev_exec_t : process udev_t" - rlSESearchRule "allow bootupd_t udev_t : process { transition } [ ]" - - rlSESearchRule "allow bootupd_t mount_exec_t : file { getattr open read map execute } [ ]" - rlSESearchRule "type_transition bootupd_t mount_exec_t : process mount_t" - rlSESearchRule "allow bootupd_t mount_t : process { transition } [ ]" - - rlSESearchRule "allow bootupd_t bootloader_exec_t : file { getattr open read map execute } [ ]" - rlSESearchRule "type_transition bootupd_t bootloader_exec_t : process bootloader_t" - rlSESearchRule "allow bootupd_t bootloader_t : process { transition } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-174888" - rlSEMatchPathCon "/usr/bin/lsblk" "bin_t" - rlSEMatchPathCon "/etc/passwd" "passwd_file_t" - rlSEMatchPathCon "/run/mount/utab" "mount_var_run_t" - rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" - rlSESearchRule "allow bootupd_t mount_var_run_t : dir { search } [ ]" - rlSESearchRule "allow bootupd_t passwd_file_t : file { getattr open read } [ ]" - rlSESearchRule "allow bootupd_t sssd_public_t : dir { search } [ ]" - rlSESearchRule "allow bootupd_t sssd_var_lib_t : dir { search } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for OSes where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then - rlRun "systemctl start ${SERVICE_NAME}.socket" - fi - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then - rlRun "systemctl stop ${SERVICE_NAME}.socket" - fi - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then - rlPhaseStartTest "real scenario -- ${SERVICE_NAME}.socket" - rlRun "systemctl enable ${SERVICE_NAME}.socket" - rlRun "systemctl start ${SERVICE_NAME}.socket" - sleep 1 - rlRun "rm -f /boot/bootupd-state.json" - rlRun "bootupctl adopt-and-update" 0,1 - rlRun "bootupctl status" 0,1 - rlRun "bootupctl validate" 0,1 - rlRun "lsblk" - rlRun "systemctl stop ${SERVICE_NAME}.socket" - rlRun "systemctl disable ${SERVICE_NAME}.socket" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario without the service or the socket" - rlRun "rm -f /boot/bootupd-state.json" - rlRun "bootupctl adopt-and-update" 0,1 - rlRun "bootupctl status" 0,1 - rlRun "bootupctl validate" 0,1 - rlRun "lsblk" - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/bz481628-send-msg-to-dbus/Makefile b/selinux-policy/bz481628-send-msg-to-dbus/Makefile index 3afb08d..06e84fa 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/Makefile +++ b/selinux-policy/bz481628-send-msg-to-dbus/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: dbus" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console expect openssh-clients dbus-daemon shadow-utils" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console expect openssh-clients dbus-daemon shadow-utils" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf index d2dae9e..8763a30 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf +++ b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf @@ -1,53 +1,2 @@ -summary: checks if dbus daemon is able to send message to hal daemon and vice versa -description: |+ - SELinux interferes with D-bus daemon and related programs. - -contact: Milos Malik -component: - - dbus - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - /usr/sbin/service - - setools-console - - expect - - openssh-clients - - dbus-daemon - - shadow-utils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - TIPpass - - TierCandidatesPASS - - targeted - - NoRHIVOS -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=463267 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=481628 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1546721 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1614236 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1688671 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1727887 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754476 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0057414 -extra-summary: /CoreOS/selinux-policy/Regression/bz481628-send-msg-to-dbus -extra-task: /CoreOS/selinux-policy/Regression/bz481628-send-msg-to-dbus -id: 3d861eff-500e-48d9-bef7-0906a55f5000 +path: /selinux-policy/bz481628-send-msg-to-dbus +tier: 2 diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh index 80100e4..97c4f41 100755 --- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh +++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" @@ -44,14 +45,12 @@ PROCESS_CONTEXT="system_dbusd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} - rlSEConfigureSSH - rlSESetEnforce rlSEStatus rlSESetTimestamp @@ -100,15 +99,13 @@ rlJournalStart rlPhaseStartTest "bz#1614236" rlSEMatchPathCon "/usr/bin/dbus-daemon" "dbusd_exec_t" rlSEMatchPathCon "/dev/nvme0n1p1" "nvme_device_t" - rlSESearchRule "allow system_dbusd_t nvme_device_t : blk_file { read } [ ]" + rlSESearchRule "allow system_dbusd_t nvme_device_t : blk_file { getattr open read }" rlPhaseEnd fi - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService "nopassword" ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "reload status" 1 rlPhaseEnd - fi if ! rlIsRHEL 5 6 7 ; then rlPhaseStartTest "bz#1688671" @@ -135,7 +132,6 @@ rlJournalStart rlPhaseStartTest "real scenario -- user session service" rlRun "setsebool ssh_sysadm_login on" rlRun "setsebool selinuxuser_tcp_server on" - CREATED_USERS="" # TODO: guest_u, xguest_u cannot successfully run systemctl for SELINUX_USER in user_u staff_u sysadm_u unconfined_u ; do USER_NAME="user${RANDOM}" @@ -153,10 +149,8 @@ rlJournalStart rlRun "grep \"${SELINUX_USER}:object_r:session_dbusd_tmp_t:.* services\" files.txt" fi rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/busctl --user --no-pager" - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" - done - for USER_NAME in ${CREATED_USERS} ; do rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 done rlRun "setsebool selinuxuser_tcp_server off" rlRun "setsebool ssh_sysadm_login off" @@ -165,11 +159,8 @@ rlJournalStart rlPhaseStartCleanup sleep 2 - rlSECheckAVC --ignore 'type=AVC .* create .*systemd .*:user_t:.*:user_tmp_t:.*tclass=dir' + rlSECheckAVC rm -f files.txt - - rlFileRestore - rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile b/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile deleted file mode 100644 index 20c69e7..0000000 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile +++ /dev/null @@ -1,113 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service -# Description: kdump service cannot be started because of SELinux -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te run.exp id_rsa id_rsa.pub - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh run.exp - chcon -t bin_t runtest.sh run.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: kdump service cannot be started because of SELinux" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: expect" >> $(METADATA) - @echo "Requires: /usr/sbin/service" >> $(METADATA) - @echo "Requires: kexec-tools" >> $(METADATA) - @echo "Requires: grubby" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: sed" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-mls" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 533007" >> $(METADATA) # RHEL-6 - @echo "Bug: 533366" >> $(METADATA) # RHEL-6 - @echo "Bug: 537088" >> $(METADATA) # RHEL-6 - @echo "Bug: 540758" >> $(METADATA) # RHEL-6 - @echo "Bug: 549503" >> $(METADATA) # RHEL-6 - @echo "Bug: 618329" >> $(METADATA) # RHEL-6 - @echo "Bug: 621061" >> $(METADATA) # RHEL-6 - @echo "Bug: 753039" >> $(METADATA) # RHEL-5 - @echo "Bug: 966203" >> $(METADATA) # RHEL-6 - @echo "Bug: 1055634" >> $(METADATA) # RHEL-7 - @echo "Bug: 1117368" >> $(METADATA) # RHEL-7 - @echo "Bug: 1117710" >> $(METADATA) # RHEL-7 - @echo "Bug: 1146491" >> $(METADATA) # RHEL-7 - @echo "Bug: 1288565" >> $(METADATA) # RHEL-6 - @echo "Bug: 1363977" >> $(METADATA) # RHEL-7 - @echo "Bug: 1375963" >> $(METADATA) # RHEL-7 - @echo "Bug: 1390669" >> $(METADATA) # RHEL-7 - @echo "Bug: 1418441" >> $(METADATA) # RHEL-7 - @echo "Bug: 1431236" >> $(METADATA) # RHEL-6 - @echo "Bug: 1536690" >> $(METADATA) # RHEL-7 - @echo "Bug: 1540004" >> $(METADATA) # RHEL-7 - @echo "Bug: 1542283" >> $(METADATA) # RHEL-7 - @echo "Bug: 1576730" >> $(METADATA) # RHEL-8 - @echo "Bug: 1588884" >> $(METADATA) # RHEL-7 - @echo "Bug: 1842897" >> $(METADATA) # RHEL-8 - @echo "Bug: 1896424" >> $(METADATA) # RHEL-8 - @echo "Bug: 1896595" >> $(METADATA) # RHEL-8 - @echo "Bug: 1899141" >> $(METADATA) # RHEL-8 - @echo "Bug: 1932752" >> $(METADATA) # RHEL-9 - @echo "Bug: 1951323" >> $(METADATA) # Fedora 33 - @echo "Bug: 1961728" >> $(METADATA) # RHEL-8 - @echo "Bug: 1965985" >> $(METADATA) # RHEL-8 - @echo "Bug: 1965989" >> $(METADATA) # RHEL-9 - @echo "Bug: 1965989" >> $(METADATA) # Fedora rawhide - - rhts-lint $(METADATA) - diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE b/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE deleted file mode 100644 index dd2a012..0000000 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service -Author: Milos Malik - -SELinux interferes with kdump and related programs. - diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa deleted file mode 100644 index a38bb9b..0000000 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEowIBAAKCAQEA724nX9GdCr5+gJTSgdn6QK+AhSdqlN0D++qqs6fGBn5YA1w1 -dGNtuMsL81HjKPIjK+tecFO9HRUSM1nsxg6z8zNzlVxvQYB8uTw3cZXKgorDI280 -6ESdU4oXDQqrUyZVRJmh2I58qMVn9TdeTwbnYFEbrnItq7NKQ9VobcF4T3w2aj61 -vSTLLx8IT9cfyTfQI9ELJ3RFTVzlyfMJ6x9PSyWPzeclsL9pR39rp5ZuZpOXY2Nm -1t3UiQcOurPS/1Y3lxUgZHadFnQyW/oIeQddIfKOollFqnKx/71YPq1RUcPcO/ba -y1IpM8tgpxXfkIWk7jB4N9zmVRI7QwDe+5NKBwIDAQABAoIBAQDAnqnmmEfzANXc -s922wZpmt8p5VQCVykkOPfgemHbjenlsGp6Wh/cZl6CBm/tYUZSiHLTZQUT/RJhj -35BwthtnKJlwK/EFjUzJ6Pvh0VQeOWxL8Ydq5Oh88LcistaqCkjG66IdCmSXkljU -Gjsw8Kjr/9R5PzomzBKPB/z/b4pOxlzAxUev2m7Gfb8UcCwnlMTq3udn6sexZ50V -bTX//tgpsUAMMzARKYk2v472qtmQuTa7rP9EIjKR8qVpv27tX0i80MFUSsOpL1E3 -kPSqqkKEXkCf1zCw14dF2d2JeiyW7ADka71m51ZMfn1POMdwWgpreeWUQphwC798 -KyrJ3RNhAoGBAPy1yUlE1Hs7+/6G3ndpf5lI5lU6aiaT12TVYi0cMWpFDjX0qA93 -Ew7HMFfkZpFwV54YYW1ZuoGG0l93voKsP8LWnSDLEoX+gBbkKHeyMHkzCTiVTlYN -rB7EtAxEe6kYlTbcYhpICA561ujxf+kn/uLhYZQ8iq70Z0kpiDGYwN19AoGBAPKM -HAq7xmxq8rCC65CBbneIJD8luK+XenDKkIj/OjjOp33odR4DAyNwUigu+DzZjdb4 -Xm2Mb3HofDzsRjPjEidQ9dx/rQoA4qKmXMLZI9qFMcFsqFkNwHToBYgrQU0XK+2G -DYIs1spu5TtqWspflcvos4oWM0EiTZs5y8TrnGzTAoGASWEn36Si5l3WoGPdOWNi -78mhSGI77JPFWbw0U9D58Fe49qXiHwt+dy4TtZHWzqiGaJu/vpbtdysE7z/ADAWk -Rhk3awxMhqgN3ZfGwGr3dFoDdXC1XHt/3TdU6LMCDWnb+iAoRGViIYI94Uou0C8S -7iJvyTGDO6YwT6hFqdEnP6kCgYB9LSA/zd8/DwcHX9nxL0tytzl1uaMSREw1r+Ve -PtKuhMDecz0WaxmQjaRpBqyowuK4ImChiwvtLr4Hty0YFEXHMrpgvSfx9LkClndj -PCuL2JfwKoLLyxQbga9xMlm2TpImOLv6Begoe4kk2+PVc/VcUlFun7x+DhUdWnu2 -up51bwKBgAfnx94dIgA8Z7P4Za8Cpp9FCMfUa4R+gNI+/0XLFAGR9Bd+c/61jMRd -OQjErru9Fq47kvE91GHfyS069gI+g7tsTcnPgAXiNhmhILe5O+blNuPPclQ9NMLG -4WII0I6nrbKMnvwCRw6Ikc2OiijPkmbI9VXwIMfbGxI77A4UGBp5 ------END RSA PRIVATE KEY----- diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub deleted file mode 100644 index 7b2871f..0000000 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDvbidf0Z0Kvn6AlNKB2fpAr4CFJ2qU3QP76qqzp8YGflgDXDV0Y224ywvzUeMo8iMr615wU70dFRIzWezGDrPzM3OVXG9BgHy5PDdxlcqCisMjbzToRJ1TihcNCqtTJlVEmaHYjnyoxWf1N15PBudgURuuci2rs0pD1WhtwXhPfDZqPrW9JMsvHwhP1x/JN9Aj0QsndEVNXOXJ8wnrH09LJY/N5yWwv2lHf2unlm5mk5djY2bW3dSJBw66s9L/VjeXFSBkdp0WdDJb+gh5B10h8o6iWUWqcrH/vVg+rVFRw9w79trLUikzy2CnFd+QhaTuMHg33OZVEjtDAN77k0oH diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf deleted file mode 100644 index 9104410..0000000 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ /dev/null @@ -1,88 +0,0 @@ -summary: SELinux interferes with kdump and related programs -description: |+ - SELinux interferes with kdump and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - expect - - /usr/sbin/service - - kexec-tools - - kdump-utils - - grubby - - libselinux - - libselinux-utils - - policycoreutils - - sed - - selinux-policy - - selinux-policy-mls - - selinux-policy-targeted - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - MLS - - NoRHEL4 - - TIPpass_Security - - TierCandidatesPASS - - TipWaived7 - - failinfedora - - targeted - - NoRHIVOS - - rhel10_broken - - reboot -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533007 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533366 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=537088 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=540758 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=549503 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=618329 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=621061 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=753039 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=966203 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1055634 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1117368 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1117710 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1146491 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1288565 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1363977 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1375963 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390669 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1418441 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1431236 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1536690 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1540004 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1542283 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1576730 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1588884 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1842897 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1896424 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1896595 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899141 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932752 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951323 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961728 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965985 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965989 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934347 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=830822 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2236876 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0057470 -extra-summary: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service -extra-task: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service -id: 99e91f23-6d4d-4f52-b867-8420eaa39e03 diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp b/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp deleted file mode 100755 index 939b3a3..0000000 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp +++ /dev/null @@ -1,17 +0,0 @@ -#!/usr/bin/expect -f -# ./run.exp password param1 param2 param3 -set password [lrange $argv 0 0] -set param1 [lrange $argv 1 1] -set param2 [lrange $argv 2 2] -set param3 [lrange $argv 3 3] -set timeout 15 -spawn $param1 $param2 $param3 -expect { - "yes/no" { send -- "yes\r" } - eof -} -expect { - "assword" { send -- "$password\r" } - eof -} - diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh deleted file mode 100755 index 3606222..0000000 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh +++ /dev/null @@ -1,250 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service -# Description: kdump service cannot be started because of SELinux -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -if ! grep crashkernel= /proc/cmdline ; then - grubby --update-kernel ALL --args crashkernel=512M - sync - tmt-reboot -fi - -PACKAGE="selinux-policy" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-mls - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm kexec-tools - rlRun "uname -a" - rlRun "cat /proc/cmdline" - - rlFileBackup --clean /root/.ssh - rlFileBackup /etc/kdump.conf - rlFileBackup /etc/shadow - OUTPUT_FILE=`mktemp` - - if rlIsRHEL 6 ; then - rlRun "ls -l testpolicy.te" - rlRun "make -f /usr/share/selinux/devel/Makefile" - rlRun "ls -l testpolicy.pp" - rlRun "semodule -i testpolicy.pp" - fi - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest "bz#533007 + bz#533366 + bz#540758 + bz#549503 + bz#966203" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - rlRun "ls -Z /proc/kcore | grep :proc_kcore_t" - if rlIsRHEL 6 ; then - rlRun "seinfo -tkdump_t -x | grep mlsfileread" - fi - rlSESearchRule "allow kdump_t proc_kcore_t : file { getattr open read }" - rlPhaseEnd - - rlPhaseStartTest "bz#537088" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - rlSESearchRule "allow kdump_t kdump_t : capability { sys_rawio }" - rlPhaseEnd - - rlPhaseStartTest "bz#618329" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - [ -e /sys/kernel/debug/boot_params/data ] && rlRun "ls -Z /sys/kernel/debug/boot_params/data | grep :debugfs_t" - rlSESearchRule "allow kdump_t user_devpts_t : chr_file { read write } [ allow_daemons_use_tty ]" - rlSESearchRule "allow kdump_t sysfs_t : dir { getattr read search }" - rlSESearchRule "allow kdump_t sysfs_t : file { getattr open read }" - rlSESearchRule "allow kdump_t debugfs_t : dir { getattr search }" - rlSESearchRule "allow kdump_t debugfs_t : file { getattr open read }" - rlPhaseEnd - - rlPhaseStartTest "bz#621061" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - rlSESearchRule "allow kdump_t kernel_t : system { module_request }" - rlPhaseEnd - fi - - if rlIsRHEL 6 ; then - rlPhaseStartTest "bz#1288565 + bz#1431236" - rlSEMatchPathCon "/usr/sbin/bmc-watchdog" "freeipmi_bmc_watchdog_exec_t" - rlSEMatchPathCon "/var/lock/kdump" "kdump_lock_t" - # even though the context of /var/lock/kdump was corrected via restorecon before reboot - # after reboot the file was mislabeled (var_lock_t) again - rlSESearchRule "dontaudit freeipmi_bmc_watchdog_t var_lock_t : file { write }" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1055634" # MLS + targeted - rlSEMatchPathCon "/usr/bin/kdumpctl" "kdumpctl_exec_t" - rlSEMatchPathCon "/var/lock" "var_lock_t" - rlSEMatchPathCon "/var/lock/kdump" "kdump_lock_t" - rlSESearchRule "allow kdumpctl_t var_lock_t : lnk_file { getattr read }" - rlSESearchRule "allow kdumpctl_t var_lock_t : dir { getattr open search read write add_name remove_name }" - rlRun "sesearch -s kdumpctl_t -t var_lock_t -c file -T | grep \"kdump_lock_t.*kdump\"" - rlSESearchRule "allow kdumpctl_t kdump_lock_t : file { getattr open create unlink }" - rlPhaseEnd - - rlPhaseStartTest "bz#1117368 + bz#1117710 + bz#1146491" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - rlRun "ls -Z /proc/kallsyms | grep :system_map_t" - rlSESearchRule "allow kdump_t system_map_t : file { getattr open read }" - rlPhaseEnd - - rlPhaseStartTest "bz#1363977" - rlSESearchRule "allow NetworkManager_t kdumpctl_t : dbus { send_msg }" - rlSESearchRule "allow kdumpctl_t NetworkManager_t : dbus { send_msg }" - rlPhaseEnd - - rlPhaseStartTest "bz#1375963 + bz#1418441" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - rlSESearchRule "allow kdump_t kdump_t : capability { sys_admin }" - rlPhaseEnd - - rlPhaseStartTest "bz#1390669" - rlSEMatchPathCon "/usr/bin/kdumpctl" "kdumpctl_exec_t" - if [ -f /sys/kernel/security/securelevel ] ; then - # the file is present on RHEL-7.5: kernel 3.10 - # the file is not present on RHEL-ALT-7.5: kernel 4.14 - rlRun "ls -Z /sys/kernel/security/securelevel | grep :security_t" - fi - rlSESearchRule "allow kdumpctl_t security_t : file { getattr open read } mls" - rlSESearchRule "allow kdumpctl_t security_t : file { getattr open read } targeted" - rlPhaseEnd - - rlPhaseStartTest "bz#1540004 + bz#1542283" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - rlSESearchRule "allow kdump_t kdump_t : capability2 { syslog }" - rlPhaseEnd - - rlPhaseStartTest "bz#1536690" - rlSESearchRule "allow kdump_t modules_object_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1576730 + bz#1588884" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - rlSEMatchPathCon "/boot/initramfs-4.16.0-8.el8+5.s390xkdump.img" "boot_t" - rlSESearchRule "allow kdump_t boot_t : file { map }" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1842897" - # relevant SELinux denials appear during the real scenario phases - rlSESearchRule "dontaudit NetworkManager_t kdumpctl_tmp_t : fifo_file { write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1896424 + bz#1896595 + bz#1899141" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - rlSESearchRule "allow kdump_t tmp_t : dir { write add_name remove_name } [ ]" - rlSESearchRule "allow kdump_t tmp_t : file { create unlink } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1951323 + bz#1961728 + bz#1965985 + bz#1965989" - # the directory belongs to the kexec-tools package - rlSEMatchPathCon "/var/lib/kdump" "kdump_var_lib_t" - rlSEMatchPathCon "/var/lib/kdump/initramfs-kernel-version.kdump.img" "kdump_var_lib_t" - rlSESearchRule "allow kdump_t kdump_var_lib_t : dir { getattr open search add_name remove_name read write } [ ]" - rlSESearchRule "allow kdump_t kdump_var_lib_t : file { getattr open read } [ ]" - rlSESearchRule "allow rpm_script_t kdump_var_lib_t : dir { getattr open search add_name remove_name read write } [ ]" - rlSESearchRule "allow rpm_script_t kdump_var_lib_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - - if rlIsFedora ; then - rlPhaseStartTest "bz#2236876" - rlSESearchRule "allow kdump_t tmpfs_t : dir { write add_name } [ ]" - rlSESearchRule "type_transition kdump_t tmpfs_t : file kdump_tmpfs_t" - rlSESearchRule "allow kdump_t kdump_tmpfs_t : file { read write } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario" - rlRun "sed -i \"s/^\(net.*\)$/# \1/\" /etc/kdump.conf" - rlRun "service kdump start 2>&1 | tee ${OUTPUT_FILE}" - rlRun "grep -i \"unable to gather efi data\" ${OUTPUT_FILE}" 1 - sleep 1 - rlRun "service kdump restart 2>&1 | tee ${OUTPUT_FILE}" - rlRun "grep -i \"unable to gather efi data\" ${OUTPUT_FILE}" 1 - sleep 1 - rlRun "service kdump stop" - sleep 1 - rlRun "grep \"kdump.*kexec.*loaded.*kernel\" /var/log/messages | tail -n 2" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- bz#753039" - USER_NAME="root" - USER_SECRET="redhat" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "mkdir -p /root/.ssh" - rlRun "restorecon -Rv /root/.ssh" - rlRun "cp id_rsa /root/.ssh/" - rlRun "chmod 600 /root/.ssh/id_rsa" - rlRun "cat id_rsa.pub >> /root/.ssh/authorized_keys" - - if rlIsRHEL 5 6 ; then - rlRun "echo \"net ${USER_NAME}@${HOSTNAME}\" >> /etc/kdump.conf" - rlRun "./run.exp ${USER_SECRET} service kdump propagate" - else - rlRun "sed -i \"s/makedumpfile/makedumpfile -F/\" /etc/kdump.conf" - rlRun "echo \"ssh ${USER_NAME}@${HOSTNAME}\" >> /etc/kdump.conf" - rlRun "./run.exp ${USER_SECRET} kdumpctl propagate" - rlRun "runcon system_u:system_r:initrc_t:s0 bash -c \"kdumpctl showmem\"" - fi - rlRun "service kdump restart" - sleep 1 - rlRun "grep \"kdump.*propagated ssh key\" /var/log/messages | tail -n 1" - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - if rlIsRHEL 6 ; then - rlRun "semodule -r testpolicy" - rlRun "rm -f testpolicy.pp" - fi - - rm -f ${OUTPUT_FILE} - rlFileRestore - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te b/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te deleted file mode 100644 index d90b338..0000000 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te +++ /dev/null @@ -1,15 +0,0 @@ -module testpolicy 1.0; - -require { - type user_tmp_t; - type setfiles_t; - type kdump_t; - class file write; -} - -#============= kdump_t ============== -allow kdump_t user_tmp_t:file write; - -#============= setfiles_t ============== -allow setfiles_t user_tmp_t:file write; - diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile deleted file mode 100644 index ed51edc..0000000 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile +++ /dev/null @@ -1,88 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot -# Description: some plymouth operations are denied during boot because of SELinux -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: some plymouth operations are denied during boot because of SELinux" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 30m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: /usr/sbin/service" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: plymouth" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5" >> $(METADATA) - @echo "Bug: 538089" >> $(METADATA) # RHEL-6 - @echo "Bug: 560611" >> $(METADATA) # RHEL-6 - @echo "Bug: 904016" >> $(METADATA) # RHEL-7 - @echo "Bug: 1045382" >> $(METADATA) # RHEL-7 - @echo "Bug: 1131195" >> $(METADATA) # RHEL-6 - @echo "Bug: 1160196" >> $(METADATA) # RHEL-7 - @echo "Bug: 1202429" >> $(METADATA) # Fedora 21 - @echo "Bug: 1517405" >> $(METADATA) # Fedora 27 - @echo "Bug: 1664143" >> $(METADATA) # Fedora 29 - @echo "Bug: 1869814" >> $(METADATA) # RHEL-8 - @echo "Bug: 1871307" >> $(METADATA) # RHEL-8 - @echo "Bug: 2184803" >> $(METADATA) # RHEL-9 - @echo "Bug: 2256442" >> $(METADATA) # Fedora 40 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE deleted file mode 100644 index e16c39f..0000000 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot -Author: Milos Malik - -SELinux interferes with plymouth / plymouthd and related programs. - diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf deleted file mode 100644 index 6ce929e..0000000 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf +++ /dev/null @@ -1,59 +0,0 @@ -summary: some plymouth operations are denied during boot because of SELinux -description: |+ - SELinux interferes with plymouth / plymouthd and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - /usr/sbin/service - - libselinux - - libselinux-utils - - plymouth - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 30m -enabled: true -tag: - - kernel-rt - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=538089 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560611 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=904016 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1045382 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1131195 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1160196 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1202429 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1517405 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1664143 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1869814 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1871307 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2184803 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2256442 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0057474 -extra-summary: /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot -extra-task: /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot -id: b3e914bb-2af2-4edb-9959-d20e81b2e7ce diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh deleted file mode 100755 index e78bd69..0000000 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh +++ /dev/null @@ -1,184 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot -# Description: some plymouth operations are denied during boot because of SELinux -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/plymouthd" -FILE_CONTEXT="plymouthd_exec_t" -SERVICE_PACKAGE="plymouth" -SERVICE_NAME="plymouth-start" -PROCESS_NAME="plymouthd" -PROCESS_CONTEXT="plymouthd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#538089" - rlSEMatchPathCon "/bin/plymouth" "plymouth_exec_t" - rlSEMatchPathCon "/sbin/cryptsetup" "lvm_exec_t" - rlSEMatchPathCon "/dev/mapper/control" "lvm_control_t" - rlRun "ls -Z /proc/devices | grep :proc_t" - rlSESearchRule "allow plymouth_t lvm_exec_t : file { getattr open read execute }" - rlSESearchRule "type_transition plymouth_t lvm_exec_t : process lvm_t" - rlSESearchRule "allow plymouth_t lvm_t : process { transition }" - rlSESearchRule "allow lvm_t lvm_t : capability { ipc_lock }" - rlSESearchRule "allow lvm_t proc_t : file { getattr open read }" - rlSESearchRule "allow lvm_t lvm_control_t : chr_file { getattr open read write }" - rlPhaseEnd - - rlPhaseStartTest "bz#560611" - rlSEMatchPathCon "/bin/plymouth" "plymouth_exec_t" - rlRun "ls -Z /proc/cmdline | grep :proc_t" - rlSESearchRule "allow plymouth_t proc_t : file { getattr open read }" - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#904016" - rlSEMatchPathCon "/usr/sbin/plymouthd" "plymouthd_exec_t" - rlSEMatchPathCon "/var/log/boot.log" "plymouthd_var_log_t" - # when plymouthd runs as plymouthd_t - rlSESearchRule "allow plymouthd_t var_log_t : dir { write add_name }" - rlSESearchRule "type_transition plymouthd_t var_log_t : file plymouthd_var_log_t" - rlSESearchRule "allow plymouthd_t plymouthd_var_log_t : file { create }" - # when plymouthd runs as kernel_t - rlSESearchRule "allow kernel_t var_log_t : dir { write add_name }" - rlRun "sesearch -s kernel_t -t var_log_t -c file -T | grep 'plymouthd_var_log_t.*boot.log'" - rlSESearchRule "allow kernel_t plymouthd_var_log_t : file { create }" - rlPhaseEnd - - rlPhaseStartTest "bz#1045382" - rlSEMatchPathCon "/usr/sbin/plymouthd" "plymouthd_exec_t" - rlSEMatchPathCon "/var/run/udev" "udev_var_run_t" - rlSEMatchPathCon "/var/run/udev/queue.bin" "udev_var_run_t" - rlSESearchRule "allow plymouthd_t plymouthd_t : netlink_kobject_uevent_socket { create setopt bind getattr }" - rlSESearchRule "allow plymouthd_t udev_var_run_t : dir { search }" - rlSESearchRule "allow plymouthd_t udev_var_run_t : file { getattr open read }" - rlPhaseEnd - - rlPhaseStartTest "bz#1160196" - rlSEMatchPathCon "/usr/sbin/plymouthd" "plymouthd_exec_t" - rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/mc/group" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" - rlSESearchRule "allow plymouthd_t sssd_public_t : dir { getattr search open }" - rlSESearchRule "allow plymouthd_t sssd_public_t : file { getattr open read }" - rlSESearchRule "allow plymouthd_t sssd_var_lib_t : dir { getattr search open }" - rlSESearchRule "allow plymouthd_t sssd_var_lib_t : sock_file { write getattr append open }" - rlPhaseEnd - fi - - if rlIsRHEL 6 ; then - rlPhaseStartTest "bz#1131195" - rlSEMatchPathCon "/var/spool/plymouth/boot.log" "plymouthd_spool_t" - rlSESearchRule "allow xdm_t plymouthd_spool_t : file { getattr }" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1202429" - rlSEMatchPathCon "/dev/ttyUSB0" "usbtty_device_t" - rlSESearchRule "allow plymouthd_t usbtty_device_t : chr_file { read write } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1517405" - rlSEMatchPathCon "/dev/fb0" "framebuf_device_t" - rlSESearchRule "allow plymouthd_t framebuf_device_t : chr_file { map } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1664143" - rlSEMatchPathCon "/sys/firmware/efi/efivars" "efivarfs_t" - rlSESearchRule "allow plymouthd_t efivarfs_t : dir { getattr open search } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1869814 + bz#1871307" - rlSESearchRule "allow plymouthd_t plymouthd_t : capability { sys_chroot } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL "<9.3" ; then - rlPhaseStartTest "bz#2184803" - rlSESearchRule "allow plymouthd_t plymouthd_t : capability2 { bpf } [ ]" - rlPhaseEnd - fi - - if rlIsFedora ; then - rlPhaseStartTest "bz#2256442" - rlSEMatchPathCon "/dev/kmsg" "kmsg_device_t" - rlSESearchRule "allow plymouthd_t kmsg_device_t : chr_file { open read write } [ ]" - rlSESearchRule "allow plymouthd_t kernel_t : system { syslog_read } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for environments where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile b/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile deleted file mode 100644 index d0987e4..0000000 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile +++ /dev/null @@ -1,100 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts -# Description: some named files in chroot-ed environment have wrong SELinux labels -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: some named files in chroot-ed environment have wrong SELinux labels" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 2h" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: bind" >> $(METADATA) - @echo "Requires: bind-chroot" >> $(METADATA) - @echo "Requires: caching-nameserver" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Requires: /usr/sbin/service" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: procps" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 451970" >> $(METADATA) # RHEL-5 - @echo "Bug: 562833" >> $(METADATA) # RHEL-5 - @echo "Bug: 578187" >> $(METADATA) # RHEL-5 - @echo "Bug: 698257" >> $(METADATA) # RHEL-5 - @echo "Bug: 739886" >> $(METADATA) # RHEL-6 - @echo "Bug: 843732" >> $(METADATA) # RHEL-6 - @echo "Bug: 859231" >> $(METADATA) # RHEL-6 - @echo "Bug: 916173" >> $(METADATA) # RHEL-7 - @echo "Bug: 1012051" >> $(METADATA) # RHEL-7 - @echo "Bug: 1103439" >> $(METADATA) # RHEL-6 - @echo "Bug: 1110397" >> $(METADATA) # RHEL-6 - @echo "Bug: 1166281" >> $(METADATA) # RHEL-7 - @echo "Bug: 1199473" >> $(METADATA) # RHEL-7 - @echo "Bug: 1312972" >> $(METADATA) # RHEL-7 - @echo "Bug: 1683754" >> $(METADATA) # RHEL-7 - @echo "Bug: 1759505" >> $(METADATA) # RHEL-8 - @echo "Bug: 1827591" >> $(METADATA) # Fedora 30 - @echo "Bug: 1923929" >> $(METADATA) # RHEL-9 - @echo "Bug: 2223725" >> $(METADATA) # Fedora 39 - @echo "Bug: 2224352" >> $(METADATA) # Fedora 38 - @echo "Bug: 2226703" >> $(METADATA) # Fedora 38 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE b/selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE deleted file mode 100644 index 5c1c31b..0000000 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts -Author: Milos Malik - -SELinux interferes with named and related programs. - diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf deleted file mode 100644 index 3228e5d..0000000 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf +++ /dev/null @@ -1,68 +0,0 @@ -summary: some named files in chroot-ed environment have wrong SELinux labels -description: |+ - SELinux interferes with named and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - bind - - bind-chroot - - caching-nameserver - - grep - - /usr/sbin/service - - libselinux - - libselinux-utils - - policycoreutils - - procps - - selinux-policy - - selinux-policy-targeted - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 2h -enabled: true -tag: - - NoRHEL4 - - TierCandidatesPASS - - f32friendly - - targeted - - NoRHIVOS - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=451970 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=562833 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=578187 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=698257 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739886 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=843732 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=859231 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=916173 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1012051 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1103439 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1110397 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1166281 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1199473 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1312972 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1683754 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1759505 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1827591 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1923929 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2223725 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2224352 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2226703 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0057489 -extra-summary: /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts -extra-task: /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts -id: dc594e14-f692-4537-9553-ce6aeab1a0cc diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh deleted file mode 100755 index 7df24ef..0000000 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh +++ /dev/null @@ -1,256 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts -# Description: some named files in chroot-ed environment have wrong SELinux labels -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -qa | grep bind | sort" - - rlServiceStop ` rlSEListServices 53 ` - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#451970" - rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" - rlSESearchRule "allow named_t port_t : udp_socket { name_bind }" - rlPhaseEnd - - rlPhaseStartTest "bz#562833" - if rlIsRHEL ">=11.0" || rlIsCentOS ">=11.0" || rlIsFedora ">=45" ; then - for PREFIX in "" "/var/named/chroot" ; do - rlSEMatchPathCon "${PREFIX}/dev/null" "null_device_t" - rlSEMatchPathCon "${PREFIX}/dev/random" "random_device_t" - rlSEMatchPathCon "${PREFIX}/dev/zero" "zero_device_t" - rlSEMatchPathCon "${PREFIX}/etc/named.conf" "named_conf_t" - rlSEMatchPathCon "${PREFIX}/run/named" "named_var_run_t" - rlSEMatchPathCon "${PREFIX}/var/log" "var_log_t" - rlSEMatchPathCon "${PREFIX}/var/log/named.log" "named_log_t" - rlSEMatchPathCon "${PREFIX}/var/named/data" "named_cache_t" - rlSEMatchPathCon "${PREFIX}/var/named/slaves" "named_cache_t" - rlSEMatchPathCon "${PREFIX}/var/named" "named_cache_t" - done - else - for PREFIX in "" "/var/named/chroot" ; do - rlSEMatchPathCon "${PREFIX}/dev/null" "null_device_t" - rlSEMatchPathCon "${PREFIX}/dev/random" "random_device_t" - rlSEMatchPathCon "${PREFIX}/dev/zero" "zero_device_t" - rlSEMatchPathCon "${PREFIX}/etc/named.conf" "named_conf_t" - rlSEMatchPathCon "${PREFIX}/run/named" "named_var_run_t" - rlSEMatchPathCon "${PREFIX}/var/log" "var_log_t" - rlSEMatchPathCon "${PREFIX}/var/log/named.log" "named_log_t" - rlSEMatchPathCon "${PREFIX}/var/named/data" "named_cache_t" - rlSEMatchPathCon "${PREFIX}/var/named/slaves" "named_cache_t" - rlSEMatchPathCon "${PREFIX}/var/named" "named_zone_t" - done - fi - rlPhaseEnd - - rlPhaseStartTest "bz#578187" - rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" - for PREFIX in "" "/var/named/chroot" ; do - rlSEMatchPathCon "${PREFIX}/var/named/dynamic" "named_cache_t" - done - rlSESearchRule "allow named_t named_t : process { getcap setcap getsched setsched setrlimit }" - rlPhaseEnd - - rlPhaseStartTest "bz#698257" - rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" - if rlIsRHEL 5 ; then - rlSEMatchPathCon "/var/named/chroot/var/log/update-debug.log" "named_log_t" - fi - rlSESearchRule "allow named_t named_log_t : file { append }" - rlPhaseEnd - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest "bz#739886" - rlSEMatchPathCon "$(readlink -en /usr/sbin/rndc)" "ndc_exec_t" - rlRun "ls -Z /proc/loadavg | grep :proc_t" - rlSESearchRule "allow ndc_t proc_t : file { getattr open read }" - rlPhaseEnd - - rlPhaseStartTest "bz#843732 + bz#916173" - for PREFIX in "" "/var/named/chroot" ; do - rlSEMatchPathCon "${PREFIX}/lib" "lib_t" - rlSEMatchPathCon "${PREFIX}/lib64" "lib_t" - rlSEMatchPathCon "${PREFIX}/usr/lib" "lib_t" - rlSEMatchPathCon "${PREFIX}/usr/lib64" "lib_t" - done - rlSEMatchPathCon "/var/named/chroot/etc/localtime" "locale_t" - rlPhaseEnd - - rlPhaseStartTest "bz#1110397 + bz#1166281" - rlSEMatchPathCon "$(readlink -en /usr/sbin/rndc)" "ndc_exec_t" - rlSEMatchPathCon "/dev/random" "random_device_t" - rlSEMatchPathCon "/dev/urandom" "urandom_device_t" - rlSESearchRule "allow ndc_t random_device_t : chr_file { getattr open read }" - rlSESearchRule "allow ndc_t urandom_device_t : chr_file { getattr open read }" - rlPhaseEnd - fi - - if rlIsRHEL 6 ; then - rlPhaseStartTest "bz#859231" - rlSEMatchPathCon "/var/tmp/DNS_25" "named_tmp_t" - rlPhaseEnd - - rlPhaseStartTest "bz#1103439 + bz#1199473" - rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" - rlSEMatchPortCon udp 1935 flash_port_t - rlSEMatchPortCon udp 2605 bgp_port_t - rlSEMatchPortCon udp 4321 whois_port_t - rlSEMatchPortCon udp 6514 syslogd_port_t - rlSEMatchPortCon udp 8610 ipp_port_t - rlSEMatchPortCon udp 8611 ipp_port_t - rlSEMatchPortCon udp 8612 ipp_port_t - rlSEMatchPortCon udp 8613 ipp_port_t - rlSEMatchPortCon udp 8614 ipp_port_t - rlSESearchRule "dontaudit named_t flash_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "dontaudit named_t ipp_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "dontaudit named_t syslogd_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "dontaudit named_t whois_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "dontaudit named_t bgp_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "allow named_t reserved_port_t : udp_socket { name_bind } [ ]" 1 - rlSESearchRule "allow named_t hi_reserved_port_t : udp_socket { name_bind } [ ]" 1 - rlSESearchRule "dontaudit named_t reserved_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "dontaudit named_t hi_reserved_port_t : udp_socket { name_bind } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1012051" - rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" - rlSESearchRule "allow named_t named_t : key { read write }" - rlPhaseEnd - - rlPhaseStartTest "bz#1312972" - rlSEMatchPortCon udp 1935 flash_port_t - rlSEMatchPortCon udp 2605 bgp_port_t - rlSEMatchPortCon udp 4321 whois_port_t - rlSEMatchPortCon udp 4444 kerberos_port_t - rlSEMatchPortCon udp 5546 dhcpc_port_t - if rlIsRHEL 7 ; then - rlSEMatchPortCon udp 61000 ephemeral_port_t - else # RHEL-8 and Fedora - rlSEMatchPortCon udp 60999 ephemeral_port_t - fi - rlSEMatchPortCon udp 8554 rtsp_port_t - rlSEMatchPortCon udp 8610 ipp_port_t - rlSEMatchPortCon udp 8611 ipp_port_t - rlSEMatchPortCon udp 8612 ipp_port_t - rlSEMatchPortCon udp 8613 ipp_port_t - rlSEMatchPortCon udp 8614 ipp_port_t - rlSESearchRule "allow named_t bgp_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "allow named_t dhcpc_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "allow named_t ephemeral_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "allow named_t flash_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "allow named_t ipp_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "allow named_t kerberos_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "allow named_t rtsp_port_t : udp_socket { name_bind } [ ]" - rlSESearchRule "allow named_t whois_port_t : udp_socket { name_bind } [ ]" - COUNT=`seinfo --portcon | cut -d : -f 3 | sort | uniq | wc -l` - rlLog "Number of defined SELinux ports which have at least 1 port number assigned is $COUNT" - for PORT_TYPE in `seinfo --portcon | cut -d : -f 3 | sort | uniq` ; do - if rlIsRHEL 5 6 7 ; then - sesearch -s named_t -t ${PORT_TYPE} -c udp_socket -p name_bind -A -C -D | grep -v '\]' | grep -q -e allow -e dontaudit - else - sesearch -s named_t -t ${PORT_TYPE} -c udp_socket -p name_bind -A --dontaudit | grep -v '\]' | grep -q -e allow -e dontaudit - fi - if [ $? -eq 1 ] ; then - rlFail "named_t access to ${PORT_TYPE}:udp_socket via name_bind operation is neither allowed nor dontaudited" - fi - done - rlLog "all $COUNT defined SELinux ports tested" - rlPhaseEnd - - rlPhaseStartTest "bz#1683754" - rlRun "ls -dZ /proc/sys/net | grep :sysctl_net_t" - rlRun "ls -dZ /proc/sys/net/ipv4 | grep :sysctl_net_t" - rlRun "ls -Z /proc/sys/net/ipv4/ip_local_port_range | grep :sysctl_net_t" - rlSESearchRule "allow named_t sysctl_net_t : dir { getattr open search } [ ]" - rlSESearchRule "allow named_t sysctl_net_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1759505" - rlSEMatchPathCon "/etc/named" "named_conf_t" - rlSEMatchPathCon "/etc/named/test.conf" "named_conf_t" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then - rlPhaseStartTest "bz#1827591 + bz#1923929" - rlSEMatchPathCon "$(readlink -en /usr/sbin/rndc)" "ndc_exec_t" - rlSESearchRule "dontaudit ndc_t ndc_t : process { setsched } [ ]" - rlPhaseEnd - fi - - if rlIsFedora '>=38' ; then - rlPhaseStartTest "bz#2223725 + bz#2224352 + bz#2226703" - rlSESearchRule "allow named_t named_t : io_uring { sqpoll } [ ]" - rlSESearchRule "allow ndc_t ndc_t : io_uring { sqpoll } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario" - if ! rlIsRHEL 5 ; then - rlRun "semodule -l | grep bind" - fi - rlRun "getsebool -a | grep named" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - rlSEService ${ROOT_PASSWORD} named named named_t "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc querylog'" - rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc dumpdb'" - rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc tsig-list'" - rlSEService ${ROOT_PASSWORD} named named named_t "restart status stop status" 1 - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ` rlSEListServices 53 ` - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/bz624405-pcsc-and-similar/Makefile b/selinux-policy/bz624405-pcsc-and-similar/Makefile deleted file mode 100644 index 18528c2..0000000 --- a/selinux-policy/bz624405-pcsc-and-similar/Makefile +++ /dev/null @@ -1,95 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar -# Description: SELinux interferes with pcscd -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with pcscd" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: pcsc-lite" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: expect" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Requires: initscripts" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: pcsc-lite" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: procps" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-mls" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Requires: setools" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Architectures: i386 ia64 ppc ppc64 x86_64" >> $(METADATA) - @echo "Bug: 624405" >> $(METADATA) # RHEL-6 - @echo "Bug: 752453" >> $(METADATA) # RHEL-6 - @echo "Bug: 1605641" >> $(METADATA) # RHEL-7 - @echo "Bug: 1802423" >> $(METADATA) # Fedora 32 - @echo "Bug: 1805719" >> $(METADATA) # Fedora 32 - @echo "Bug: 1806129" >> $(METADATA) # Fedora 32 - @echo "Bug: 1816787" >> $(METADATA) # Fedora 32 - @echo "Bug: 1818759" >> $(METADATA) # Fedora 32 - @echo "Bug: 1825182" >> $(METADATA) # Fedora 32 - @echo "Bug: 1825188" >> $(METADATA) # Fedora 32 - @echo "Bug: 2355930" >> $(METADATA) # Fedora 43 - @echo "Bug: 2356058" >> $(METADATA) # Fedora 43 - @echo "Bug: 2357154" >> $(METADATA) # Fedora 43 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/bz624405-pcsc-and-similar/PURPOSE b/selinux-policy/bz624405-pcsc-and-similar/PURPOSE deleted file mode 100644 index c9c36f2..0000000 --- a/selinux-policy/bz624405-pcsc-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar -Author: Milos Malik - -SELinux interferes with pcscd and related programs. - diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf deleted file mode 100644 index eccec8d..0000000 --- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf +++ /dev/null @@ -1,65 +0,0 @@ -summary: SELinux interferes with pcscd -description: |+ - SELinux interferes with pcscd and related programs. - -contact: Milos Malik -component: - - pcsc-lite - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - expect - - grep - - /usr/sbin/service - - libselinux - - libselinux-utils - - pcsc-lite - - policycoreutils - - procps - - selinux-policy - - selinux-policy-mls - - selinux-policy-targeted - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - TIPpass - - TIPpass_FIPS - - TIPpass_Security - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=624405 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=752453 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1605641 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1802423 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1805719 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1806129 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1816787 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1818759 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825182 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825188 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2355930 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2356058 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2357154 -adjust+: - - enabled: false - when: arch == s390, s390x - continue: false - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0057525 -extra-summary: /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar -extra-task: /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar -id: 43cb4c7e-4e58-4b9b-82ea-8c9438ee0030 diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh deleted file mode 100755 index c202480..0000000 --- a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh +++ /dev/null @@ -1,123 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar -# Description: SELinux interferes with pcscd -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -SERVICE_NAME="pcscd" -PROCESS_CONTEXT="pcscd_t" -PROCESS_NAME="pcscd" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-mls - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm pcsc-lite - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#624405" - rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" - if rlIsRHEL 5 ; then - rlRun "ls -dZ /sys | grep :sysfs_t" - rlRun "ls -dZ /sys/devices | grep :sysfs_t" - rlSESearchRule "allow pcscd_t sysfs_t : dir { getattr search }" - else - rlSEMatchPathCon "/sys" "sysfs_t" - rlSEMatchPathCon "/sys/devices" "sysfs_t" - rlSESearchRule "allow pcscd_t sysfs_t : dir { getattr open read search }" - rlSESearchRule "allow pcscd_t sysfs_t : file { getattr open read }" - fi - rlPhaseEnd - - rlPhaseStartTest "bz#752453" - rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" - rlSESearchRule "allow pcscd_t usb_device_t : chr_file { getattr read write }" - rlPhaseEnd - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1605641" - rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" - rlSESearchRule "dontaudit pcscd_t pcscd_t : capability { sys_admin }" - rlPhaseEnd - fi - - if rlIsFedora ; then - rlPhaseStartTest "bz#1806129 + bz#1816787 + bz#1818759 + bz#1825182 + bz#1825188" - rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" - rlSESearchRule "dontaudit pcscd_t pcscd_t : capability { sys_nice } [ daemons_dontaudit_scheduling ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1802423 + bz#1805719" - rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" - rlSESearchRule "dontaudit pcscd_t pcscd_t : process { setsched } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2355930 + bz#2356058 + bz#2357154" - rlSESearchRule "allow init_t pcscd_t : process2 { nnp_transition } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- bz#624405" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/bz733494-amanda-and-similar/Makefile b/selinux-policy/bz733494-amanda-and-similar/Makefile deleted file mode 100644 index 695123f..0000000 --- a/selinux-policy/bz733494-amanda-and-similar/Makefile +++ /dev/null @@ -1,96 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar -# Description: SELinux interferes with amanda and related tools -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE krb5.conf krb5.keytab - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with amanda and related tools" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: amanda" >> $(METADATA) - @echo "Requires: amanda" >> $(METADATA) - @echo "Requires: amanda-client" >> $(METADATA) - @echo "Requires: amanda-server" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: initscripts" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: nc" >> $(METADATA) - @echo "Requires: net-tools" >> $(METADATA) - @echo "Requires: nmap-ncat" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: procps-ng" >> $(METADATA) - @echo "Requires: krb5-workstation" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Requires: setools" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "Requires: xinetd" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 283971" >> $(METADATA) # RHEL-5 - @echo "Bug: 498596" >> $(METADATA) # RHEL-5 - @echo "Bug: 729361" >> $(METADATA) # RHEL-6 - @echo "Bug: 733494" >> $(METADATA) # RHEL-6 - @echo "Bug: 965140" >> $(METADATA) # RHEL-7 - @echo "Bug: 1371561" >> $(METADATA) # RHEL-7 - @echo "Bug: 1452444" >> $(METADATA) # RHEL-7 - @echo "Bug: 1623052" >> $(METADATA) # RHEL-7 - @echo "Bug: 1630963" >> $(METADATA) # RHEL-7 - @echo "Bug: 1739137" >> $(METADATA) # RHEL-8 - @echo "Bug: 1960513" >> $(METADATA) # Fedora 34 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/bz733494-amanda-and-similar/PURPOSE b/selinux-policy/bz733494-amanda-and-similar/PURPOSE deleted file mode 100644 index f6d2f5d..0000000 --- a/selinux-policy/bz733494-amanda-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar -Author: Milos Malik - -SELinux interferes with amandad and related programs. - diff --git a/selinux-policy/bz733494-amanda-and-similar/krb5.conf b/selinux-policy/bz733494-amanda-and-similar/krb5.conf deleted file mode 100644 index 981c0de..0000000 --- a/selinux-policy/bz733494-amanda-and-similar/krb5.conf +++ /dev/null @@ -1,27 +0,0 @@ -# Configuration snippets may be placed in this directory as well -includedir /etc/krb5.conf.d/ - -[logging] - default = FILE:/var/log/krb5libs.log - kdc = FILE:/var/log/krb5kdc.log - admin_server = FILE:/var/log/kadmind.log - -[libdefaults] - dns_lookup_realm = false - ticket_lifetime = 24h - renew_lifetime = 7d - forwardable = true - rdns = false - pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt - default_realm = EXAMPLE.COM - default_ccache_name = KEYRING:persistent:%{uid} - -[realms] - EXAMPLE.COM = { - kdc = kerberos.example.com - admin_server = kerberos.example.com - } - -[domain_realm] - .example.com = EXAMPLE.COM - example.com = EXAMPLE.COM diff --git a/selinux-policy/bz733494-amanda-and-similar/krb5.keytab b/selinux-policy/bz733494-amanda-and-similar/krb5.keytab deleted file mode 100644 index c820713..0000000 Binary files a/selinux-policy/bz733494-amanda-and-similar/krb5.keytab and /dev/null differ diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf deleted file mode 100644 index fe87add..0000000 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ /dev/null @@ -1,66 +0,0 @@ -summary: SELinux interferes with amanda and related tools -description: |+ - SELinux interferes with amandad and related programs. - -contact: Milos Malik -component: - - amanda - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - amanda - - amanda-client - - amanda-server - - audit - - initscripts - - libselinux - - libselinux-utils - - nc - - net-tools - - nmap-ncat - - policycoreutils - - procps-ng - - krb5-workstation - - selinux-policy - - selinux-policy-targeted - - setools-console - - xinetd -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - TierCandidatesFAIL - - f32friendly - - rhel9-buildroot - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=283971 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=498596 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=729361 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=733494 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=965140 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1371561 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1452444 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1623052 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1630963 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1739137 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1960513 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1065002 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1572696 -adjust+: - - enabled: false - when: distro >= rhel-9 - because: the amanda package is not available there - - enabled: false - when: distro >= centos-stream-9 - because: the amanda package is not available there -extra-nitrate: TC#0114575 -extra-summary: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar -extra-task: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar -id: d3191af0-4b52-47b8-90bf-fa6fbf3edc47 diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh deleted file mode 100755 index 10c06e4..0000000 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ /dev/null @@ -1,275 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar -# Description: SELinux interferes with amanda and related tools -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/lib/amanda/amandad" -FILE_CONTEXT="amanda_inetd_exec_t" -SERVICE_NAME="amanda" -PROCESS_NAME="amandad" -PROCESS_CONTEXT="amanda_t" - -rlJournalStart - if rlIsRHEL && ! rlIsRHEL 7 8 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm amanda - rlAssertRpm amanda-client - rlAssertRpm amanda-server - - if rlIsRHEL 5 6 ; then - rlServiceStop xinetd - fi - rlFileBackup /etc/shadow - rlFileBackup /etc/krb5.conf - rlFileBackup /etc/krb5.keytab - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#283971" - # META-Fixed-In: selinux-policy-2.4.6-91.el5 - if ! rlIsRHEL 5 ; then - rlSEMatchPathCon "/usr/sbin/amandad" "bin_t" - fi - rlSEMatchPathCon "/usr/lib/amanda/amandad" "amanda_inetd_exec_t" - rlSEMatchPortCon "tcp" "389" "ldap_port_t" - if ! rlIsRHEL 7 ; then - rlSESearchRule "allow amanda_t ldap_port_t : tcp_socket { name_connect }" - fi - rlPhaseEnd - - rlPhaseStartTest "bz#498596" - # META-Fixed-In: selinux-policy-2.4.6-230.el5 - rlSEMatchPathCon "/usr/lib/amanda/killpgrp" "amanda_exec_t" - rlSESearchRule "allow amanda_t fsadm_t : process { signal }" - rlPhaseEnd - - if rlIsRHEL 6 ; then - rlPhaseStartTest "bz#729361" - rlSEMatchPathCon "/bin/mailx" "sendmail_exec_t" - rlSEMatchPathCon "/var/lib/amanda/Data/amdump" "amanda_data_t" - rlSEMatchPathCon "/var/lib/amanda/Data/log" "amanda_log_t" - rlSESearchRule "allow sendmail_t amanda_var_lib_t : file { getattr open append }" - # FIXME: based on known AVCs there is a problem with initrc_tmp_t file - rlPhaseEnd - fi - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest "bz#733494" - # META-Fixed-In: selinux-policy-3.7.19-109.el6 - rlSESearchRule "allow amanda_t amanda_t : process { setsched }" - rlSESearchRule "allow amanda_t amanda_data_t : lnk_file { create unlink }" - rlSESearchRule "allow amanda_t amanda_data_t : dir { add_name remove_name create rmdir write }" - # FIXME: dontaudit rules for getattr operations on directories in /proc are missing - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1371561" - rlSEMatchPathCon "/var/lib" "var_lib_t" - rlSEMatchPathCon "/var/lib/amanda" "amanda_var_lib_t" - rlSESearchRule "allow amanda_t var_lib_t : dir { add_name write }" - rlSESearchRule "allow amanda_t amanda_t : capability { sys_admin }" - rlSESearchRule "type_transition amanda_t var_lib_t : dir amanda_var_lib_t" - rlSESearchRule "allow amanda_t amanda_var_lib_t : dir { create setattr }" - rlSESearchRule "allow amanda_t amanda_var_lib_t : file { create setattr write }" - rlPhaseEnd - - rlPhaseStartTest "bz#1452444" - rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" - rlSEMatchPathCon "/dev/shm" "tmpfs_t" - rlSESearchRule "type_transition amanda_t tmpfs_t : dir amanda_tmpfs_t" - rlSESearchRule "type_transition amanda_t tmpfs_t : file amanda_tmpfs_t" - rlSESearchRule "allow amanda_t tmpfs_t : filesystem { getattr }" - rlSESearchRule "allow amanda_t tmpfs_t : dir { read write add_name remove_name }" - rlSESearchRule "allow amanda_t amanda_tmpfs_t : dir { getattr open read write search add_name remove_name }" - rlSESearchRule "allow amanda_t amanda_tmpfs_t : file { getattr open read write create link unlink }" - rlSESearchRule "allow amanda_t amanda_t : capability { setgid }" - rlSESearchRule "allow amanda_t proc_net_t : file { getattr open read }" - rlPhaseEnd - fi - - if false ; then - rlPhaseStartTest "bz#1623052" - rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" - rlSEMatchPathCon "/var/tmp/host_0" "krb5_host_rcache_t" - rlSESearchRule "allow amanda_t krb5_host_rcache_t : file { write unlink } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "bz#965140" - if rlIsRHEL 5 ; then - SOURCE_TYPE="inetd_t" # xinetd runs the process - BOOLEANS="[ amanda_disable_trans ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="inetd_t" # xinetd runs the process - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/usr/sbin/prelink" "prelink_exec_t" - rlSEMatchPathCon "/usr/lib/amanda/*" "amanda_exec_t" - rlSEMatchPathCon "/usr/lib64/amanda/*" "amanda_exec_t" - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" - rlSESearchRule "allow prelink_t amanda_exec_t : file { getattr }" - rlSESearchRule "allow setroubleshootd_t amanda_exec_t : file { getattr }" - rlSESearchRule "allow unconfined_t amanda_exec_t : file { getattr }" - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1630963" - rlSESearchRule "allow amanda_t amanda_tmpfs_t : file { map } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1739137" - # xfsdump is executed from amanda_t and stays in amanda_t - rlSEMatchPathCon "/usr/sbin/xfsdump" "bin_t" - rlSEMatchPathCon "/dev/random" "random_device_t" - rlSEMatchPathCon "/var/lib/xfsdump" "var_lib_t" - rlSEMatchPathCon "/var/lib/xfsdump/inventory" "amanda_var_lib_t" - rlSEMatchPathCon "/var/lib/xfsdump/inventory/1fa2bf89-02c1-4bba-bc3d-a265cbd5eff2.InvIndex" "amanda_var_lib_t" - rlSESearchRule "allow amanda_t random_device_t : chr_file { getattr open read } [ ]" - rlSESearchRule "allow amanda_t amanda_var_lib_t : file { create write setattr } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then - rlPhaseStartTest "bz#1960513" - rlRun "ls -l /usr/sbin/amandad" - rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" - rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t" - rlSESearchRule "allow amanda_t cgroup_t : filesystem { getattr } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "real scenario -- amanda-udp" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlRun "systemctl enable amanda-udp.socket" - rlRun "systemctl start amanda-udp.socket" - rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "restart status stop status" 1 - rlRun "systemctl stop amanda-udp.socket" - rlRun "systemctl disable amanda-udp.socket" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- kamanda" - rlRun "rm -f /etc/krb5.conf /etc/krb5.keytab" - FQDN=`hostname -f` - rlRun 'echo -en "read_kt krb5.keytab\nclear\nadd_entry -password -p host/${FQDN}@EXAMPLE.COM -k 2 -e aes128-cts-hmac-sha1-96\nblahblah\nwrite_kt krb5.keytab\nl\nq\n" | ktutil' - rlRun "cp krb5.conf krb5.keytab /etc" - rlRun "restorecon -Rv /etc" - PORT_NUMBER="10082" - HOST_ADDRESS="127.0.0.1" - rlRun "systemctl enable kamanda.socket" - rlRun "systemctl start kamanda.socket" - rlLog "starting provocateur job" - ( tail -f - | ncat ${HOST_ADDRESS} ${PORT_NUMBER} ) & - PROVOCATEUR_PID=$! - sleep 1 - rlRun "netstat -tupan | grep :${PORT_NUMBER}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" - rlRun "kill ${PROVOCATEUR_PID}" - rlRun "killall ncat" 0,1 - rlRun "systemctl stop kamanda.socket" - rlRun "systemctl disable kamanda.socket" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then - rlPhaseStartTest "real scenario -- xinetd service" - HOST_ADDRESS="127.0.0.1" - PORT_NUMBER="10080" # number or socket path - if rlIsRHEL 5 6 ; then - PORT_TYPE="-u" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) - rlRun "chkconfig ${SERVICE_NAME} on" - rlRun "service xinetd restart" - rlLog "starting provocateur job" - ( echo | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & - PROVOCATEUR_PID=$! - else - PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) - rlRun "systemctl enable ${SERVICE_NAME}.socket" - rlRun "systemctl start ${SERVICE_NAME}.socket" - rlLog "starting provocateur job" - ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & - PROVOCATEUR_PID=$! - fi - sleep 1 - rlRun "netstat -tupan | grep :${PORT_NUMBER}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" - rlRun "kill ${PROVOCATEUR_PID}" - rlRun "killall ncat" 0,1 - if rlIsRHEL 5 6 ; then - rlRun "chkconfig ${SERVICE_NAME} off" - rlRun "service xinetd stop" - else - rlRun "systemctl stop ${SERVICE_NAME}.socket" - rlRun "systemctl disable ${SERVICE_NAME}.socket" - fi - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - if rlIsRHEL 5 6 ; then - rlServiceRestore xinetd - fi - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/caddy-and-similar/Makefile b/selinux-policy/caddy-and-similar/Makefile deleted file mode 100644 index 30ed418..0000000 --- a/selinux-policy/caddy-and-similar/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/caddy-and-similar -# Description: SELinux interferes with caddy services and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/caddy-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with caddy services and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console caddy /usr/sbin/semanage" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL10" >> $(METADATA) - @echo "Bug: 1706651" >> $(METADATA) # Fedora 30 - @echo "Bug: 2122886" >> $(METADATA) # Fedora 36 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/caddy-and-similar/PURPOSE b/selinux-policy/caddy-and-similar/PURPOSE deleted file mode 100644 index b87aa22..0000000 --- a/selinux-policy/caddy-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/caddy-and-similar -Author: Milos Malik - -Description: SELinux interferes with caddy services and related programs - diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf deleted file mode 100644 index b6fe343..0000000 --- a/selinux-policy/caddy-and-similar/main.fmf +++ /dev/null @@ -1,44 +0,0 @@ -summary: SELinux interferes with caddy services and related programs -description: |+ - SELinux interferes with caddy services and related programs - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - caddy - - /usr/sbin/semanage -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - failinfedora - - targeted - - epel - - rhel8-epel - - rhel9-epel - - NoRHIVOS - - avoidImageMode -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, centos-stream-10, rhel-10 - because: the caddy package is not available there -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1706651 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2122886 -extra-summary: /CoreOS/selinux-policy/Regression/caddy-and-similar -extra-task: /CoreOS/selinux-policy/Regression/caddy-and-similar -extra-nitrate: TC#0614303 -id: 31fd828a-6d5a-4977-af70-b751ec50366e diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh deleted file mode 100755 index b970b6a..0000000 --- a/selinux-policy/caddy-and-similar/runtest.sh +++ /dev/null @@ -1,91 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/caddy-and-similar -# Description: SELinux interferes with caddy services and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SERVICE_PACKAGE="caddy" -PROCESS_NAME="caddy" -PROCESS_CONTEXT="httpd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi - - rlServiceStop caddy caddy-api - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1706651" - rlSEMatchPathCon "/usr/bin/caddy" "httpd_exec_t" - rlSEMatchPathCon "/var/lib/caddy" "httpd_var_lib_t" - rlSESearchRule "allow init_t httpd_exec_t : file { getattr open read execute } [ ]" - rlSESearchRule "type_transition init_t httpd_exec_t : process httpd_t [ ]" - rlSESearchRule "allow init_t httpd_t : process { transition } [ ]" - rlSESearchRule "allow init_t httpd_var_lib_t : dir { mounton } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2122886" - rlSEMatchPathCon "/usr/bin/caddy" "httpd_exec_t" - rlRun "ls -Z /proc/sys/net/core/somaxconn | grep :sysctl_net_t" - rlSESearchRule "allow httpd_t sysctl_net_t : file { getattr open read } [ ]" - rlPhaseEnd - - if ls /usr/lib/systemd/system/caddy*.service ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "semanage fcontext -l -C | grep caddy" - for SERVICE_NAME in caddy caddy-api ; do - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - done - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlServiceRestore caddy caddy-api - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/capability2-class/Makefile b/selinux-policy/capability2-class/Makefile deleted file mode 100644 index aa75e64..0000000 --- a/selinux-policy/capability2-class/Makefile +++ /dev/null @@ -1,68 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Sanity/capability2-class -# Description: Does SELinux policy define new capabilities in capability2 class? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Sanity/capability2-class -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does SELinux policy define new capabilities in capability2 class?" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit git libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 1915264" >> $(METADATA) # Fedora rawhide - - rhts-lint $(METADATA) - diff --git a/selinux-policy/capability2-class/PURPOSE b/selinux-policy/capability2-class/PURPOSE deleted file mode 100644 index c18e355..0000000 --- a/selinux-policy/capability2-class/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Sanity/capability2-class -Author: Milos Malik - -Description: Does SELinux policy define new capabilities in capability2 class? - diff --git a/selinux-policy/capability2-class/main.fmf b/selinux-policy/capability2-class/main.fmf deleted file mode 100644 index a53e8a0..0000000 --- a/selinux-policy/capability2-class/main.fmf +++ /dev/null @@ -1,33 +0,0 @@ -path: /selinux-policy/capability2-class -contact: Milos Malik -test: ./runtest.sh -framework: beakerlib -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - git - - libselinux - - libselinux-utils - - policycoreutils - - setools-console - - selinux-policy - - selinux-policy-targeted -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915264 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - continue: false -extra-nitrate: TC#0615396 -id: 251fd08a-0f65-4592-8d4d-2b79e9479460 -tag: - - NoRHIVOS diff --git a/selinux-policy/capability2-class/runtest.sh b/selinux-policy/capability2-class/runtest.sh deleted file mode 100755 index 73e7d37..0000000 --- a/selinux-policy/capability2-class/runtest.sh +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Sanity/capability2-class -# Description: Does SELinux policy define new capabilities in capability2 class? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1915264" - rlRun "seinfo --common cap2 -x" - for CAPABILITY in perfmon bpf checkpoint_restore ; do - rlRun "seinfo --common cap2 -x | grep -w ${CAPABILITY}" - done - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/chronyd-and-similar/Makefile b/selinux-policy/chronyd-and-similar/Makefile deleted file mode 100644 index a26d46f..0000000 --- a/selinux-policy/chronyd-and-similar/Makefile +++ /dev/null @@ -1,112 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/chronyd-and-similar -# Description: SELinux interferes with chronyd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/chronyd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE chrony-nts-test.sh - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh chrony-nts-test.sh - chcon -t bin_t runtest.sh chrony-nts-test.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with chronyd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 1h" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: chrony" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy-mls selinux-policy-targeted setools-console chrony ksh nscd /usr/bin/certtool /usr/sbin/service socat linuxptp" >> $(METADATA) # EPEL - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Architectures: i386 ppc64 x86_64" >> $(METADATA) - @echo "Bug: 974992" >> $(METADATA) # RHEL-7 - @echo "Bug: 978993" >> $(METADATA) # RHEL-6 - @echo "Bug: 1243764" >> $(METADATA) # RHEL-7 - @echo "Bug: 1243987" >> $(METADATA) # RHEL-7 - @echo "Bug: 1273116" >> $(METADATA) # RHEL-7 - @echo "Bug: 1281473" >> $(METADATA) # RHEL-6 - @echo "Bug: 1290310" >> $(METADATA) # RHEL-6 - @echo "Bug: 1350765" >> $(METADATA) # RHEL-7 - @echo "Bug: 1390657" >> $(METADATA) # RHEL-6 - @echo "Bug: 1416015" >> $(METADATA) # RHEL-7 - @echo "Bug: 1421248" >> $(METADATA) # RHEL-7 - @echo "Bug: 1425408" >> $(METADATA) # RHEL-7 - @echo "Bug: 1440791" >> $(METADATA) # RHEL-7 - @echo "Bug: 1470150" >> $(METADATA) # RHEL-7 - @echo "Bug: 1508486" >> $(METADATA) # RHEL-7 - @echo "Bug: 1509379" >> $(METADATA) # RHEL-7 - @echo "Bug: 1509927" >> $(METADATA) # RHEL-7 - @echo "Bug: 1530525" >> $(METADATA) # RHEL-7 - @echo "Bug: 1567753" >> $(METADATA) # RHEL-7 - @echo "Bug: 1568281" >> $(METADATA) # RHEL-7 - @echo "Bug: 1574418" >> $(METADATA) # RHEL-7 - @echo "Bug: 1575002" >> $(METADATA) # RHEL-7 - @echo "Bug: 1577057" >> $(METADATA) # RHEL-7 - @echo "Bug: 1593267" >> $(METADATA) # RHEL-7 - @echo "Bug: 1593607" >> $(METADATA) # RHEL-8 - @echo "Bug: 1596563" >> $(METADATA) # RHEL-7 - @echo "Bug: 1618757" >> $(METADATA) # RHEL-7 - @echo "Bug: 1622499" >> $(METADATA) # RHEL-8 - @echo "Bug: 1652079" >> $(METADATA) # RHEL-7 - @echo "Bug: 1696252" >> $(METADATA) # RHEL-8 - @echo "Bug: 1772852" >> $(METADATA) # RHEL-8 - @echo "Bug: 1895825" >> $(METADATA) # RHEL-9 - @echo "Bug: 1900143" >> $(METADATA) # Fedora 34 - @echo "Bug: 1961207" >> $(METADATA) # RHEL-8 - @echo "Bug: 2008894" >> $(METADATA) # Fedora 35 - @echo "Bug: 2065313" >> $(METADATA) # RHEL-8 - @echo "Bug: 2118628" >> $(METADATA) # RHEL-8 - @echo "Bug: 2118631" >> $(METADATA) # RHEL-9 - @echo "Bug: 2173604" >> $(METADATA) # RHEL-9 - @echo "Bug: 2169949" >> $(METADATA) # Fedora-38 - @echo "Bug: RHEL-18219" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-82299" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-82308" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/chronyd-and-similar/PURPOSE b/selinux-policy/chronyd-and-similar/PURPOSE deleted file mode 100644 index b67781b..0000000 --- a/selinux-policy/chronyd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/chronyd-and-similar -Author: Milos Malik - -SELinux interferes with chronyc, chronyd and related programs. - diff --git a/selinux-policy/chronyd-and-similar/chrony-nts-test.sh b/selinux-policy/chronyd-and-similar/chrony-nts-test.sh deleted file mode 100755 index 4771d70..0000000 --- a/selinux-policy/chronyd-and-similar/chrony-nts-test.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash - -set -e - -server_name=chrony-nts-test -cert=/etc/pki/tls/certs/nts.crt -key=/etc/pki/tls/private/nts.key - -sed -i "/ $server_name\$/d" /etc/hosts -echo "127.0.0.1 $server_name" >> /etc/hosts - -cat > cert.cfg < /etc/chrony.conf < -component: - - chrony - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy-mls - - selinux-policy-targeted - - setools-console - - chrony - - ksh - - nscd - - /usr/bin/certtool - - /usr/sbin/service - - socat - - linuxptp -environment: - AVC_ERROR: +no_avc_check -duration: 1h -enabled: true -tag: - - NoRHEL4 - - TIP_fedora_fail - - TIPfail_Security - - TIPfail_fedora - - TIPfail_infra - - TIPpass - - TipWaived6 - - f33friendly - - targeted - - NoRHIVOS -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=974992 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=978993 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243764 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243987 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1273116 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1281473 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1290310 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1350765 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390657 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1416015 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1421248 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1425408 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1440791 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470150 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1508486 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1509379 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1509927 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1530525 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1567753 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1568281 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574418 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1575002 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1577057 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593267 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593607 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1596563 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618757 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1622499 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1652079 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1696252 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772852 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1895825 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900143 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961207 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008894 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2065313 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949493 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118628 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118631 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173604 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2169949 - - verifies: https://issues.redhat.com/browse/RHEL-18219 - - verifies: https://issues.redhat.com/browse/RHEL-82299 - - verifies: https://issues.redhat.com/browse/RHEL-82308 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false - - enabled: false - when: arch == ia64, ppc, s390 - continue: false -extra-nitrate: TC#0202180 -extra-summary: /CoreOS/selinux-policy/Regression/chronyd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/chronyd-and-similar -id: d247a2ee-7ce9-4ee2-b3f7-3b04102c7b83 diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh deleted file mode 100755 index 269bb91..0000000 --- a/selinux-policy/chronyd-and-similar/runtest.sh +++ /dev/null @@ -1,465 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/chronyd-and-similar -# Description: SELinux interferes with chronyd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -SERVICE_PACKAGE="chrony" -SERVICE_NAME="chronyd" -PROCESS_NAME="chronyd" -PROCESS_CONTEXT="chronyd_t" -CHRONYD_RESTRICTED_SERVICE="chronyd-restricted" -CHRONYD_RESTRICTED_UNIT_FILE="/usr/lib/systemd/system/chronyd-restricted.service" -CHRONYD_RESTRICTED_UNIT_DROPIN_DIR="/etc/systemd/system/chronyd-restricted.service.d" -CHRONYD_RESTRICTED_UNIT_DROPIN_FILE="${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}/context.conf" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop `rlSEListServices 123` - rlFileBackup /etc/chrony.conf - rlFileBackup /etc/shadow - rlFileBackup /etc/chrony.keys - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest "bz#974992 + bz#978993" - rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" - rlSESearchRule "allow chronyd_t chronyd_t : capability { sys_nice } [ ]" - rlSESearchRule "allow chronyd_t chronyd_t : process { setsched } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1243764 + bz#1243987" - rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t" - rlSEMatchPathCon "/var/run/chrony-helper" "chronyd_var_run_t" - rlSEMatchPathCon "/var/run/chrony-helper/added_servers" "chronyd_var_run_t" - rlSEMatchPathCon "/var/run/chrony-helper/lock" "chronyd_var_run_t" - rlSEMatchPathCon "/var/lib/dhclient" "dhcpc_state_t" - rlSEMatchPathCon "/var/lib/dhclient/chrony.servers.eth0" "dhcpc_state_t" - rlSEMatchPathCon "/usr/bin/systemctl" "systemd_systemctl_exec_t" - rlSESearchRule "allow dhcpc_t chronyd_exec_t : file { getattr open read execute }" - rlSESearchRule "type_transition dhcpc_t chronyd_exec_t : process chronyd_t" - rlSESearchRule "allow dhcpc_t chronyd_t : process { transition }" - rlSESearchRule "allow chronyd_t var_run_t : dir { read write add_name remove_name search open getattr }" - rlSESearchRule "type_transition chronyd_t var_run_t : dir chronyd_var_run_t" - rlSESearchRule "allow chronyd_t chronyd_var_run_t : dir { read write add_name remove_name search open getattr }" - rlSESearchRule "allow chronyd_t chronyd_var_run_t : file { getattr open read write create unlink }" - rlSESearchRule "allow chronyd_t dhcpc_state_t : dir { getattr open read search }" - rlSESearchRule "allow chronyd_t dhcpc_state_t : file { getattr open read }" - rlSESearchRule "allow chronyd_t bin_t : file { getattr open read execute_no_trans }" - rlSESearchRule "allow chronyd_t systemd_systemctl_exec_t : file { getattr open read execute_no_trans }" - rlSESearchRule "allow timemaster_t chronyd_t : process { signal }" - rlPhaseEnd - - rlPhaseStartTest "bz#1350765" - rlSESearchRule "allow chronyd_t chronyd_t : capability2 { block_suspend } [ ]" - rlSESearchRule "allow chronyd_t kernel_t : system { module_request } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1416015 + bz#1421248 + bz#1425408 + bz#1440791" - rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" - rlSEMatchPathCon "/etc/adjtime" "adjtime_t" - rlSEMatchPathCon "/var/run/chrony" "chronyd_var_run_t" - rlSEMatchPathCon "/var/run/chrony/chronyd.sock" "chronyd_var_run_t" - rlSEMatchPathCon "/var/run/chrony/chronyc.1117.sock" "chronyd_var_run_t" - rlSESearchRule "allow chronyd_t adjtime_t : file { getattr open read }" - rlSESearchRule "allow chronyd_t chronyd_t : capability { chown }" - rlSESearchRule "allow chronyd_t chronyd_t : unix_dgram_socket { sendto }" - rlSESearchRule "allow chronyd_t chronyd_t : capability { net_admin }" - rlPhaseEnd - - rlPhaseStartTest "bz#1508486" - rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSESearchRule "allow chronyd_t chronyc_exec_t : file { getattr open read execute_no_trans }" - rlSESearchRule "allow chronyd_t chronyc_t : process { transition }" 1 - rlPhaseEnd - - rlPhaseStartTest "bz#1509379" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSESearchRule "allow chronyc_t chronyc_t : capability { dac_read_search } [ ]" - rlSESearchRule "type_transition chronyd_t chronyc_exec_t : process chronyc_t" 1 - rlSESearchRule "allow chronyd_t chronyd_t : capability { dac_read_search } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1530525" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSEMatchPathCon "/etc" "etc_t" - rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t" -# rlSESearchRule "allow chronyc_t etc_t : dir { write add_name }" -# rlSESearchRule "type_transition chronyc_t etc_t : file chronyd_keys_t" - rlSESearchRule "allow chronyc_t chronyd_keys_t : file { getattr ioctl append write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1470150" - rlSEMatchPathCon "/var/run/chrony" "chronyd_var_run_t" - rlSEMatchPathCon "/var/run/chrony/chronyc.3781.sock" "chronyd_var_run_t" - rlSESearchRule "allow chronyd_t chronyc_t : unix_dgram_socket { sendto }" - rlSESearchRule "allow chronyc_t chronyd_t : unix_dgram_socket { sendto }" - rlSESearchRule "allow system_cronjob_t chronyc_exec_t : file { getattr open read execute } [ ]" - rlSESearchRule "type_transition system_cronjob_t chronyc_exec_t : process chronyc_t" - rlSESearchRule "allow system_cronjob_t chronyc_t : process { transition } [ ]" - rlSESearchRule "allow inetd_child_t chronyc_exec_t : file { getattr open read execute } [ ]" - rlSESearchRule "type_transition inetd_child_t chronyc_exec_t : process chronyc_t" - rlSESearchRule "allow inetd_child_t chronyc_t : process { transition } [ ]" - rlSESearchRule "allow chronyc_t chronyd_var_run_t : sock_file { create write unlink }" - rlPhaseEnd - fi - - if false ; then - rlPhaseStartTest "bz#1273116" # CLOSED as NOT-A-BUG, unable to reproduce it anymore - rlSEMatchPathCon "/usr/lib/systemd/system/chronyd.service" "chronyd_unit_file_t" - rlSESearchRule "allow chronyd_t chronyd_unit_file_t : service { status }" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest "bz#1281473" - rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" - rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t" - rlSEMatchPathCon "/var/run/timemaster/chrony.conf" "timemaster_var_run_t" - rlSESearchRule "allow chronyd_t chronyd_keys_t : file { append setattr }" - rlSESearchRule "allow chronyd_t timemaster_var_run_t : file { getattr open read }" - rlPhaseEnd - - rlPhaseStartTest "bz#1290310" - rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" - rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/chronyd.sock" "chronyd_var_run_t" - rlSESearchRule "allow chronyd_t var_run_t : dir { getattr open search read write add_name remove_name }" - rlSESearchRule "type_transition chronyd_t var_run_t : sock_file chronyd_var_run_t" - rlSESearchRule "allow chronyd_t chronyd_var_run_t : sock_file { create }" - rlPhaseEnd - - rlPhaseStartTest "bz#1390657" - rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t" - rlSESearchRule "allow logrotate_t chronyd_keys_t : file { getattr open read }" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1509927" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSESearchRule "allow chronyc_t user_devpts_t : chr_file { read write getattr append open } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1574418" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSEMatchPathCon "/tmp" "tmp_t" - rlSEMatchPathCon "/var/lib" "var_lib_t" - rlSEMatchPathCon "/var/lib/check_mk_agent" "var_lib_t" - rlSEMatchPathCon "/var/lib/check_mk_agent/cache" "var_lib_t" - rlSEMatchPathCon "/var/lib/check_mk_agent/cache/chrony.cache.new" "var_lib_t" - rlSEMatchPathCon "/var/log" "var_log_t" - rlSESearchRule "allow chronyc_t tmp_t : dir { write add_name } [ ]" - rlSESearchRule "type_transition chronyc_t tmp_t : file chronyd_tmp_t" - rlSESearchRule "allow chronyc_t chronyd_tmp_t : file { create getattr open write } [ ]" - rlSESearchRule "allow chronyc_t var_log_t : dir { write add_name } [ ]" - rlSESearchRule "type_transition chronyc_t var_log_t : file chronyd_var_log_t" - rlSESearchRule "allow chronyc_t chronyd_var_log_t : file { create getattr open write } [ ]" - rlSESearchRule "allow chronyc_t var_lib_t : dir { write add_name } [ ]" - rlSESearchRule "type_transition chronyc_t var_lib_t : file chronyd_var_lib_t" - rlSESearchRule "allow chronyc_t chronyd_var_lib_t : file { create getattr open write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1575002 + bz#1577057 + bz#1593267" - rlSEMatchPathCon "/dev/tty1" "tty_device_t" - rlSESearchRule "allow unconfined_t chronyc_exec_t : file { getattr open read execute }" - rlSESearchRule "allow unconfined_t chronyc_t : process { transition }" - rlSESearchRule "type_transition unconfined_t chronyc_exec_t : process chronyc_t" - rlSESearchRule "type_change unconfined_t tty_device_t : chr_file user_tty_device_t" - rlSESearchRule "allow chronyc_t user_tty_device_t : chr_file { read write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1596563" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSEMatchPathCon "/var/run/nscd/socket" "nscd_var_run_t" - rlSEMatchPathCon "/var/db/nscd/passwd" "nscd_var_run_t" - rlSESearchRule "allow chronyc_t nscd_t : unix_stream_socket { connectto }" - rlSESearchRule "allow system_dbusd_t nscd_var_run_t : file { map }" - rlSESearchRule "dontaudit chronyc_t nscd_var_run_t : file { getattr open read }" - rlSESearchRule "allow chronyd_t chronyd_tmpfs_t : file { map }" - rlSESearchRule "allow chronyd_t gpsd_tmpfs_t : file { map }" - rlSESearchRule "allow chronyc_t nscd_t : nscd { shmemhost gethost }" - rlPhaseEnd - - rlPhaseStartTest "bz#1568281" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSEMatchPathCon "/run/chrony" "chronyd_var_run_t" - rlSESearchRule "allow logrotate_t chronyc_exec_t : file { getattr open read execute } [ ]" - rlSESearchRule "type_transition logrotate_t chronyc_exec_t : process chronyc_t" - rlSESearchRule "allow logrotate_t chronyc_t : process { transition } [ ]" - rlSESearchRule "allow chronyc_t chronyd_var_run_t : dir { write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1567753" - rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" - rlSEMatchPathCon "/var/lib/libvirt/dnsmasq" "virt_var_lib_t" - rlSESearchRule "allow chronyd_t virt_var_lib_t : dir { getattr open search read } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1618757 + bz#1622499" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSESearchRule "allow chronyc_t unconfined_t : unix_stream_socket { read write ioctl getattr } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - # bz#1652079 was closed as WONTFIX - rlPhaseStartTest "bz#1652079 + bz#1696252" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSEMatchPathCon "/var/lib" "var_lib_t" - rlSEMatchPathCon "/var/lib/test" "var_lib_t" - rlSEMatchPathCon "/var/log" "var_log_t" - rlSEMatchPathCon "/var/log/test" "var_log_t" - rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/test" "var_run_t" - rlSEMatchPathCon "/var/cache" "var_t" - rlSEMatchPathCon "/var/cache/test" "var_t" - rlSESearchRule "allow chronyc_t var_lib_t : dir { getattr open search write add_name } [ ]" - rlSESearchRule "allow chronyc_t var_lib_t : file { getattr ioctl write append } [ ]" - rlSESearchRule "allow chronyc_t var_log_t : dir { getattr open search write add_name } [ ]" - rlSESearchRule "allow chronyc_t var_log_t : file { getattr ioctl write append } [ ]" - rlSESearchRule "allow chronyc_t var_t : file { getattr ioctl write append } [ ]" - rlSESearchRule "allow chronyc_t var_run_t : file { getattr ioctl write append } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1593607" - rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t" - rlSESearchRule "allow chronyd_t shell_exec_t : file { map } [ ] mls" - rlPhaseEnd - - rlPhaseStartTest "bz#1772852" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSEMatchPathCon "/var/db/nscd/hosts" "nscd_var_run_t" - rlSESearchRule "allow chronyc_t nscd_var_run_t : file { map } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 8 ; then - rlPhaseStartTest "bz#1895825" - rlSEMatchPathCon "/run/chrony-dhcp" "chronyd_var_run_t" - rlSEMatchPathCon "/run/chrony-dhcp/something.source" "chronyd_var_run_t" - rlPhaseEnd - - rlPhaseStartTest "bz#1900143" - rlSEMatchPathCon "/run/systemd/resolve/io.systemd.Resolve" "systemd_resolved_var_run_t" - rlSESearchRule "allow chronyd_t systemd_resolved_var_run_t : sock_file { write } [ ]" - # rlRun "grep resolve /etc/nsswitch.conf" - rlPhaseEnd - - if ! rlIsRHEL "<9.3" ; then - rlPhaseStartTest "bz#2173604" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t" - rlRun "ls -dZ /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" - rlSESearchRule "allow chronyc_t sysctl_net_t : dir { search } [ ]" - rlSESearchRule "allow chronyc_t sysctl_net_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1961207" - rlSEMatchPortCon tcp 4460 ntske_port_t - rlSEMatchPathCon "/usr/share/pki/ca-trust-source/ca-bundle.trust.p11-ki" "cert_t" - rlSESearchRule "allow chronyd_t ntske_port_t : tcp_socket { name_bind name_connect } [ ]" - rlSESearchRule "allow chronyd_t chronyd_t : tcp_socket { listen accept }" - rlSESearchRule "allow chronyd_t cert_t : file { map } [ ]" - rlPhaseEnd - fi - - if rlIsFedora ; then - rlPhaseStartTest "bz#2008894" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlSESearchRule "allow init_t chronyc_t : process2 { nnp_transition } [ ]" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- chrony-wait service" - rlServiceStop chrony-wait - rlRun "mkdir -p /run/systemd/system/chrony-wait.service.d" - rlRun "echo -e '[Service]\nDynamicUser=yes' > /run/systemd/system/chrony-wait.service.d/override.conf" - rlRun "systemctl daemon-reload" - rlRun "systemctl start chrony-wait.service" - sleep 5 - rlRun "systemctl stop chrony-wait.service" - rlRun "rm -f /run/systemd/system/chrony-wait.service.d/override.conf" - rlRun "systemctl daemon-reload" - rlServiceRestore chrony-wait - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario" - rlRun "echo \"sched_priority 50\" >> /etc/chrony.conf" - rlRun "echo \"refclock SHM 0\" >> /etc/chrony.conf" - rlRun "echo \"refclock SOCK /var/run/chronyd.sock\" >> /etc/chrony.conf" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - if ! rlIsFedora ; then - rlRun "ipcs -m | grep 0x4e545030" - rlRun "ls -Z /var/run/chronyd.sock | grep :chronyd_var_run_t" - fi - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "chronyc tracking" - for OUTPUT_FILE in /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output ; do - rlRun "rm -f ${OUTPUT_FILE}" - rlRun "chronyc tracking > ${OUTPUT_FILE}" - rlRun "test -s ${OUTPUT_FILE}" - rlRun "ls -Z ${OUTPUT_FILE} | grep -e :user_tmp_t -e :chronyd_var_lib_t -e :chronyd_var_log_t" - done - if ! rlIsRHEL 7 ; then - for OUTPUT_FILE in /var/lib/test /var/log/test /var/run/test /var/cache/test ; do - rlRun "rm -f ${OUTPUT_FILE}" - rlRun "chronyc -n tracking > ${OUTPUT_FILE}" - rlRun "test -s ${OUTPUT_FILE}" - rlRun "chronyc -n tracking >> ${OUTPUT_FILE}" - rlRun "ls -Z ${OUTPUT_FILE}" - rlRun "ls -Z ${OUTPUT_FILE} | grep -e :var_lib_t -e :var_log_t -e :var_run_t -e :var_t" - rlRun "rm -f ${OUTPUT_FILE}" - done - fi - if rpm -q nscd >& /dev/null ; then - rlRun "service nscd start" - fi - sleep 2 - rlRun "getsebool -a | grep nscd" - rlRun "chronyc sources" - rlRun "ksh -c \"chronyc sources\"" - if ! rlIsRHEL 5 6 ; then - rlRun "chronyc serverstats" - fi - if rpm -q nscd >& /dev/null ; then - rlRun "service nscd stop" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "real scenario -- bz#1530525" - rlRun "rm -f /etc/chrony.keys" - rlRun "touch /etc/chrony.keys" - rlRun "restorecon -v /etc/chrony.keys" - rlRun "chronyc keygen 1111 SHA1 > /etc/chrony.keys" - rlRun "chronyc keygen 1111 SHA1 >> /etc/chrony.keys" - rlRun "ls -Z /etc/chrony.keys | grep :chronyd_keys_t" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "real scenario -- bz#1961207" - rlRun "./chrony-nts-test.sh" - rlRun "rm -f /var/lib/chrony/*.nts" - rlRun "systemctl restart chronyd" - rlPhaseEnd - - rlPhaseStartTest "bz#2065313" - rlSESearchRule "allow chronyd_t unconfined_t : unix_dgram_socket { sendto }" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- bz#2065313" - rlLog "special socat command talks to chronyd via its UNIX socket" - printf "\x6\x1\x0\x0\x0\x21\x0\x0\x21\xd7\xe4\x22\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0" | socat unix-sendto:/run/chrony/chronyd.sock,bind=/run/chrony/chronyc.sock,umask=0000 - | hexdump -C - rlPhaseEnd - - rlPhaseStartTest "bz#2118628 + bz#2118631" - rlSEMatchPortCon udp 319 ptp_event_port_t - rlSESearchRule "allow chronyd_t ptp_event_port_t : udp_socket { name_bind } [ ]" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- bz#2118628 + bz#2118631" - rlRun "echo -en '\nallow\nptpport 319\nserver 127.0.0.1 port 319 minpoll 0 maxpoll 0\n' >> /etc/chrony.conf" - rlRun "systemctl restart chronyd" - sleep 5 - rlRun "chronyc ntpdata 127.0.0.1 | grep 'Total RX'" - rlPhaseEnd - fi - - if ! ( rlIsRHEL 9 && rlIsRHEL "<9.7" ) && ! ( rlIsRHEL 10 && rlIsRHEL "<10.1" ) ; then - if rlSEDefined "chronyd_restricted_t" ; then - rlPhaseStartTest "RHEL-82299 + RHEL-82308" - rlSESearchRule "allow chronyc_t chronyd_restricted_t : unix_dgram_socket { sendto } [ ]" - rlSESearchRule "allow chronyd_restricted_t chronyc_t : unix_dgram_socket { sendto } [ ]" - rlPhaseEnd - fi - - if [ -f ${CHRONYD_RESTRICTED_UNIT_FILE} ]; then - rlPhaseStartTest "chronyd-restricted -- bz#2169949 + RHEL-18219" - rlRun "systemctl stop ${SERVICE_NAME}" - rlRun "mkdir -p ${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}" - if ! grep ^SELinuxContext= ${CHRONYD_RESTRICTED_UNIT_FILE} ; then - # temporary configuration change until it becomes a part of the chrony package - rlRun "echo -e '[Service]\nSELinuxContext=system_u:system_r:chronyd_restricted_t:s0\n' > ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" - rlRun "systemctl daemon-reload" - fi - rlRun "systemctl start ${CHRONYD_RESTRICTED_SERVICE}" - sleep 3 - rlRun "ps -o pid,uid,command,context -C chronyd | grep -1 system_u:system_r:chronyd_restricted_t:" - rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" - rlRun "chronyc reload sources" 0,1 - rlRun "systemctl restart ${CHRONYD_RESTRICTED_SERVICE}" - rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" - rlRun "systemctl stop ${CHRONYD_RESTRICTED_SERVICE}" - rlRun "rm -f ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" - rlRun "systemctl daemon-reload" - rlPhaseEnd - fi - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlRun "rm -f /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output" - rlFileRestore - rlServiceRestore `rlSEListServices 123` - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/cockpit-ws-and-similar/Makefile b/selinux-policy/cockpit-ws-and-similar/Makefile deleted file mode 100644 index d048f53..0000000 --- a/selinux-policy/cockpit-ws-and-similar/Makefile +++ /dev/null @@ -1,85 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar -# Description: SELinux interferes with cockpit-ws and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/cockpit-ws-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with cockpit-ws and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 cockpit-ws net-tools nmap-ncat cockpit-dashboard cockpit-bridge psmisc selinux-policy-devel" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Architectures: x86_64" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 1100808" >> $(METADATA) # RHEL-7 - @echo "Bug: 1214223" >> $(METADATA) # RHEL-7 - @echo "Bug: 1279429" >> $(METADATA) # RHEL-7 - @echo "Bug: 1283955" >> $(METADATA) # RHEL-7 - @echo "Bug: 1374572" >> $(METADATA) # RHEL-7 - @echo "Bug: 1381914" >> $(METADATA) # RHEL-7 - @echo "Bug: 1402316" >> $(METADATA) # RHEL-7 - @echo "Bug: 1402495" >> $(METADATA) # RHEL-7 - @echo "Bug: 1413509" >> $(METADATA) # RHEL-7 - @echo "Bug: 1561053" >> $(METADATA) # Fedora 28 - @echo "Bug: 1584167" >> $(METADATA) # Fedora 28 - @echo "Bug: 1609929" >> $(METADATA) # Fedora 28 - @echo "Bug: 1613638" >> $(METADATA) # Fedora 28 - @echo "Bug: 1615318" >> $(METADATA) # RHEL-8 - @echo "Bug: 1629678" >> $(METADATA) # RHEL-8 - @echo "Bug: 1718814" >> $(METADATA) # RHEL-8 - @echo "Bug: 1979182" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/cockpit-ws-and-similar/PURPOSE b/selinux-policy/cockpit-ws-and-similar/PURPOSE deleted file mode 100644 index b42781c..0000000 --- a/selinux-policy/cockpit-ws-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar -Author: Milos Malik - -SELinux interferes with cockpit-ws, cockpit-ssh, cockpit-session and related programs. - diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf deleted file mode 100644 index a386b3a..0000000 --- a/selinux-policy/cockpit-ws-and-similar/main.fmf +++ /dev/null @@ -1,68 +0,0 @@ -summary: SELinux interferes with cockpit-ws and related programs -description: |+ - SELinux interferes with cockpit-ws, cockpit-ssh, cockpit-session and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - glib2 - - cockpit-ws - - net-tools - - nmap-ncat - - cockpit-dashboard - - cockpit-bridge - - psmisc - - selinux-policy-devel -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TierCandidatesPASS - - failinfedora - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1100808 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1214223 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1279429 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1283955 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1374572 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1381914 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402316 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402495 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1413509 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1561053 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1584167 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1609929 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1613638 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1615318 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1629678 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1718814 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1979182 -adjust+: - - enabled: false - when: arch != x86_64 - continue: false - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0419451 -extra-summary: /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar -extra-task: /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar -id: 80693544-1e8a-4200-9edd-c3e766d1e433 diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh deleted file mode 100755 index 4bb6c98..0000000 --- a/selinux-policy/cockpit-ws-and-similar/runtest.sh +++ /dev/null @@ -1,238 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar -# Description: SELinux interferes with cockpit-ws and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/libexec/cockpit-ws" -FILE_CONTEXT="cockpit_ws_exec_t" -SERVICE_PACKAGE="cockpit-ws" -SERVICE_NAME="cockpit" -if grep "cockpit-tls" /usr/lib/systemd/system/cockpit.service; then - PROCESS_NAME="cockpit-tls" -else - PROCESS_NAME="cockpit-ws" -fi -PROCESS_CONTEXT="cockpit_ws_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1100808" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1214223" - rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" - rlSEMatchPathCon "/var/tmp" "tmp_t" - rlSESearchRule "allow cockpit_session_t tmp_t : dir { read write add_name remove_name getattr open search } [ ]" - rlSESearchRule "type_transition cockpit_session_t tmp_t : file cockpit_tmp_t" - rlSESearchRule "allow cockpit_session_t cockpit_tmp_t : file { create write open unlink } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1279429 + bz#1283955" - rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" - rlSEMatchPathCon "/tmp" "tmp_t" - rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/cockpit-ws" "cockpit_var_run_t" - rlSESearchRule "allow cockpit_ws_t var_run_t : dir { write add_name } [ ]" - rlSESearchRule "type_transition cockpit_ws_t var_run_t : dir cockpit_var_run_t [ ]" - rlSESearchRule "allow cockpit_ws_t cockpit_var_run_t : dir { create } [ ]" - rlSESearchRule "allow cockpit_ws_t tmp_t : dir { write add_name } [ ]" - rlSESearchRule "type_transition cockpit_ws_t tmp_t : dir cockpit_tmp_t [ ]" - rlSESearchRule "type_transition cockpit_ws_t tmp_t : file cockpit_tmp_t [ ]" - rlSESearchRule "allow cockpit_ws_t cockpit_tmp_t : dir { read write create getattr setattr lock unlink link rename add_name remove_name search rmdir open } [ ]" - rlSESearchRule "allow cockpit_ws_t cockpit_tmp_t : file { read write create getattr setattr lock append unlink link rename open } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1374572" - rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" - rlSEMatchPathCon "/usr/share/cracklib" "crack_db_t" - rlSEMatchPathCon "/usr/share/cracklib/pw_dict.pwd" "crack_db_t" - rlSEMatchPathCon "/etc/nshadow" "shadow_t" - rlSESearchRule "allow cockpit_session_t crack_db_t : dir { search }" - rlSESearchRule "allow cockpit_session_t crack_db_t : file { getattr open read }" - rlSESearchRule "allow cockpit_session_t shadow_t : file { create write setattr }" - rlSESearchRule "allow cockpit_session_t passwd_file_t : file { write }" - rlPhaseEnd - - rlPhaseStartTest "bz#1413509" - rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" - rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" - rlSEMatchPathCon "/var/lib/cockpit" "cockpit_var_lib_t" - rlSEMatchPortCon tcp 22 ssh_port_t - rlSESearchRule "allow cockpit_ws_t cockpit_session_exec_t : file { getattr open read execute }" - rlSESearchRule "type_transition cockpit_ws_t cockpit_session_exec_t : process cockpit_session_t" - rlSESearchRule "allow cockpit_ws_t cockpit_session_t : process { transition }" - rlSESearchRule "allow cockpit_session_t cockpit_var_lib_t : dir { search }" - rlSESearchRule "allow cockpit_session_t ssh_port_t : tcp_socket { name_connect } [ ]" - rlPhaseEnd - - if ! rlIsRHEL 7 ; then - rlPhaseStartTest "bz#1584167 + bz#1609929 + bz#1613638 + bz#1615318" - rlSEMatchPathCon "/usr/sbin/sshd" "sshd_exec_t" - rlSEMatchPathCon "/var/run/cockpit" "cockpit_var_run_t" - rlSEMatchPathCon "/var/run/cockpit/active.motd" "cockpit_var_run_t" - rlSESearchRule "allow sshd_t cockpit_var_run_t : dir { getattr open search } [ ]" - rlSESearchRule "allow sshd_t cockpit_var_run_t : file { getattr open read } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1629678" - rlSEMatchPathCon "/usr/lib/systemd/system/cockpit.socket" "cockpit_unit_file_t" - rlSESearchRule "allow cockpit_ws_t cockpit_unit_file_t : service { status } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1561053" - rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" - rlRun "ls -Z /proc/cpuinfo | grep :proc_t" - rlSESearchRule "allow cockpit_ws_t proc_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartTest "bz#1402316 + bz#1402495" - rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" - rlSESearchRule "allow cockpit_session_t cockpit_session_t : process { setrlimit }" - rlPhaseEnd - - if ! rlIsRHEL 7 ; then - rlPhaseStartTest "bz#1718814" - # staff_u section - rlSESearchRule "allow staff_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]" - rlSESearchRule "allow staff_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]" - rlSESearchRule "allow staff_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]" - # rlSESearchRule "allow staff_sudo_t staff_t : unix_stream_socket { ioctl } [ ]" - rlSESearchRule "allow cockpit_session_t staff_ssh_agent_t : process { signal } [ ]" - # user_u section - rlSESearchRule "allow user_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]" - rlSESearchRule "allow user_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]" - rlSESearchRule "allow user_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]" - # user_u cannot run sudo - tested in a different TC - rlSESearchRule "allow cockpit_session_t user_ssh_agent_t : process { signal } [ ]" - # sysadm_u section - rlSESearchRule "allow sysadm_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]" - rlSESearchRule "allow sysadm_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]" - - # rlSESearchRule "allow sysadm_sudo_t sysadm_t : unix_stream_socket { ioctl } [ ]" - rlSESearchRule "allow sysadm_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]" - rlSESearchRule "allow cockpit_session_t sysadm_ssh_agent_t : process { signal } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1979182" - rlSESearchRule "allow cockpit_ws_t fs_t : filesystem { getattr } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then - rlPhaseStartTest "real scenario -- xinetd service" - HOST_ADDRESS="127.0.0.1" # IP address or nothing - PORT_NUMBER="9090" # number or socket path - PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) - if rlIsRHEL 5 6 ; then - rlRun "chkconfig ${SERVICE_NAME} on" - rlRun "service xinetd restart" - rlLog "starting provocateur job" - ( tail -f - | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & - PROVOCATEUR_PID=$! - else - rlRun "systemctl enable ${SERVICE_NAME}.socket" - rlRun "systemctl start ${SERVICE_NAME}.socket" - rlLog "starting provocateur job" - ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & - PROVOCATEUR_PID=$! - fi - sleep 1 - rlRun "netstat -tupan | grep :${PORT_NUMBER}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" - rlRun "kill ${PROVOCATEUR_PID}" - rlRun "killall ncat" 0,1 - if rlIsRHEL 5 6 ; then - rlRun "chkconfig ${SERVICE_NAME} off" - rlRun "service xinetd stop" - else - rlRun "systemctl stop ${SERVICE_NAME}.socket" - rlRun "systemctl disable ${SERVICE_NAME}.socket" - fi - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/cockpit-ws-and-similar/testpolicy.te b/selinux-policy/cockpit-ws-and-similar/testpolicy.te deleted file mode 100644 index 10b6586..0000000 --- a/selinux-policy/cockpit-ws-and-similar/testpolicy.te +++ /dev/null @@ -1,17 +0,0 @@ -policy_module(testpolicy,1.0) - -require { - type initrc_t; - type cockpit_session_exec_t; - type cockpit_session_t; - type user_devpts_t; - class file { getattr open read execute entrypoint }; - class process { transition }; - class chr_file { getattr open read write append }; -} - -allow initrc_t cockpit_session_exec_t : file { getattr open read execute entrypoint }; -allow initrc_t cockpit_session_t : process { transition }; -type_transition initrc_t cockpit_session_exec_t : process cockpit_session_t; -allow cockpit_session_t user_devpts_t : chr_file { getattr open read write append }; - diff --git a/selinux-policy/colord-and-similar/Makefile b/selinux-policy/colord-and-similar/Makefile deleted file mode 100644 index 32ada87..0000000 --- a/selinux-policy/colord-and-similar/Makefile +++ /dev/null @@ -1,75 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/colord-and-similar -# Description: SELinux interferes with colord and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/colord-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh ssh.exp - chcon -t bin_t runtest.sh ssh.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with colord and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: colord" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted glib2 setools-console colord /usr/sbin/service expect" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5 -RHEL6" >> $(METADATA) - @echo "Bug: 1373082" >> $(METADATA) # RHEL-7 - @echo "Bug: 1381579" >> $(METADATA) # RHEL-7 - @echo "Bug: 1398030" >> $(METADATA) # RHEL-7 - @echo "Bug: 1421247" >> $(METADATA) # RHEL-7 - @echo "Bug: 1460480" >> $(METADATA) # RHEL-7 - @echo "Bug: 1772669" >> $(METADATA) # RHEL-8 - @echo "Bug: 2259679" >> $(METADATA) # Fedora 40 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/colord-and-similar/PURPOSE b/selinux-policy/colord-and-similar/PURPOSE deleted file mode 100644 index eca8438..0000000 --- a/selinux-policy/colord-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/colord-and-similar -Author: Milos Malik - -SELinux interferes with colord and related programs. - diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf deleted file mode 100644 index d3bca10..0000000 --- a/selinux-policy/colord-and-similar/main.fmf +++ /dev/null @@ -1,59 +0,0 @@ -summary: SELinux interferes with colord and related programs -description: |+ - SELinux interferes with colord and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - glib2 - - setools-console - - colord - - /usr/sbin/service - - expect -environment: - AVC_ERROR: +no_avc_check - ALLOWED_USERS: staff_u user_u sysadm_u unconfined_u - DENIED_USERS: guest_u xguest_u -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass - - TIPpass_FIPS - - TIPpass_Security - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373082 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1381579 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1398030 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1421247 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460480 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772669 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2259679 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0276310 -extra-summary: /CoreOS/selinux-policy/Regression/colord-and-similar -extra-task: /CoreOS/selinux-policy/Regression/colord-and-similar -id: c0168fe1-5628-4c40-ba49-f6939ce96d1b diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh deleted file mode 100755 index 4d6970d..0000000 --- a/selinux-policy/colord-and-similar/runtest.sh +++ /dev/null @@ -1,165 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/colord-and-similar -# Description: SELinux interferes with colord and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -SERVICE_PACKAGE="colord" -SERVICE_NAME="colord" -PROCESS_NAME="colord" -PROCESS_CONTEXT="colord_t" -ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} -DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlSEConfigureSSH - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1373082 + bz#1381579 + bz#1398030 + bz#1421247 + bz#1460480" - rlSEMatchPathCon "/usr/libexec/colord" "colord_exec_t" - rlSEMatchPathCon "/etc/udev/hwdb.bin" "systemd_hwdb_etc_t" - rlSESearchRule "allow colord_t systemd_hwdb_etc_t : file { getattr open read } [ ]" - rlPhaseEnd - - DESTINATION="org.freedesktop.ColorManager" - if busctl | grep -iq ${DESTINATION} ; then - rlPhaseStartTest "real scenario -- DBus service" - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" - sleep 1 - rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" - rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "real scenario -- user session service" - CREATED_USERS="" - rlRun "setsebool ssh_sysadm_login on" - rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "restorecon -RvF /home/${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager status colord-session" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager start colord-session" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager stop colord-session" - sleep 2 - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" - done - rlRun "setsebool ssh_sysadm_login off" - for USER_NAME in ${CREATED_USERS} ; do - rlRun "userdel -rfZ ${USER_NAME}" - done - rlPhaseEnd - - rlPhaseStartTest "bz#1772669" - # TODO: find an agreement about which confined users should be allowed - rlSESearchRule "allow staff_t colord_t : dbus { send_msg } [ ]" - rlSESearchRule "allow colord_t staff_t : dbus { send_msg } [ ]" - rlSESearchRule "allow user_t colord_t : dbus { send_msg } [ ]" - rlSESearchRule "allow colord_t user_t : dbus { send_msg } [ ]" - rlSESearchRule "allow sysadm_t colord_t : dbus { send_msg } [ ]" - rlSESearchRule "allow colord_t sysadm_t : dbus { send_msg } [ ]" - rlSESearchRule "allow unconfined_t colord_t : dbus { send_msg } [ ]" - rlSESearchRule "allow colord_t unconfined_t : dbus { send_msg } [ ]" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- bz#1772669" - CREATED_USERS="" - rlRun "setsebool ssh_sysadm_login on" - rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "restorecon -RvF /home/${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost colormgr get-devices" - sleep 2 - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" - done - rlRun "setsebool ssh_sysadm_login off" - for USER_NAME in ${CREATED_USERS} ; do - rlRun "userdel -rfZ ${USER_NAME}" - done - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - if rlIsFedora ; then - rlPhaseStartTest "bz#2259679" - rlSEMatchPathCon "/usr/libexec/colord" "colord_exec_t" - rlSEMatchPathCon "/var/lib/colord/mapping.db" "colord_var_lib_t" - rlSESearchRule "allow init_t colord_t : process2 { nnp_transition } [ ]" - rlSESearchRule "allow colord_t colord_var_lib_t : file { read write } [ ]" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/colord-and-similar/ssh.exp b/selinux-policy/colord-and-similar/ssh.exp deleted file mode 100755 index 1244013..0000000 --- a/selinux-policy/colord-and-similar/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname "$command ; sleep 5" -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/coreutils-single/main.fmf b/selinux-policy/coreutils-single/main.fmf deleted file mode 100644 index 4c4188f..0000000 --- a/selinux-policy/coreutils-single/main.fmf +++ /dev/null @@ -1,37 +0,0 @@ -summary: Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on. -description: |+ - Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on. - -contact: Veronika Syncakova -test: ./runtest.sh -framework: beakerlib -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - policycoreutils - - selinux-policy - - selinux-policy-targeted -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - NoRHIVOS -link: - - verifies: https://redhat.atlassian.net/browse/RHEL-141858 -adjust+: - - enabled: false - when: distro < rhel-10.3 - continue: false - because: RHEL-141858 is fixed in RHEL-10.3 diff --git a/selinux-policy/coreutils-single/runtest.sh b/selinux-policy/coreutils-single/runtest.sh deleted file mode 100755 index 743b295..0000000 --- a/selinux-policy/coreutils-single/runtest.sh +++ /dev/null @@ -1,43 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="coreutils-single" -BOOLEAN="corecmd_bin_sys_resource" -INSTALLED_VARIANT="" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - if rpm -q coreutils-single > /dev/null 2>&1; then - INSTALLED_VARIANT="single" - else - INSTALLED_VARIANT="regular" - rlRun "yum -y install ${PACKAGE} --allowerasing" - fi - rlAssertRpm ${PACKAGE} - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - rlPhaseEnd - - rlPhaseStartTest "RHEL-141858" - # Boolean and rule exists - rlRun "getsebool -a | grep ${BOOLEAN}" - rlSESearchRule "allow NetworkManager_dispatcher_chronyc_t self:capability {sys_resource} [ ${BOOLEAN} ]" - INTERFACE_NAME="$(ip link show | head -n 1 | awk -F': ' '/^[0-9]+:/ {print $2}')" - - # No AVC when the boolean is turned on - rlSEBooleanOn ${BOOLEAN} - rlRun "nmcli connection up ${INTERFACE_NAME}" - sleep 5 - rlPhaseEnd - - rlPhaseStartCleanup - rlSECheckAVC - rlSEBooleanRestore ${BOOLEAN} - if [ "$INSTALLED_VARIANT" = "regular" ]; then - rlRun "yum -y install coreutils --allowerasing" - fi - rlPhaseEnd -rlJournalEnd \ No newline at end of file diff --git a/selinux-policy/cups-browsed-and-similar/Makefile b/selinux-policy/cups-browsed-and-similar/Makefile deleted file mode 100644 index f78d4ec..0000000 --- a/selinux-policy/cups-browsed-and-similar/Makefile +++ /dev/null @@ -1,73 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/cups-browsed-and-similar -# Description: SELinux interferes with cups-browsed and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/cups-browsed-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with cups-browsed and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: cups" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/cups-browsed cups /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 1395801" >> $(METADATA) # Fedora 26 - @echo "Bug: 1401634" >> $(METADATA) # Fedora 26 - @echo "Bug: 1719754" >> $(METADATA) # RHEL-7 - @echo "Bug: RHEL-47401" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-54579" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/cups-browsed-and-similar/PURPOSE b/selinux-policy/cups-browsed-and-similar/PURPOSE deleted file mode 100644 index 91bc83d..0000000 --- a/selinux-policy/cups-browsed-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/cups-browsed-and-similar -Author: Milos Malik - -SELinux interferes with cups-browsed and related programs. - diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf deleted file mode 100644 index ca03382..0000000 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ /dev/null @@ -1,52 +0,0 @@ -summary: SELinux interferes with cups-browsed and related programs -description: |+ - SELinux interferes with cups-browsed and related programs. - -contact: Milos Malik -component: - - cups - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy - url: https://src.fedoraproject.org/tests/selinux.git -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/cups-browsed - - cups - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - RHEL8 - - f32friendly - - targeted - - NoRHIVOS -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1395801 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1401634 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1719754 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929329 - - verifies: https://issues.redhat.com/browse/RHEL-47401 - - verifies: https://issues.redhat.com/browse/RHEL-54579 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0300676 -extra-summary: /CoreOS/selinux-policy/Regression/cups-browsed-and-similar -extra-task: /CoreOS/selinux-policy/Regression/cups-browsed-and-similar -id: 089ae8a5-999e-415e-bf84-eaa8a77b551d diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh deleted file mode 100755 index 0877fdc..0000000 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ /dev/null @@ -1,112 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/cups-browsed-and-similar -# Description: SELinux interferes with cups-browsed and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/cups-browsed" -FILE_CONTEXT="cupsd_exec_t" -SERVICE_NAME="cups-browsed" -PROCESS_NAME="cups-browsed" -PROCESS_CONTEXT="cupsd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - SERVICE_PACKAGE=`rpm -qf ${FILE_PATH} | head -n 1` - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlFileBackup /etc/shadow - rlFileBackup /etc/cups/cups-browsed.conf - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSESearchRule "allow initrc_t ${FILE_CONTEXT} : file { getattr open read execute }" - rlSESearchRule "allow initrc_t ${PROCESS_CONTEXT} : process { transition }" - rlSESearchRule "type_transition initrc_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" - rlPhaseEnd - - rlPhaseStartTest "bz#1395801 + bz#1401634 + bz#1719754" - rlSEMatchPathCon "/usr/sbin/cups-browsed" "cupsd_exec_t" - rlSEMatchPathCon "/tmp" "tmp_t" - rlSESearchRule "allow cupsd_t tmp_t : dir { write add_name } [ ]" - rlSESearchRule "type_transition cupsd_t tmp_t : lnk_file cupsd_tmp_t" - rlSESearchRule "allow cupsd_t cupsd_tmp_t : lnk_file { create unlink } [ ]" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "echo -en '\nBrowsePoll localhost\n' >> /etc/cups/cups-browsed.conf" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then - # RHEL-47401 closed as won't fix - # RHEL-54579 will be fixed in RHEL-10 - rlRun "mkdir -p /root/.cups" - rlRun "touch /root/.cups/lpoptions" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - # Ignore specific avc denial on rhel-9 due to RHEL-47401 - if rlIsRHEL 9 || rlIsCentOS 9; then - rlSECheckAVC --ignore 'type=AVC.*comm=cups-browsed.*name=lpoptions.*scontext=.*:cupsd_t:.*tcontext=.*:admin_home_t:.*tclass=file' - else - rlSECheckAVC - fi - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlServiceStop cups - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/cups-lpd-and-similar/Makefile b/selinux-policy/cups-lpd-and-similar/Makefile deleted file mode 100644 index 83fe356..0000000 --- a/selinux-policy/cups-lpd-and-similar/Makefile +++ /dev/null @@ -1,75 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/cups-lpd-and-similar -# Description: SELinux interferes with cups-lpd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/cups-lpd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with cups-lpd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 20m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: cups" >> $(METADATA) - @echo "Requires: audit expect policycoreutils-python-utils selinux-policy-devel libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console xinetd nmap-ncat nc net-tools cups-lpd chkconfig /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 192216" >> $(METADATA) # Fedora 5 - @echo "Bug: 1004198" >> $(METADATA) # RHEL-7 - @echo "Bug: 1420522" >> $(METADATA) # Fedora 24 - @echo "Bug: 1554118" >> $(METADATA) # RHEL-8 - @echo "Bug: 1919399" >> $(METADATA) # RHEL-8 - @echo "Bug: 1947397" >> $(METADATA) # RHEL-9 - @echo "Bug: 2020531" >> $(METADATA) # Fedora 35 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/cups-lpd-and-similar/PURPOSE b/selinux-policy/cups-lpd-and-similar/PURPOSE deleted file mode 100644 index 4bf0246..0000000 --- a/selinux-policy/cups-lpd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/cups-lpd-and-similar -Author: Milos Malik - -SELinux interferes with cups-lpd and related programs. - diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf deleted file mode 100644 index cd7d489..0000000 --- a/selinux-policy/cups-lpd-and-similar/main.fmf +++ /dev/null @@ -1,62 +0,0 @@ -summary: SELinux interferes with cups-lpd and related programs -description: |+ - SELinux interferes with cups-lpd and related programs. - -contact: Milos Malik -component: - - cups - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy - url: https://src.fedoraproject.org/tests/selinux.git -recommend: - - audit - - expect - - policycoreutils-python-utils - - selinux-policy-devel - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - xinetd - - nmap-ncat - - nc - - net-tools - - cups-lpd - - chkconfig - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 20m -enabled: true -tag: - - NoRHEL4 - - RHEL8 - - customer_scenario - - f32friendly - - rhel9-buildroot - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=192216 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1004198 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1420522 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1554118 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919399 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1947397 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2020531 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2039449 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919173 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0305784 -extra-summary: /CoreOS/selinux-policy/Regression/cups-lpd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/cups-lpd-and-similar -id: 544f74d0-54a4-4174-a4a0-4fe85190a5c6 diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh deleted file mode 100755 index 10aa060..0000000 --- a/selinux-policy/cups-lpd-and-similar/runtest.sh +++ /dev/null @@ -1,166 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/cups-lpd-and-similar -# Description: SELinux interferes with cups-lpd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/lib/cups/daemon/cups-lpd" -FILE_CONTEXT="cupsd_lpd_exec_t" -SERVICE_PACKAGE="cups-lpd" -SERVICE_NAME="cups-lpd" -PROCESS_NAME="cups-lpd" -PROCESS_CONTEXT="cupsd_lpd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - if rlIsRHEL 5 6 ; then - rlServiceStop ${SERVICE_NAME} - else - rlSocketStop ${SERVICE_NAME} - fi - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#192216" - rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" - rlSEMatchPathCon "/var/run/cups" "cupsd_var_run_t" - rlSESearchRule "allow cupsd_lpd_t cupsd_var_run_t : dir { search } [ ]" - rlSESearchRule "allow cupsd_lpd_t cupsd_lpd_t : netlink_route_socket { create } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1004198" - if rlIsRHEL 5 ; then - SOURCE_TYPE="inetd_t" # xinetd runs the process - BOOLEANS="[ cupsd_lpd_disable_trans ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="inetd_t" # xinetd runs the process - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPortCon "tcp" "515" "printer_port_t" - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" - if ! rlIsRHEL 5 6 ; then - rlSESearchRule "allow ${PROCESS_CONTEXT} printer_port_t : tcp_socket { name_bind }" - fi - rlPhaseEnd - - rlPhaseStartTest "bz#1420522 + bz#1554118" - rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" - rlSESearchRule "allow init_t cupsd_lpd_t : tcp_socket { create setopt bind listen }" - rlPhaseEnd - - rlPhaseStartTest "bz#1919399 + bz#1947397" - rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" - rlSEMatchPathCon "/run/cups/cups.sock" "cupsd_var_run_t" - rlSESearchRule "allow cupsd_lpd_t cupsd_var_run_t : sock_file { read } [ ]" - rlPhaseEnd - - if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then - rlPhaseStartTest "bz#2020531" - rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" - rlRun "ls -Z /proc/1/environ | grep :init_t" - rlSESearchRule "dontaudit cupsd_lpd_t init_t : dir { search } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then - rlPhaseStartTest "real scenario -- bz#1919399 + bz#1947397" - rlRun "systemctl start cups.service" - rlRun "systemctl enable cups-lpd.socket" - rlRun "systemctl start cups-lpd.socket" - sleep 2 - rlRun "lpadmin -p test -o printer-is-shared=true -E" - rlRun "DEVICE_URI=lpd://127.0.0.1/test /usr/lib/cups/backend/lpd 1 user test 1 '' /etc/fstab" - sleep 5 - rlRun "lpadmin -x test" - rlRun "systemctl stop cups-lpd.socket" - rlRun "systemctl disable cups-lpd.socket" - rlRun "systemctl stop cups.service" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then - rlPhaseStartTest "real scenario -- xinetd service" - HOST_ADDRESS="127.0.0.1" # IP address or nothing - PORT_NUMBER="515" # number or socket path - PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) - if rlIsRHEL 5 6 ; then - rlRun "chkconfig ${SERVICE_NAME} on" - rlRun "service xinetd restart" - rlLog "starting provocateur job" - ( tail -f - | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & - PROVOCATEUR_PID=$! - else - rlRun "systemctl enable ${SERVICE_NAME}.socket" - rlRun "systemctl start ${SERVICE_NAME}.socket" - rlLog "starting provocateur job" - ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & - PROVOCATEUR_PID=$! - fi - sleep 1 - rlRun "netstat -tupan | grep :${PORT_NUMBER}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" - rlRun "kill ${PROVOCATEUR_PID}" - rlRun "killall ncat" 0,1 - if rlIsRHEL 5 6 ; then - rlRun "chkconfig ${SERVICE_NAME} off" - rlRun "service xinetd stop" - else - rlRun "systemctl stop ${SERVICE_NAME}.socket" - rlRun "systemctl disable ${SERVICE_NAME}.socket" - fi - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - if rlIsRHEL 5 6 ; then - rlServiceRestore ${SERVICE_NAME} - else - rlSocketRestore ${SERVICE_NAME} - fi - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/cups-pdf-and-similar/Makefile b/selinux-policy/cups-pdf-and-similar/Makefile index 4b09310..b3668ab 100644 --- a/selinux-policy/cups-pdf-and-similar/Makefile +++ b/selinux-policy/cups-pdf-and-similar/Makefile @@ -62,7 +62,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL10" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 560220" >> $(METADATA) # Fedora 12 @echo "Bug: 563977" >> $(METADATA) # Fedora 12 @echo "Bug: 570782" >> $(METADATA) # Fedora 12 @@ -72,7 +72,6 @@ $(METADATA): Makefile @echo "Bug: 1594271" >> $(METADATA) # Fedora 28 @echo "Bug: 1700442" >> $(METADATA) # Fedora 28 @echo "Bug: 1832521" >> $(METADATA) # Fedora 32 - @echo "Bug: 2234765" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index 7b86822..699c0b8 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -1,61 +1,2 @@ -summary: SELinux interferes with cups-pdf and related programs -description: |+ - SELinux interferes with cups-pdf and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy - url: https://src.fedoraproject.org/tests/selinux.git -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - expect - - openssh-clients - - shadow-utils - - cups - - cups-pdf - - cups-client - - cups-filters -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - epel - - rhel8-epel - - rhel9-epel - - NoRHIVOS - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560220 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=563977 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=570782 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1516282 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1517509 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1532043 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1594271 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700442 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832521 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2234765 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7, rhel-10, centos-stream-10 - continue: false -extra-nitrate: TC#0607292 -extra-summary: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar -extra-task: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar -id: aa317943-d9be-4434-9731-a43601d39c00 +path: /selinux-policy/cups-pdf-and-similar +tier: 2 diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index eb81af7..328ad07 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -27,9 +27,11 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" FILE_PATH="/usr/lib/cups/backend/cups-pdf" FILE_CONTEXT="cups_pdf_exec_t" SERVICE_PACKAGE="cups-pdf" @@ -40,26 +42,21 @@ ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} rlJournalStart - if rlIsFedora "<32"; then + if rlIsRHEL || rlIsFedora "<32"; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} >& /dev/null ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi + rlAssertRpm ${SERVICE_PACKAGE} rlServiceStart ${SERVICE_NAME} rlFileBackup /etc/shadow - rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -106,20 +103,11 @@ rlJournalStart rlSESearchRule "type_transition cups_pdf_t var_log_t : file cupsd_log_t" rlPhaseEnd - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#1832521" rlSESearchRule "allow cups_pdf_t cups_pdf_t : unix_dgram_socket { create connect } [ ]" rlPhaseEnd - if ! rlIsRHEL "<9.3" ; then - rlPhaseStartTest "bz#2234765" - rlSESearchRule "allow cups_pdf_t kernel_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - fi - fi - rlPhaseStartTest "real scenario -- confined users" - CREATED_USERS="" rlRun "lpadmin -x cups-pdf" 0-255 rlRun "lpadmin -p cups-pdf -v cups-pdf:/ -E -P /usr/share/cups/model/CUPS-PDF_opt.ppd" rlRun "setsebool ssh_sysadm_login on" @@ -134,14 +122,12 @@ rlJournalStart rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost lpr -P cups-pdf /usr/share/cups/data/testprint" sleep 5 rlRun "find /home/${USER_NAME} -type f | grep testprint-job" - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 done rlRun "setsebool selinuxuser_tcp_server off" rlRun "setsebool ssh_sysadm_login off" rlRun "lpadmin -x cups-pdf" - for USER_NAME in ${CREATED_USERS} ; do - rlRun "userdel -rfZ ${USER_NAME}" - done rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf deleted file mode 100644 index d3774c7..0000000 --- a/selinux-policy/deny-rules/main.fmf +++ /dev/null @@ -1,37 +0,0 @@ -summary: Basic functional test of the deny rules in SELinux policy -contact: Milos Malik -test: ./runtest.sh -framework: beakerlib -component: - - selinux-policy -recommend: - - libsepol - - libsemanage - - libselinux - - policycoreutils - - selinux-policy - - strace - - expect -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail -duration: 10m -enabled: true -tier: 1 -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - NoRHIVOS -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 - because: deny rules are not recognized/implemented there -extra-nitrate: TC#0616661 -id: 3221e55d-6039-40f6-b9ff-6a02e85948e7 diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh deleted file mode 100755 index 2fb86c6..0000000 --- a/selinux-policy/deny-rules/runtest.sh +++ /dev/null @@ -1,143 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -USER_CONTEXT=${USER_CONTEXT:-"sysadm_u:sysadm_r:sysadm_t"} -SELINUX_USER=`echo ${USER_CONTEXT} | cut -d : -f 1` -USER_ROLE=`echo ${USER_CONTEXT} | cut -d : -f 2` -USER_TYPE=`echo ${USER_CONTEXT} | cut -d : -f 3` -USER_NAME="user${RANDOM}" -USER_SECRET="S3krET${RANDOM}" - -rlJournalStart - CUR_VERSION=`rpm -q --qf "%{version}" policycoreutils | head -n 1` - if rlTestVersion ${CUR_VERSION} '<' 3.6 ; then - rlLog "The installed SELinux userspace does NOT support deny rules." - rlLog "The automated test is NOT relevant for this environment." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlAssertRpm libsepol - rlAssertRpm libsemanage - rlAssertRpm libselinux - rlAssertRpm policycoreutils - rlAssertRpm selinux-policy - if ! rpm -q strace ; then - rlRun "yum -y install strace" 0-255 - fi - - rlRun "setenforce 1" - rlRun "sestatus" - rlRun "useradd -o -u 0 -g 0 -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "setsebool ssh_sysadm_login on" - - rlFileBackup /etc/ssh/sshd_config - rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" - rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - if [ -d /etc/ssh/sshd_config.d ] ; then - rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" - fi - rlRun "service sshd restart" - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "prevent the reading of a file" - rlRun "stat /etc/shadow" 0 - rlRun "grep ^bin /etc/shadow" 0 - rlRun "echo -e '( deny ${USER_TYPE} shadow_t ( file ( getattr read )))' > testpolicy.cil" - rlRun "semodule -i testpolicy.cil" - rlRun "semodule -lfull | grep testpolicy" - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost stat /etc/shadow" - rlRun "grep -i 'permission denied' $rlRun_LOG" - rm -f $rlRun_LOG - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost grep ^bin /etc/shadow" - rlRun "grep -i 'permission denied' $rlRun_LOG" - rm -f $rlRun_LOG - rlRun "semodule -r testpolicy" - rlPhaseEnd - - rlPhaseStartTest "prevent the execution of a file" - rlRun "dmesg >& /dev/null" - rlRun "echo -e '( deny ${USER_TYPE} dmesg_exec_t ( file ( execute execute_no_trans )))' > testpolicy.cil" - rlRun "semodule -i testpolicy.cil" - rlRun "semodule -lfull | grep testpolicy" - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost dmesg" - rlRun "grep -i 'permission denied' $rlRun_LOG" - rm -f $rlRun_LOG - rlRun "semodule -r testpolicy" - rlPhaseEnd - - rlPhaseStartTest "prevent removal of a file" - if [ -f /etc/machine-id ] ; then - rlRun "cp -a /etc/machine-id /home/${USER_NAME}/" - else - rlRun "cp -a /run/machine-id /home/${USER_NAME}/" - fi - rlRun "ls -Z /home/${USER_NAME}/machine-id" - rlRun "echo -e '( deny ${USER_TYPE} machineid_t ( file ( unlink )))' > testpolicy.cil" - rlRun "semodule -i testpolicy.cil" - rlRun "semodule -lfull | grep testpolicy" - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost rm -f /home/${USER_NAME}/machine-id" - rlRun "grep -i 'permission denied' $rlRun_LOG" - rm -f $rlRun_LOG - rlRun "semodule -r testpolicy" - rlRun "rm -f /home/${USER_NAME}/machine-id" - rlPhaseEnd - - rlPhaseStartTest "prevent the search in a directory" - rlRun "ls -lZR /etc/pki >& /dev/null" - rlRun "echo -e '( deny ${USER_TYPE} cert_t ( dir ( search )))' > testpolicy.cil" - rlRun "semodule -i testpolicy.cil" - rlRun "semodule -lfull | grep testpolicy" - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost ls -lZR /etc/pki" - rlRun "grep -i 'permission denied' $rlRun_LOG" - rm -f $rlRun_LOG - rlRun "semodule -r testpolicy" - rlPhaseEnd - - rlPhaseStartTest "prevent ptracing of processes" - rlWatchdog "strace -p $$" 5 - rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( process ( ptrace )))' > testpolicy.cil" - rlRun "semodule -i testpolicy.cil" - rlRun "semodule -lfull | grep testpolicy" - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost strace -p $$" - rlRun "grep -i 'permission denied' $rlRun_LOG" - rm -f $rlRun_LOG - rlRun "semodule -r testpolicy" - rlPhaseEnd - - rlPhaseStartTest "prevent loading of kernel modules" - if lsmod | grep -q dummy ; then - rlRun "modprobe -r dummy" - fi - rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( system ( module_load module_request )))' > testpolicy.cil" - rlRun "echo -e '( deny kmod_t kmod_t ( system ( module_load module_request )))' >> testpolicy.cil" - rlRun "echo -e '( deny kmod_t modules_object_t ( system ( module_load )))' >> testpolicy.cil" - rlRun "semodule -i testpolicy.cil" - rlRun "semodule -lfull | grep testpolicy" - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost modprobe dummy" - rlRun "grep -i 'permission denied' $rlRun_LOG" - rm -f $rlRun_LOG - rlRun "lsmod | grep ^dummy" 1 - rlRun "semodule -r testpolicy" - rlRun "modprobe dummy" - rlRun "lsmod | grep dummy" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "setsebool ssh_sysadm_login off" - rlRun "userdel -rfZ ${USER_NAME}" - rlFileRestore - if [ -d /etc/ssh/sshd_config.d ] ; then - rlRun "rm -f /etc/ssh/sshd_config.d/001-enable-password.conf" - fi - rlRun "service sshd restart" - rlSECheckAVC --ignore 'type=AVC .* denied { unlink } .* comm=rm .*:sysadm_t:.*:machineid_t:.*tclass=file' --ignore 'type=AVC .* denied { module_load } .* comm=modprobe .*:kmod_t:.*:modules_object_t:.*tclass=system' --ignore 'type=AVC.*module_load.*:kmod_t:.*:kmod_t:.*tclass=system' - rlPhaseEnd -rlJournalEnd - diff --git a/selinux-policy/deny-rules/ssh.exp b/selinux-policy/deny-rules/ssh.exp deleted file mode 100755 index 58c9647..0000000 --- a/selinux-policy/deny-rules/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname $command -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/dhclient-and-similar/Makefile b/selinux-policy/dhclient-and-similar/Makefile index e372ff7..4779e3c 100644 --- a/selinux-policy/dhclient-and-similar/Makefile +++ b/selinux-policy/dhclient-and-similar/Makefile @@ -63,9 +63,6 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1897388" >> $(METADATA) # Fedora 33 - @echo "Bug: 2035117" >> $(METADATA) # Fedora 35 - @echo "Bug: 2093709" >> $(METADATA) # Fedora 36 - @echo "Bug: 2094155" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf index 909d0a7..d61123a 100644 --- a/selinux-policy/dhclient-and-similar/main.fmf +++ b/selinux-policy/dhclient-and-similar/main.fmf @@ -1,40 +1,2 @@ -summary: SELinux interferes with dhclient and related programs -description: |+ - SELinux interferes with dhclient and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - psmisc - - chrony - - dhcp-client -environment: - AVC_ERROR: +no_avc_check -duration: 10m -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1897388 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2035117 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093709 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094155 -adjust+: - - when: trigger == build - enabled: false - because: the test may mess up the IP address -extra-summary: /CoreOS/selinux-policy/Regression/dhclient-and-similar -extra-task: /CoreOS/selinux-policy/Regression/dhclient-and-similar -extra-nitrate: TC#0613884 -id: bce71943-38b6-428b-af69-20b9e6a60708 -tag: - - NoRHIVOS +path: /selinux-policy/dhclient-and-similar +tier: 2 diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index 247727e..4db364a 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -27,9 +27,11 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" SERVICE_PACKAGE="chrony" SERVICE_NAME="chronyd" @@ -37,14 +39,13 @@ rlJournalStart rlLog "If this test fails, please contact mmalik on IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} rlServiceStart ${SERVICE_NAME} - rlFileBackup --missing-ok /run/chrony-dhcp rlSESetEnforce rlSEStatus @@ -52,7 +53,6 @@ rlJournalStart sleep 2 rlPhaseEnd - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#1897388" rlSEMatchPathCon "/usr/sbin/dhclient-script" "dhcpc_exec_t" rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" @@ -61,38 +61,17 @@ rlJournalStart rlSESearchRule "allow dhcpc_t chronyc_t : process { transition } [ ]" rlPhaseEnd - rlPhaseStartTest "bz#2035117 + bz#2093709 + bz#2094155" - rlSEMatchPathCon "/usr/sbin/dhclient-script" "dhcpc_exec_t" - rlSEMatchPathCon "/run/chrony-dhcp" "chronyd_var_run_t" - rlSEMatchPathCon "/run/chrony-dhcp/eth0.sources" "chronyd_var_run_t" - rlSESearchRule "type_transition dhcpc_t var_run_t : dir chronyd_var_run_t chrony-dhcp" - rlSESearchRule "allow dhcpc_t chronyd_var_run_t : dir { read write } [ ]" - rlSESearchRule "allow dhcpc_t chronyd_var_run_t : file { create getattr append } [ ]" - rlPhaseEnd - fi - - if which dhclient >& /dev/null ; then rlPhaseStartTest "real scenario" - rlRun "rm -rf /run/chrony-dhcp" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlRun "dhclient" DHCLIENT_PID=`pgrep dhclient` rlRun "ps -efZ | grep dhclient" rlRun "ps -efZ | grep ':dhcpc_t:.*dhclient'" - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then - rlRun "grep CHRONY_SOURCEDIR /etc/dhcp/dhclient.d/chrony.sh" - rlRun "grep sourcedir /etc/chrony.conf" - sleep 5 - rlRun "ls -alZ /run/chrony-dhcp" - fi rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 rlSECheckAVC kill ${DHCLIENT_PID} - rlFileRestore rlServiceRestore ${SERVICE_NAME} rlPhaseEnd rlJournalPrintText diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile deleted file mode 100644 index 5ed2841..0000000 --- a/selinux-policy/dhcpcd-and-similar/Makefile +++ /dev/null @@ -1,78 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/dhcpcd-and-similar -# Description: SELinux interferes with dhcpcd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/dhcpcd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with dhcpcd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute systemd-resolved" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 1585971" >> $(METADATA) # Fedora 28 - @echo "Bug: 1602343" >> $(METADATA) # Fedora 28 - @echo "Bug: RHEL-15326" >> $(METADATA) # RHEL-9 - @echo "Bug: 2269708" >> $(METADATA) # Fedora 40 - @echo "Bug: 2270733" >> $(METADATA) # Fedora 41 - @echo "Bug: RHEL-33081" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-43417" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-113937" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-113941" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-147153" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-147155" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/dhcpcd-and-similar/PURPOSE b/selinux-policy/dhcpcd-and-similar/PURPOSE deleted file mode 100644 index 503905e..0000000 --- a/selinux-policy/dhcpcd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/dhcpcd-and-similar -Author: Milos Malik - -SELinux interferes with dhcpcd and related programs. - diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf deleted file mode 100644 index 1f828c1..0000000 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ /dev/null @@ -1,55 +0,0 @@ -summary: SELinux interferes with dhcpcd and related programs -description: |+ - SELinux interferes with dhcpcd and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - dhcpcd - - /usr/sbin/service - - iproute - - systemd-resolved -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1602343 - - verifies: https://issues.redhat.com/browse/RHEL-15326 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2269708 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270733 - - verifies: https://issues.redhat.com/browse/RHEL-33081 - - verifies: https://issues.redhat.com/browse/RHEL-43417 - - verifies: https://issues.redhat.com/browse/RHEL-113937 - - verifies: https://issues.redhat.com/browse/RHEL-113941 - - verifies: https://issues.redhat.com/browse/RHEL-147153 - - verifies: https://issues.redhat.com/browse/RHEL-147155 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 - because: the dhcpcd package is not available there -extra-nitrate: TC#0574611 -extra-summary: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar -id: 16f95682-f375-4789-86a5-a59b9d70ff3a diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh deleted file mode 100755 index 37583a1..0000000 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ /dev/null @@ -1,159 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/dhcpcd-and-similar -# Description: SELinux interferes with dhcpcd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/dhcpcd" -FILE_CONTEXT="dhcpc_exec_t" -SERVICE_PACKAGE="dhcpcd" -SERVICE_NAME="dhcpcd" -PROCESS_NAME="dhcpcd" -PROCESS_CONTEXT="dhcpc_t" - -rlJournalStart - rlPhaseStartSetup - if rlIsRHEL 4 5 6 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - rlRun "rpm -qa | grep systemd | sort" - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1585971 + bz#1602343" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/dhcpcd" "dhcpc_var_run_t" - rlSEMatchPathCon "/var/run/dhcpcd/sock" "dhcpc_var_run_t" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow dhcpc_t dhcpc_t : netlink_generic_socket { create bind }" - rlSESearchRule "allow dhcpc_t dhcpc_t : netlink_kobject_uevent_socket { create setopt bind getattr }" - rlSESearchRule "allow dhcpc_t dhcpc_t : rawip_socket { create setopt }" - rlSESearchRule "allow dhcpc_t var_run_t : dir { write add_name }" - rlSESearchRule "type_transition dhcpc_t var_run_t : sock_file dhcpc_var_run_t" - rlSESearchRule "allow dhcpc_t dhcpc_var_run_t : sock_file { create unlink }" - rlPhaseEnd - - if ( rlIsRHEL 9 && rlIsRHEL ">9.3" ) || rlIsCentOS 9 ; then - rlPhaseStartTest "RHEL-15326" - rlSESearchRule "allow dhcpc_t dhcpc_t : capability2 { bpf } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 8 && ! ( rlIsRHEL 9 && rlIsRHEL "<9.5" ); then - rlPhaseStartTest "bz#2269708 + bz#2270733" - rlSEMatchPathCon "/run/netns" "ifconfig_var_run_t" - rlSESearchRule "allow dhcpc_t ifconfig_var_run_t : dir { read } [ ]" - rlPhaseEnd - fi - - if rlIsRHEL 10 || rlIsCentOS 10 ; then - rlPhaseStartTest "RHEL-33081" - rlSEMatchPathCon "/run/dhcpcd/eth0-4.unpriv.sock" "dhcpc_var_run_t" - rlSESearchRule "allow dhcpc_t dhcpc_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-43417" - rlSESearchRule "allow dhcpc_t dhcpc_t : capability { kill } [ ]" - rlPhaseEnd - fi - - if rlIsRHEL '> 9.7' || rlIsRHEL '> 10.1' ; then - rlPhaseStartTest "RHEL-113937 + RHEL-113941" - rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "dhcpc_hook_exec_t" - CONF_FILE_CONTEXT=`secon --type --file /etc/chrony.conf` - rlSESearchRule "allow dhcpc_hook_t ${CONF_FILE_CONTEXT} : file { write } [ ]" - rlPhaseEnd - fi - - if rlIsRHEL '> 9.8' || rlIsRHEL '> 10.2' ; then - rlPhaseStartTest "RHEL-147153 + RHEL-147155" - rlSEMatchPathCon "/usr/bin/resolvectl" "bin_t" - rlSESearchRule "allow dhcpc_hook_t dhcpc_hook_t : unix_dgram_socket { create ioctl } [ ]" - rlSESearchRule "allow dhcpc_hook_t init_t : unix_stream_socket { getattr } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! rlIsRHEL "<9.5" ; then - rlRun "ip netns add test-ns" - rlRun "ip netns del test-ns" - rlRun "ls -lZR /run/netns" - fi - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/dmidecode-and-similar/Makefile b/selinux-policy/dmidecode-and-similar/Makefile deleted file mode 100644 index 03a223f..0000000 --- a/selinux-policy/dmidecode-and-similar/Makefile +++ /dev/null @@ -1,74 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/dmidecode-and-similar -# Description: SELinux interferes with dmidecode and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2017 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/dmidecode-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh ssh.exp - chcon -t bin_t runtest.sh ssh.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with dmidecode and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: dmidecode" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dmidecode selinux-policy-devel shadow-utils openssh-clients expect" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 263141" >> $(METADATA) # RHEL-5 - @echo "Bug: 1289274" >> $(METADATA) # RHEL-7 - @echo "Bug: 1300799" >> $(METADATA) # RHEL-7 - @echo "Bug: 1608480" >> $(METADATA) # RHEL-7 - @echo "Bug: 1926696" >> $(METADATA) # Fedora 34 - @echo "Bug: RHEL-16104" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/dmidecode-and-similar/PURPOSE b/selinux-policy/dmidecode-and-similar/PURPOSE deleted file mode 100644 index 06eaabe..0000000 --- a/selinux-policy/dmidecode-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/dmidecode-and-similar -Author: Milos Malik - -SELinux interferes with dmidecode and related programs. - diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf deleted file mode 100644 index 2a1b60d..0000000 --- a/selinux-policy/dmidecode-and-similar/main.fmf +++ /dev/null @@ -1,55 +0,0 @@ -summary: SELinux interferes with dmidecode and related programs -description: |+ - SELinux interferes with dmidecode and related programs. - -contact: Milos Malik -component: - - selinux-policy - - dmidecode -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - dmidecode - - selinux-policy-devel - - shadow-utils - - openssh-clients - - expect -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - TIPpass_Security - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=263141 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1289274 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1300799 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1608480 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1926696 - - verifies: https://issues.redhat.com/browse/RHEL-16104 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false - - enabled: false - when: arch != aarch64 and arch != i386 and arch != x86_64 - continue: false -extra-nitrate: TC#0550595 -extra-summary: /CoreOS/selinux-policy/Regression/dmidecode-and-similar -extra-task: /CoreOS/selinux-policy/Regression/dmidecode-and-similar -id: 8b3954c3-5475-4a03-aad9-0a31a68bcdce diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh deleted file mode 100755 index b8ff02c..0000000 --- a/selinux-policy/dmidecode-and-similar/runtest.sh +++ /dev/null @@ -1,168 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/dmidecode-and-similar -# Description: SELinux interferes with dmidecode and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2017 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ALLOWED_USERS=${ALLOWED_USERS:-"sysadm_u unconfined_u"} -DENIED_USERS=${DENIED_USERS:-"staff_u user_u guest_u xguest_u"} - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm dmidecode - - rlSEConfigureSSH - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#263141" - rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" - rlSESearchRule "allow dmidecode_t sysfs_t : dir { getattr open search } [ ]" - rlSESearchRule "allow dmidecode_t sysfs_t : file { getattr open read } [ ]" - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1289274" - rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" - rlSEMatchPathCon "/dev/urandom" "urandom_device_t" - rlSESearchRule "allow dmidecode_t urandom_device_t : chr_file { getattr open read } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1300799" - rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" - rlSEMatchPathCon "/run/lock/subsys/rhsmcertd" "rhsmcertd_lock_t" - rlSEMatchPathCon "/var/log/rhsm/rhsm.log" "rhsmcertd_log_t" - rlSESearchRule "allow dmidecode_t rhsmcertd_lock_t : file { open }" - rlSESearchRule "allow dmidecode_t rhsmcertd_log_t : file { open read }" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1608480" - rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" - rlSESearchRule "allow rhsmcertd_t dmidecode_exec_t : file { map } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- runcon" - # this TC does not belong to the small set of SELinux domains which can run dmidecode in the system_u:system_r:dmidecode_t:s0 context, therefore we need some help - # TODO: use sysadm_t user instead of initrc_t to run dmidecode, because sysadm_t is allowed to transition to dmidecode_t - rlRun "ls -l testpolicy.*" - rlRun "make -f /usr/share/selinux/devel/Makefile testpolicy.pp" - rlRun "semodule -i testpolicy.pp" - - rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/dmidecode" - if [ -f /usr/sbin/biosdecode ] ; then - rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/biosdecode" - fi - if [ -f /usr/sbin/vpddecode ] ; then - rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/vpddecode" - fi - if [ -f /usr/sbin/ownership ] ; then - rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/ownership" - fi - - rlRun "semodule -l | grep testpolicy" - rlRun "semodule -r testpolicy" - rlRun "semodule -l | grep testpolicy" 1 - rlPhaseEnd - - rlPhaseStartTest "real scenario -- confined users" - CREATED_USERS="" - rlRun "setsebool ssh_sysadm_login on" - rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -o -u 0 -g 0 -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "restorecon -RvF /home/${USER_NAME}" - if [ -f /usr/sbin/dmidecode ] ; then - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/dmidecode" - fi - if [ -f /usr/sbin/biosdecode ] ; then - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/biosdecode" - fi - if [ -f /usr/sbin/vpddecode ] ; then - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/vpddecode" - fi - if [ -f /usr/sbin/ownership ] ; then - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/ownership" - fi - sleep 2 - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" - done - rlRun "setsebool ssh_sysadm_login off" - for USER_NAME in ${CREATED_USERS} ; do - rlRun "userdel -rfZ ${USER_NAME}" - done - rlPhaseEnd - - if ! rlIsRHEL "<9.5"; then - rlPhaseStartTest "RHEL-16104" - rlSEMatchPathCon "/var" "var_t" - rlSEMatchPathCon "/var/log" "var_log_t" - rlSEMatchPathCon "/var/log/sudo-io" "sudo_log_t" - rlSESearchRule "allow sysadm_sudo_t var_t : dir { read } [ ]" - rlSESearchRule "allow sysadm_sudo_t var_log_t : dir { read } [ ]" - rlSESearchRule "allow sysadm_sudo_t sudo_log_t : dir { read } [ ]" - rlRun "setsebool ssh_sysadm_login on" - rlRun "useradd -Z sysadm_u -G wheel sysadm-user" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "echo ${USER_SECRET} | passwd --stdin sysadm-user" - rlRun "echo -en 'Defaults log_output\nDefaults log_input\nDefaults iolog_dir=/var/log/sudo-io\nsysadm-user ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/sysadm-user" - rlRun "rm -rf /var/log/sudo-io" - rlRun -s "./ssh.exp sysadm-user ${USER_SECRET} localhost sudo dmidecode" - rlRun "grep DMI $rlRun_LOG" - rlRun "rm -f $rlRun_LOG" - rlRun "rm -rf /var/log/sudo-io" - rlRun -s "./ssh.exp sysadm-user ${USER_SECRET} localhost sudo -r sysadm_r dmidecode" - rlRun "grep DMI $rlRun_LOG" - rlRun "rm -f $rlRun_LOG" - rlRun "rm -f /etc/sudoers.d/sysadm-user" - rlRun "userdel -rfZ sysadm-user" - rlRun "setsebool ssh_sysadm_login off" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/dmidecode-and-similar/ssh.exp b/selinux-policy/dmidecode-and-similar/ssh.exp deleted file mode 100755 index 1244013..0000000 --- a/selinux-policy/dmidecode-and-similar/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname "$command ; sleep 5" -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/dmidecode-and-similar/testpolicy.te b/selinux-policy/dmidecode-and-similar/testpolicy.te deleted file mode 100644 index 9f732dd..0000000 --- a/selinux-policy/dmidecode-and-similar/testpolicy.te +++ /dev/null @@ -1,18 +0,0 @@ -policy_module(testpolicy,1.0) - -require { - type initrc_t; - type dmidecode_t; - type dmidecode_exec_t; - type console_device_t; - class file { getattr open read execute }; - class process { transition }; - class chr_file { read write }; -} - -allow initrc_t dmidecode_exec_t : file { getattr open read execute }; -type_transition initrc_t dmidecode_exec_t : process dmidecode_t; -allow initrc_t dmidecode_t : process { transition }; -allow dmidecode_t initrc_t:process { sigchld }; -allow dmidecode_t console_device_t : chr_file { read write }; - diff --git a/selinux-policy/exim-and-similar/Makefile b/selinux-policy/exim-and-similar/Makefile deleted file mode 100644 index 4982ecb..0000000 --- a/selinux-policy/exim-and-similar/Makefile +++ /dev/null @@ -1,74 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/exim-and-similar -# Description: SELinux interferes with exim and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/exim-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with exim and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console at exim lsof" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 1025315" >> $(METADATA) # RHEL-6 - @echo "Bug: 1444441" >> $(METADATA) # RHEL-7 - @echo "Bug: RHEL-14110" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-14186" >> $(METADATA) # RHEL-8 - @echo "Bug: RHEL-21902" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-21903" >> $(METADATA) # RHEL-8 - @echo "Bug: RHEL-94268" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/exim-and-similar/PURPOSE b/selinux-policy/exim-and-similar/PURPOSE deleted file mode 100644 index 8501e39..0000000 --- a/selinux-policy/exim-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/exim-and-similar -Author: Milos Malik - -SELinux interferes with exim and related programs. - diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf deleted file mode 100644 index de59c51..0000000 --- a/selinux-policy/exim-and-similar/main.fmf +++ /dev/null @@ -1,61 +0,0 @@ -summary: SELinux interferes with exim and related programs -description: |+ - SELinux interferes with exim and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - /usr/sbin/service - - setools-console - - at - - exim - - lsof -environment: - AVC_ERROR: +no_avc_check -duration: 5m -enabled: true -tag: - - NoRHEL4 - - TIPpass_Security - - TierCandidatesPASS - - f31friendly - - f32friendly - - targeted - - epel - - rhel8-epel - - rhel9-epel - - rhel10-epel - - NoRHIVOS - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1025315 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1444441 - - verifies: https://issues.redhat.com/browse/RHEL-14110 - - verifies: https://issues.redhat.com/browse/RHEL-14186 - - verifies: https://issues.redhat.com/browse/RHEL-21902 - - verifies: https://issues.redhat.com/browse/RHEL-21903 - - verifies: https://issues.redhat.com/browse/RHEL-94268 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-alt-7 - continue: false - - enabled: false - when: arch == i386, ppc64, s390 - continue: false -extra-nitrate: TC#0057402 -extra-summary: /CoreOS/selinux-policy/Regression/exim-and-similar -extra-task: /CoreOS/selinux-policy/Regression/exim-and-similar -id: 4b7d4e3b-8ab3-4cab-b984-13be2a78252f diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh deleted file mode 100755 index 01b5036..0000000 --- a/selinux-policy/exim-and-similar/runtest.sh +++ /dev/null @@ -1,145 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/exim-and-similar -# Description: SELinux interferes with exim and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/exim" -FILE_CONTEXT="exim_exec_t" -SERVICE_PACKAGE="exim" -SERVICE_NAME="exim" -PROCESS_NAME="exim" -PROCESS_CONTEXT="exim_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlFileBackup /etc/exim/exim.conf - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest "bz#1025315" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - rlSEMatchPathCon "/sys/devices/system/cpu" "sysfs_t" - rlSEMatchPathCon "/sys/devices/system/cpu/online" "sysfs_t" - rlSESearchRule "allow exim_t sysfs_t : file { getattr open read }" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - rlSEMatchPathCon "/sys/devices/system/cpu" "sysfs_t" - rlSEMatchPathCon "/sys/devices/system/cpu/online" "cpu_online_t" - rlSESearchRule "allow exim_t cpu_online_t : file { getattr open read }" - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow exim_t sysfs_t : dir { search }" - rlPhaseEnd - fi - - if rlIsRHEL 7 ; then - rlPhaseStartTest "bz#1444441" - rlSEMatchPathCon "/usr/sbin/exim" "exim_exec_t" - rlSESearchRule "allow exim_t sysctl_net_t : dir { getattr open search } [ ]" - rlSESearchRule "allow exim_t sysctl_net_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - - if rlIsRHEL 8 || ( rlIsRHEL 9 && rlIsRHEL ">9.3" ) || rlIsCentOS 8 9 ; then - rlPhaseStartTest "RHEL-21902 + RHEL-21903" - rlSEMatchPathCon "/var/spool/exim/exim_daemon_notify" "exim_spool_t" - rlSESearchRule "allow exim_t exim_t : unix_dgram_socket { sendto } [ ]" - rlPhaseEnd - fi - - if rlIsRHEL '>9.6' || rlIsRHEL '>10.0' || rlIsFedora ; then - rlPhaseStartTest "RHEL-94268" - rlRun "ls -dZ /proc/sys/net/ | grep :sysctl_net_t" - rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" - rlSESearchRule "allow exim_t sysctl_net_t : dir { search } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="sendmail_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "lsof | grep exim_daemon_notify" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - - if ! ( rlIsRHEL 9 && rlIsRHEL "<9.4" ) ; then - rlPhaseStartTest "real scenario -- RHEL-14110 + RHEL-14186" - rlSEMatchPathCon "/var/spool/exim/input" "exim_spool_t" - rlSESearchRule "allow system_mail_t exim_spool_t : dir { create } [ ]" - rlRun "sed -i 's/^.*\(split_spool_directory\).*=.*$/\1 = true/' /etc/exim/exim.conf" - rlRun "service exim start" - rlRun "service atd start" - rlRun "echo '/usr/bin/id -Z' | at now" - sleep 15s - rlRun "ls -lZ /var/spool/exim/input" - rlRun "service atd stop" - rlRun "service exim stop" - rlPhaseEnd - fi - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/fapolicyd-and-similar/Makefile b/selinux-policy/fapolicyd-and-similar/Makefile index 17eef10..5ceb8a2 100644 --- a/selinux-policy/fapolicyd-and-similar/Makefile +++ b/selinux-policy/fapolicyd-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: fapolicyd" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit /usr/sbin/service libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console fapolicyd fapolicyd-selinux systemd-container" >> $(METADATA) + @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console fapolicyd fapolicyd-selinux" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -66,8 +66,6 @@ $(METADATA): Makefile @echo "Bug: 1865818" >> $(METADATA) # RHEL-8 @echo "Bug: 1874491" >> $(METADATA) # Fedora 33 @echo "Bug: 1876538" >> $(METADATA) # Fedora 33 - @echo "Bug: 1932225" >> $(METADATA) - @echo "Bug: RHEL-77071" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index e4e8de2..8faf6ba 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -1,51 +1,2 @@ -summary: SELinux interferes with fapolicyd and related programs -description: |+ - SELinux interferes with fapolicyd and related programs. - -contact: Milos Malik -component: - - fapolicyd - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - /usr/sbin/service - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - fapolicyd - - fapolicyd-selinux - - systemd-container -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - fedora-wanted - - failinfedora - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1865818 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1874491 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1876538 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932225 - - verifies: https://issues.redhat.com/browse/RHEL-77071 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0608224 -extra-summary: /CoreOS/selinux-policy/Regression/fapolicyd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/fapolicyd-and-similar -id: b489ccc7-3f8e-452d-b46f-37dcc6d1a64d +path: /selinux-policy/fapolicyd-and-similar +tier: 2 diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh index 21e183b..720f008 100755 --- a/selinux-policy/fapolicyd-and-similar/runtest.sh +++ b/selinux-policy/fapolicyd-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -40,7 +41,7 @@ PROCESS_CONTEXT="fapolicyd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -87,22 +88,6 @@ rlJournalStart rlSESearchRule "allow fapolicyd_t rpm_var_lib_t : file { create } [ ]" rlPhaseEnd - if seinfo --common file -x | grep -q watch ; then - rlPhaseStartTest "bz#1932225" - rlSEMatchPathCon "/boot" "boot_t" - rlSEMatchPathCon "/" "root_t" - rlSEMatchPathCon "/dev/shm" "tmpfs_t" - rlSEMatchPathCon "/tmp" "tmp_t" - rlSEMatchPathCon "/run/user/0" "user_tmp_t" - rlSESearchRule "allow fapolicyd_t boot_t : dir { watch_mount watch_with_perm } [ ]" - rlSESearchRule "allow fapolicyd_t root_t : dir { watch_mount watch_with_perm } [ ]" - rlSESearchRule "allow fapolicyd_t tmpfs_t : dir { watch_mount watch_with_perm } [ ]" - rlSESearchRule "allow fapolicyd_t tmp_t : dir { watch_mount watch_with_perm } [ ]" - rlSESearchRule "allow fapolicyd_t user_tmp_t : dir { watch_mount watch_with_perm } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -110,25 +95,9 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "RHEL-77071" - if rlIsCentOS 10 || rlIsRHEL 10 ; then - rlSESearchRule "allow fapolicyd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" - fi - rlRun "service systemd-machined start" - rlRun "service systemd-machined status -l" - rlRun "service fapolicyd start" - rlRun "service fapolicyd status -l" - sleep 5 - rlRun "service fapolicyd stop" - rlRun "service systemd-machined stop" - rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/fedora-third-party-and-similar/Makefile b/selinux-policy/fedora-third-party-and-similar/Makefile deleted file mode 100644 index 0f350ab..0000000 --- a/selinux-policy/fedora-third-party-and-similar/Makefile +++ /dev/null @@ -1,68 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar -# Description: SELinux interferes with the fedora-third-party service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/fedora-third-party-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with the fedora-third-party service and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service fedora-third-party" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) - @echo "Bug: 2093453" >> $(METADATA) # Fedora 37 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/fedora-third-party-and-similar/PURPOSE b/selinux-policy/fedora-third-party-and-similar/PURPOSE deleted file mode 100644 index a57c27d..0000000 --- a/selinux-policy/fedora-third-party-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar -Author: Milos Malik - -SELinux interferes with the fedora-third-party service and related programs. - diff --git a/selinux-policy/fedora-third-party-and-similar/main.fmf b/selinux-policy/fedora-third-party-and-similar/main.fmf deleted file mode 100644 index e1a16d5..0000000 --- a/selinux-policy/fedora-third-party-and-similar/main.fmf +++ /dev/null @@ -1,47 +0,0 @@ -summary: SELinux interferes with the fedora-third-party service and related programs -description: |+ - SELinux interferes with the fedora-third-party service and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - fedora-third-party -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - NoRHEL9 - - targeted - - NoRHIVOS -tier: 2 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093453 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 - because: the fedora-third-party package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar -extra-task: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar -extra-nitrate: TC#0614304 -id: 98743019-2a5a-48c2-9be6-7b8caa3add4d diff --git a/selinux-policy/fedora-third-party-and-similar/runtest.sh b/selinux-policy/fedora-third-party-and-similar/runtest.sh deleted file mode 100755 index bc6e4a3..0000000 --- a/selinux-policy/fedora-third-party-and-similar/runtest.sh +++ /dev/null @@ -1,97 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar -# Description: SELinux interferes with the fedora-third-party service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/bin/fedora-third-party" -FILE_CONTEXT="fedoratp_exec_t" -SERVICE_PACKAGE="fedora-third-party" -SERVICE_NAME="fedora-third-party-refresh" -PROCESS_NAME="fedora-third-party" -PROCESS_CONTEXT="fedoratp_t" - -rlJournalStart - if rlIsRHEL ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup --missing-ok /run/ostree-booted - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#2093453" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/etc/passwd" "passwd_file_t" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow ${PROCESS_CONTEXT} passwd_file_t : file { getattr open read } [ ]" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for OSes where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlRun "touch /run/ostree-booted" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlRun "fedora-third-party list" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlRun "rm -f /run/ostree-booted" - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/files-ownership/main.fmf b/selinux-policy/files-ownership/main.fmf deleted file mode 100644 index 302f725..0000000 --- a/selinux-policy/files-ownership/main.fmf +++ /dev/null @@ -1,27 +0,0 @@ -summary: test if selinux-policy owns tree with interface files -contact: Veronika Syncakova -test: ./runtest.sh -duration: 5m -enabled: true -require: - - selinux-policy -recommend: - - selinux-policy-targeted - - selinux-policy-mls - - selinux-policy-minimum -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 - continue: false -link: - - verifies: https://redhat.atlassian.net/browse/RHEL-141659 - - verifies: https://redhat.atlassian.net/browse/RHEL-157952 - - verifies: https://redhat.atlassian.net/browse/FC-1681 -id: ee9a0250-4a0a-4c56-bf4e-15228324dbc5 - diff --git a/selinux-policy/files-ownership/runtest.sh b/selinux-policy/files-ownership/runtest.sh deleted file mode 100755 index d5e79f1..0000000 --- a/selinux-policy/files-ownership/runtest.sh +++ /dev/null @@ -1,47 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of selinux-policy/files-ownership/runtest.sh -# Description: test if selinux-policy owns tree with interface files -# Author: Veronika Syncakova -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2026 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm selinux-policy - rlPhaseEnd - - rlPhaseStartTest "RHEL-141659 + RHEL-157952 + FC-1681" - for LOCATION in devel devel/include devel/include/distributed \ - packages/targeted packages/minimum packages/mls; do - rlRun -s "rpm -qf /usr/share/selinux/${LOCATION}" - rlAssertGrep "selinux-policy-" $rlRun_LOG -i - rm -f $rlRun_LOG - done - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalEnd \ No newline at end of file diff --git a/selinux-policy/firewalld-and-similar/Makefile b/selinux-policy/firewalld-and-similar/Makefile deleted file mode 100644 index 1912dab..0000000 --- a/selinux-policy/firewalld-and-similar/Makefile +++ /dev/null @@ -1,88 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/firewalld-and-similar -# Description: SELinux interferes with firewalld and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/firewalld-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with firewalld and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 30m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: firewalld" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console firewalld glib2 nftables procps-ng /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 907902" >> $(METADATA) # RHEL-7 - @echo "Bug: 989922" >> $(METADATA) # RHEL-7 - @echo "Bug: 1067494" >> $(METADATA) # RHEL-7 - @echo "Bug: 1214853" >> $(METADATA) # RHEL-7 - @echo "Bug: 1221326" >> $(METADATA) # RHEL-7 - @echo "Bug: 1243403" >> $(METADATA) # RHEL-7 - @echo "Bug: 1284902" >> $(METADATA) # RHEL-7 - @echo "Bug: 1304721" >> $(METADATA) # RHEL-7 - @echo "Bug: 1304723" >> $(METADATA) # RHEL-7 - @echo "Bug: 1342235" >> $(METADATA) # RHEL-7 - @echo "Bug: 1342587" >> $(METADATA) # RHEL-7 - @echo "Bug: 1346316" >> $(METADATA) # RHEL-7 - @echo "Bug: 1375576" >> $(METADATA) # RHEL-7 - @echo "Bug: 1418391" >> $(METADATA) # RHEL-7 - @echo "Bug: 1438708" >> $(METADATA) # RHEL-7 - @echo "Bug: 1573501" >> $(METADATA) # RHEL-8 - @echo "Bug: 1593687" >> $(METADATA) # RHEL-8 - @echo "Bug: 1600903" >> $(METADATA) # RHEL-8 - @echo "Bug: 1759010" >> $(METADATA) # RHEL-8 - @echo "Bug: 1989641" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/firewalld-and-similar/PURPOSE b/selinux-policy/firewalld-and-similar/PURPOSE deleted file mode 100644 index 04c3f20..0000000 --- a/selinux-policy/firewalld-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/firewalld-and-similar -Author: Milos Malik - -SELinux interferes with firewalld and related programs. - diff --git a/selinux-policy/firewalld-and-similar/main.fmf b/selinux-policy/firewalld-and-similar/main.fmf deleted file mode 100644 index ec559bc..0000000 --- a/selinux-policy/firewalld-and-similar/main.fmf +++ /dev/null @@ -1,72 +0,0 @@ -summary: SELinux interferes with firewalld and related programs -description: |+ - SELinux interferes with firewalld and related programs. - -contact: Milos Malik -component: - - selinux-policy - - firewalld -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - firewalld - - glib2 - - nftables - - procps-ng - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 30m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIP_fedora_pass - - TIPpass - - TIPpass_FIPS - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - NoRHIVOS -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=907902 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=989922 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1067494 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1214853 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1221326 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243403 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1284902 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1304721 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1304723 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1342235 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1342587 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1346316 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1375576 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1418391 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1438708 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1573501 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593687 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600903 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1759010 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1989641 -adjust+: - - enabled: false - when: distro < rhel-7 - continue: false -extra-nitrate: TC#0175059 -extra-summary: /CoreOS/selinux-policy/Regression/firewalld-and-similar -extra-task: /CoreOS/selinux-policy/Regression/firewalld-and-similar -id: e856e8cc-0893-457b-a1ef-a71c09b6fef9 diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh deleted file mode 100755 index 496e8d0..0000000 --- a/selinux-policy/firewalld-and-similar/runtest.sh +++ /dev/null @@ -1,235 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/firewalld-and-similar -# Description: SELinux interferes with firewalld and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -SERVICE_PACKAGE="firewalld" -SERVICE_NAME="firewalld" -PROCESS_NAME="firewalld" -PROCESS_CONTEXT="firewalld_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/firewalld/lockdown-whitelist.xml - rlFileBackup /etc/shadow - rlFileBackup /run/firewalld - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#907902" - rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" - rlSEMatchPathCon "/usr/lib64/python2.7/site.pyc" "lib_t" - rlSESearchRule "allow firewalld_t lib_t : dir { getattr open read search }" - rlSESearchRule "allow firewalld_t lib_t : file { getattr open read execute }" - rlPhaseEnd - - rlPhaseStartTest "bz#989922" - rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" - rlSEMatchPathCon "/etc/firewalld/lockdown-whitelist.xml" "firewalld_etc_rw_t" - rlSESearchRule "allow firewalld_t firewalld_etc_rw_t : lnk_file { getattr read }" - rlPhaseEnd - - rlPhaseStartTest "bz#1067494" - for USER_TYPE in user_t staff_t unconfined_t ; do - rlSESearchRule "allow ${USER_TYPE} firewalld_t : dbus { send_msg }" - rlSESearchRule "allow firewalld_t ${USER_TYPE} : dbus { send_msg }" - done - rlPhaseEnd - - if rlSEDefined "puppetagent_t" ; then - rlPhaseStartTest "bz#1214853" - rlSESearchRule "allow firewalld_t puppetagent_t : dbus { send_msg }" - rlSESearchRule "allow puppetagent_t firewalld_t : dbus { send_msg }" - rlPhaseEnd - fi - - rlPhaseStartTest "bz#1221326" - rlSESearchRule "allow firewalld_t openshift_initrc_t : dbus { send_msg }" - rlSESearchRule "allow openshift_initrc_t firewalld_t : dbus { send_msg }" - rlPhaseEnd - - rlPhaseStartTest "bz#1243403" - rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/xtables.lock" "iptables_var_run_t" - rlSESearchRule "allow iptables_t iptables_var_run_t : file { getattr open read lock } [ ]" - rlSESearchRule "type_transition iptables_t var_run_t : file iptables_var_run_t [ ]" - rlSESearchRule "allow iptables_t var_run_t : dir { read write add_name remove_name getattr open search } [ ]" - rlRun "sesearch -s unconfined_t -t var_run_t -c file -T | grep \"iptables_var_run_t.*xtables.lock\"" - rlPhaseEnd - - rlPhaseStartTest "bz#1284902" - rlSESearchRule "allow firewalld_t system_cronjob_t : dbus { send_msg }" - rlSESearchRule "allow system_cronjob_t firewalld_t : dbus { send_msg }" - rlPhaseEnd - - rlPhaseStartTest "bz#1342235" - rlSEMatchPathCon "/var/run/firewalld" "firewalld_var_run_t" - rlSESearchRule "allow iptables_t firewalld_var_run_t : file { getattr open read } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1304723 + bz#1346316" - rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" - rlSEMatchPathCon "/var/log" "var_log_t" - rlSEMatchPathCon "/var/log/firewalld" "firewalld_var_log_t" - rlSEMatchPathCon "/etc/sysconfig/network-scripts" "net_conf_t" - rlSEMatchPathCon "/etc/sysconfig/network-scripts/ifcfg-enp0s25.NdcLYC" "net_conf_t" - rlSESearchRule "allow firewalld_t var_log_t : dir { write add_name } [ ]" - rlSESearchRule "type_transition firewalld_t var_log_t : file firewalld_var_log_t [ ]" - rlSESearchRule "allow firewalld_t firewalld_var_log_t : file { create } [ ]" - rlSESearchRule "allow firewalld_t net_conf_t : dir { write add_name }" - rlSESearchRule "allow firewalld_t net_conf_t : file { getattr open read write rename create unlink setattr }" - rlPhaseEnd - - rlPhaseStartTest "bz#1342587" - rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" - rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/firewalld" "firewalld_var_run_t" - rlSESearchRule "allow firewalld_t var_run_t : dir { read write add_name remove_name getattr open search } [ ]" - rlSESearchRule "type_transition firewalld_t var_run_t : dir firewalld_var_run_t [ ]" - rlSESearchRule "allow firewalld_t firewalld_var_run_t : dir { create } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1304721" - rlSESearchRule "allow firewalld_t firewalld_etc_rw_t : file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open } ;" - rlPhaseEnd - - rlPhaseStartTest "bz#1418391" - rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" - rlSESearchRule "allow firewalld_t modules_object_t : dir { getattr open read search }" - rlPhaseEnd - - rlPhaseStartTest "bz#1438708" - rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" - rlSEMatchPathCon "/root" "admin_home_t" - rlSESearchRule "dontaudit firewalld_t admin_home_t : dir { write }" - rlPhaseEnd - - rlPhaseStartTest "bz#1375576" - rlSESearchRule "allow firewalld_t ldconfig_exec_t : file { getattr open read execute_no_trans } [ ]" - rlSESearchRule "type_transition firewalld_t ldconfig_exec_t : process ldconfig_t" 1 - rlSESearchRule "allow firewalld_t ldconfig_t : process { transition }" 1 - rlPhaseEnd - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1573501 + bz#1593687 + bz#1600903" - rlSEMatchPathCon "/usr/sbin/nft" "iptables_exec_t" - rlSESearchRule "allow firewalld_t firewalld_t : netlink_netfilter_socket { create }" - rlSESearchRule "allow firewalld_t kernel_t : system { module_request } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1759010" - rlSEMatchPathCon "/root/.cache" "cache_home_t" - rlSEMatchPathCon "/home/user/.cache" "cache_home_t" - rlSESearchRule "dontaudit firewalld_t firewalld_t : capability { dac_override }" - rlSESearchRule "allow firewalld_t cache_home_t : dir { create }" 1 - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "remnants from BZ#1574383" - rlSESearchRule "allow firewalld_t iptables_exec_t : file { map } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then - rlPhaseStartTest "bz#1989641" - rlSESearchRule "allow firewalld_t firewalld_t : capability { setpcap } [ ]" - rlSESearchRule "allow firewalld_t firewalld_t : process { setcap } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- bz#1304721" - rlServiceStart "firewalld" - rlRun "firewall-cmd --add-port 1234/tcp --permanent" - rlRun "firewall-cmd --remove-port 1234/tcp --permanent" - rlPhaseEnd - - DESTINATION="org.fedoraproject.FirewallD1" - if busctl | grep -iq ${DESTINATION} ; then - rlPhaseStartTest "real scenario -- DBus service" - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" - sleep 1 - rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" - rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" - rlServiceStop "firewalld" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - rlRun "rm -rf /run/firewalld" - rlRun "rm -f /run/xtables.lock" - if [ -f /etc/firewalld/lockdown-whitelist.xml ] ; then - rlRun "mv /etc/firewalld/lockdown-whitelist.xml /etc/firewalld/lockdown-whitelist.xml.orig" - rlRun "ln -s /etc/firewalld/lockdown-whitelist.xml.orig /etc/firewalld/lockdown-whitelist.xml" - fi - # see https://bugzilla.redhat.com/show_bug.cgi?id=907902#c7 - # rlRun "rm -f /usr/lib{,64}/python2.7/site.{pyc,pyo}" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlRun "rm -f /etc/firewalld/lockdown-whitelist.xml*" - rlRun "ls -dZ /run/firewalld | grep :firewalld_var_run_t" - if rlIsRHEL 7 ; then - rlRun "ls -Z /run/xtables.lock | grep :iptables_var_run_t" - fi - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/fwupd-and-similar/Makefile b/selinux-policy/fwupd-and-similar/Makefile deleted file mode 100644 index be34447..0000000 --- a/selinux-policy/fwupd-and-similar/Makefile +++ /dev/null @@ -1,73 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/fwupd-and-similar -# Description: SELinux interferes with fwupd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/fwupd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh ssh.exp - chcon -t bin_t runtest.sh ssh.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with fwupd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: fwupd" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 fwupd /usr/sbin/service expect" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) - @echo "Bug: 1772619" >> $(METADATA) # RHEL-8 - @echo "Bug: 1832231" >> $(METADATA) # RHEL-8 - @echo "Bug: 1832234" >> $(METADATA) # RHEL-8 - @echo "Bug: 1832772" >> $(METADATA) # RHEL-8 - @echo "Bug: 1851932" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/fwupd-and-similar/PURPOSE b/selinux-policy/fwupd-and-similar/PURPOSE deleted file mode 100644 index b988125..0000000 --- a/selinux-policy/fwupd-and-similar/PURPOSE +++ /dev/null @@ -1,6 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/fwupd-and-similar -Author: Milos Malik - -SELinux interferes with fwupd and related programs. -Standalone service and confined users are tested. - diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf deleted file mode 100644 index 237d4da..0000000 --- a/selinux-policy/fwupd-and-similar/main.fmf +++ /dev/null @@ -1,54 +0,0 @@ -summary: SELinux interferes with fwupd and related programs -description: |+ - SELinux interferes with fwupd and related programs. - Standalone service and confined users are tested. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - glib2 - - fwupd - - /usr/sbin/service - - expect -environment: - AVC_ERROR: +no_avc_check - ALLOWED_USERS: staff_u user_u sysadm_u unconfined_u - DENIED_USERS: guest_u xguest_u -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TierCandidatesPASS - - targeted - - NoRHIVOS -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772619 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832231 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832234 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832772 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851932 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1860924 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0563429 -extra-summary: /CoreOS/selinux-policy/Regression/fwupd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/fwupd-and-similar -id: 12996742-5ad6-4dd2-b04d-b4c781fcce79 diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh deleted file mode 100755 index eaf601a..0000000 --- a/selinux-policy/fwupd-and-similar/runtest.sh +++ /dev/null @@ -1,188 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/fwupd-and-similar -# Description: SELinux interferes with fwupd and related programs. -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/libexec/fwupd/fwupd" -FILE_CONTEXT="fwupd_exec_t" -SERVICE_PACKAGE="fwupd" -SERVICE_NAME="fwupd" -PROCESS_NAME="fwupd" -PROCESS_CONTEXT="fwupd_t" -ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} -DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlSEConfigureSSH - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined ${PROCESS_CONTEXT} ; then - rlPhaseStartTest "SELinux contexts and rules" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - fi - - DESTINATION="org.freedesktop.fwupd" - if busctl | grep -iq ${DESTINATION} ; then - rlPhaseStartTest "real scenario -- DBus service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # RHEL-4, RHEL-5, RHEL-6 is excluded - PROCESS_CONTEXT="unconfined_service_t" - fi - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" 0,1 - sleep 1 - rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" - rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # RHEL-4, RHEL-5, RHEL-6 is excluded - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - if rlSEDefined "fwupd_t" ; then - rlPhaseStartTest "bz#1772619" - # TODO: find an agreement about which confined users should be allowed - rlSESearchRule "allow staff_t fwupd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow fwupd_t staff_t : dbus { send_msg } [ ]" - rlSESearchRule "allow user_t fwupd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow fwupd_t user_t : dbus { send_msg } [ ]" - rlSESearchRule "allow sysadm_t fwupd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow fwupd_t sysadm_t : dbus { send_msg } [ ]" - rlSESearchRule "allow unconfined_t fwupd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow fwupd_t unconfined_t : dbus { send_msg } [ ]" - rlPhaseEnd - fi - - if rlSEDefined "fwupd_var_lib_t" ; then - rlPhaseStartTest "bz#1832231" - rlSEMatchPathCon "/var/lib/fwupd" "fwupd_var_lib_t" - rlSESearchRule "allow init_t fwupd_var_lib_t : dir { setattr } [ init_create_dirs ]" - rlPhaseEnd - fi - - if rlSEDefined "fwupd_cache_t" ; then - rlPhaseStartTest "bz#1832234" - rlSEMatchPathCon "/var/cache/fwupd" "fwupd_cache_t" - rlSEMatchPathCon "/var/cache/fwupd/motd.d" "fwupd_cache_t" - rlSEMatchPathCon "/var/cache/fwupd/motd.d/85-fwupd" "fwupd_cache_t" - rlSESearchRule "allow init_t pam_var_run_t : dir { mounton } [ init_create_dirs ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1851932" - rlSESearchRule "allow systemd_logind_t fwupd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow fwupd_t systemd_logind_t : dbus { send_msg } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1832772" - rlSEMatchPathCon "/dev/shm/lldpad.state" "lldpad_tmpfs_t" - rlSESearchRule "allow init_t lldpad_tmpfs_t : file { getattr } [ ]" - rlSESearchRule "allow init_t squid_tmpfs_t : file { getattr } [ ]" - rlSESearchRule "allow init_t vhostmd_tmpfs_t : file { getattr } [ ]" - rlSESearchRule "allow init_t wdmd_tmpfs_t : file { getattr } [ ]" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- bz#1832772" - rlRun "ls -Z /dev/shm" - rlRun "service fwupd-refresh start" 0-255 - sleep 1 - rlRun "service fwupd-refresh status" 0-255 - sleep 1 - rlRun "service fwupd-refresh stop" 0-255 - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- confined users -- bz#1772619" - CREATED_USERS="" - rlRun "setsebool ssh_sysadm_login on" - rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "restorecon -RvF /home/${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost fwupdmgr get-devices" - sleep 2 - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" - done - rlRun "setsebool ssh_sysadm_login off" - for USER_NAME in ${CREATED_USERS} ; do - rlRun "userdel -rfZ ${USER_NAME}" - done - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/fwupd-and-similar/ssh.exp b/selinux-policy/fwupd-and-similar/ssh.exp deleted file mode 100755 index 58c9647..0000000 --- a/selinux-policy/fwupd-and-similar/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname $command -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index 6c545f7..2ddf9f6 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -1,48 +1,5 @@ -summary: Is the getrlimit permission defined? Are appropriate checks applied? -description: |+ - Is the getrlimit permission defined? Are { getrlimit } SELinux denials triggered when certain access happens? - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - util-linux -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail -duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - f33friendly - - targeted - - NoRHIVOS -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549691 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549772 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 - continue: false -extra-nitrate: TC#0574397 -extra-summary: /CoreOS/selinux-policy/Sanity/getrlimit-permission -extra-task: /CoreOS/selinux-policy/Sanity/getrlimit-permission -id: d266c52f-08b3-4ab6-80bb-c41370e9e8b2 +path: /selinux-policy/getrlimit-permission +tier: 2 +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/selinux-policy/getrlimit-permission/runtest.sh b/selinux-policy/getrlimit-permission/runtest.sh index 9d4ee00..846434e 100755 --- a/selinux-policy/getrlimit-permission/runtest.sh +++ b/selinux-policy/getrlimit-permission/runtest.sh @@ -27,13 +27,14 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/gnome-remote-desktop-and-similar/Makefile b/selinux-policy/gnome-remote-desktop-and-similar/Makefile deleted file mode 100644 index c68a44f..0000000 --- a/selinux-policy/gnome-remote-desktop-and-similar/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar -# Description: SELinux interferes with gnome-remote-desktop-daemon and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with gnome-remote-desktop-daemon and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: gnome-remote-desktop" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service gnome-remote-desktop gdm freerdp" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2321236" >> $(METADATA) # Fedora 42 - @echo "Bug: RHEL-35877" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/gnome-remote-desktop-and-similar/PURPOSE b/selinux-policy/gnome-remote-desktop-and-similar/PURPOSE deleted file mode 100644 index ba1be55..0000000 --- a/selinux-policy/gnome-remote-desktop-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar -Author: Milos Malik - -SELinux interferes with gnome-remote-desktop-daemon and related programs. - diff --git a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf deleted file mode 100644 index 362abd7..0000000 --- a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf +++ /dev/null @@ -1,46 +0,0 @@ -summary: SELinux interferes with gnome-remote-desktop and related programs -description: |+ - SELinux interferes with gnome-remote-desktop-daemon and related programs. - -contact: Milos Malik -component: - - gnome-remote-desktop - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - gnome-remote-desktop - - gdm - - freerdp -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2321236 - - verifies: https://issues.redhat.com/browse/RHEL-35877 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar -extra-task: /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar -extra-nitrate: TC#0617929 diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh deleted file mode 100755 index 2349eb1..0000000 --- a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh +++ /dev/null @@ -1,107 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar -# Description: SELinux interferes with gnome-remote-desktop-daemon and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/libexec/gnome-remote-desktop-daemon" -SERVICE_PACKAGE="gnome-remote-desktop" -SERVICE_NAME="gnome-remote-desktop" -PROCESS_NAME="gnome-remote-desktop-daemon" -if semodule -l | grep -q gnome_remote_desktop ; then - FILE_CONTEXT="gnome_remote_desktop_exec_t" - PROCESS_CONTEXT="gnome_remote_desktop_t" -else - FILE_CONTEXT="bin_t" - PROCESS_CONTEXT="unconfined_service_t" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined "gnome_remote_desktop_t" ; then - rlPhaseStartTest "bz#2321236" - rlSEMatchPathCon "/usr/libexec/gnome-remote-desktop-daemon" "gnome_remote_desktop_exec_t" - rlSEMatchPathCon "/etc/gnome-remote-desktop" "etc_t" - rlSESearchRule "allow gnome_remote_desktop_t etc_t : dir { watch } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-35877" - rlSESearchRule "allow gnome_remote_desktop_t policykit_t : dbus { send_msg } [ ]" - rlSESearchRule "allow policykit_t gnome_remote_desktop_t : dbus { send_msg } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/gnome-remote-desktop.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "rm -rf ~gnome-remote-desktop/.local/share/gnome-remote-desktop" - rlRun "sudo -u gnome-remote-desktop mkdir -p ~gnome-remote-desktop/.local/share/gnome-remote-desktop" - rlRun "sudo -u gnome-remote-desktop winpr-makecert -silent -rdp -path ~gnome-remote-desktop/.local/share/gnome-remote-desktop tls" - rlRun "grdctl --system rdp set-tls-key ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.key" - rlRun "grdctl --system rdp set-tls-cert ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.crt" - rlRun "grdctl --system rdp set-credentials nobody nothing" - rlRun "grdctl --system rdp enable" - rlRun "systemctl enable --now gdm" - sleep 2 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "grdctl --headless status" - rlRun "grdctl --system status" - rlRun "grdctl --system rdp enable" - rlRun "grdctl --system vnc enable" - rlRun "grdctl --system status" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlRun "systemctl stop gdm" - rlPhaseEnd - fi - - # TODO: test the gnome-remote-desktop service under normal/confined users - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/hostapd-and-similar/Makefile b/selinux-policy/hostapd-and-similar/Makefile deleted file mode 100644 index 4c1c5dd..0000000 --- a/selinux-policy/hostapd-and-similar/Makefile +++ /dev/null @@ -1,82 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/hostapd-and-similar -# Description: SELinux interferes with hostapd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/hostapd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with hostapd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: hostapd" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console hostapd /usr/sbin/service kernel-modules-internal" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 1224405" >> $(METADATA) # Fedora 22 - @echo "Bug: 1225245" >> $(METADATA) # Fedora 22 - @echo "Bug: 1237343" >> $(METADATA) # Fedora 22 - @echo "Bug: 1266068" >> $(METADATA) # Fedora 23 - @echo "Bug: 1273570" >> $(METADATA) # Fedora 23 - @echo "Bug: 1278569" >> $(METADATA) # Fedora 23 - @echo "Bug: 1282179" >> $(METADATA) # Fedora 23 - @echo "Bug: 1334021" >> $(METADATA) # Fedora 24 - @echo "Bug: 1343683" >> $(METADATA) # Fedora 24 - @echo "Bug: 1977676" >> $(METADATA) # RHEL-8 - @echo "Bug: 1979968" >> $(METADATA) # RHEL-9 - @echo "Bug: 1784253" >> $(METADATA) # Fedora 35 - @echo "Bug: 2032277" >> $(METADATA) # Fedora 35 - @echo "Bug: RHEL-59683" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/hostapd-and-similar/PURPOSE b/selinux-policy/hostapd-and-similar/PURPOSE deleted file mode 100644 index 7f50b6d..0000000 --- a/selinux-policy/hostapd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/hostapd-and-similar -Author: Milos Malik - -SELinux interferes with hostapd and related programs. - diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf deleted file mode 100644 index a99ac23..0000000 --- a/selinux-policy/hostapd-and-similar/main.fmf +++ /dev/null @@ -1,64 +0,0 @@ -summary: SELinux interferes with hostapd and related programs -description: |+ - SELinux interferes with hostapd and related programs. - -contact: Milos Malik -component: - - hostapd - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - hostapd - - /usr/sbin/service - - kernel-modules-internal -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL8 - - TIPpass_Security - - failinfedora - - targeted - - NoRHIVOS - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1224405 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1225245 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1237343 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1266068 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1273570 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1278569 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1282179 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1334021 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1343683 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1977676 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1979968 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1784253 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2032277 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2064688 - - verifies: https://issues.redhat.com/browse/RHEL-59683 -adjust+: - - enabled: false - when: arch == s390x - continue: false - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0602539 -extra-summary: /CoreOS/selinux-policy/Regression/hostapd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/hostapd-and-similar -id: 83fb3ff1-3bd6-4400-a677-fe38f712d966 diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh deleted file mode 100755 index 1ed5ed0..0000000 --- a/selinux-policy/hostapd-and-similar/runtest.sh +++ /dev/null @@ -1,134 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/hostapd-and-similar -# Description: SELinux interferes with hostapd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/hostapd" -FILE_CONTEXT="hostapd_exec_t" -SERVICE_PACKAGE="hostapd" -SERVICE_NAME="hostapd" -PROCESS_NAME="hostapd" -PROCESS_CONTEXT="hostapd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - rlRun "rpm -qa kernel\*" - rlRun "uname -a" - rlRun "yum -y install kernel-modules-internal-`uname -r` --enablerepo '*'" - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlFileBackup /etc/hostapd/hostapd.conf - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined ${PROCESS_CONTEXT} ; then - rlPhaseStartTest "bz#1224405" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/run/hostapd" "hostapd_var_run_t" - rlSEMatchPathCon "/run/hostapd/wlan0" "hostapd_var_run_t" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "dontaudit hostapd_t debugfs_t : dir { search } [ ]" - rlSESearchRule "allow hostapd_t hostapd_var_run_t : sock_file { create setattr unlink } [ ]" - rlSESearchRule "allow hostapd_t hostapd_t : capability { fsetid } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1225245" - rlSESearchRule "allow hostapd_t hostapd_t : capability { net_admin } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1237343" - rlSESearchRule "allow hostapd_t hostapd_t : capability { net_raw } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1266068 + bz#1273570 + bz#1278569 + bz#1282179 + bz#1334021 + bz#1343683" - rlSESearchRule "allow hostapd_t hostapd_t : netlink_generic_socket { create setopt bind getattr } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1977676 + bz#1979968" - rlSEMatchPathCon "/usr/sbin/hostapd" "hostapd_exec_t" - rlSEMatchPortCon udp 67 dhcpd_port_t - rlSESearchRule "allow hostapd_t hostapd_t : capability { net_bind_service } [ ]" - rlSESearchRule "allow hostapd_t dhcpd_port_t : udp_socket { name_bind } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1784253 + bz#2032277" - rlSESearchRule "allow hostapd_t user_tmp_t : sock_file { write } [ ]" - rlSESearchRule "allow hostapd_t unconfined_t : unix_dgram_socket { sendto } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - rlRun "modprobe mac80211_hwsim" - rlRun "lsmod | grep mac80211_hwsim" - rlRun "sed -i 's/^interface=.*$//' /etc/hostapd/hostapd.conf" - rlRun "sed -i 's/^hw_mode=.*$//' /etc/hostapd/hostapd.conf" - rlRun "sed -i 's/^channel=.*$//' /etc/hostapd/hostapd.conf" - rlRun "sed -i 's/^ssid=.*//' /etc/hostapd/hostapd.conf" - rlRun "echo interface=wlan0 >> /etc/hostapd/hostapd.conf" - rlRun "echo hw_mode=g >> /etc/hostapd/hostapd.conf" - rlRun "echo channel=10 >> /etc/hostapd/hostapd.conf" - rlRun "echo ssid=somename >> /etc/hostapd/hostapd.conf" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlRun "hostapd_cli all_sta" - rlRun "systemd-run hostapd_cli ping" - sleep 5 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/icecast-and-similar/Makefile b/selinux-policy/icecast-and-similar/Makefile deleted file mode 100644 index 51ccee4..0000000 --- a/selinux-policy/icecast-and-similar/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/icecast-and-similar -# Description: SELinux interferes with icecast and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/icecast-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with icecast and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service icecast" >> $(METADATA) # EPEL - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL8 -RHEL9" >> $(METADATA) - @echo "Architectures: aarch64 ppc64le s390x x86_64" >> $(METADATA) - @echo "Bug: 894387" >> $(METADATA) # RHEL-6 - @echo "Bug: 2156763" >> $(METADATA) # Fedora 36 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/icecast-and-similar/PURPOSE b/selinux-policy/icecast-and-similar/PURPOSE deleted file mode 100644 index 7a60dce..0000000 --- a/selinux-policy/icecast-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/icecast-and-similar -Author: Milos Malik - -SELinux interferes with icecast and related programs. - diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf deleted file mode 100644 index 5a60241..0000000 --- a/selinux-policy/icecast-and-similar/main.fmf +++ /dev/null @@ -1,52 +0,0 @@ -summary: SELinux interferes with icecast and related programs -description: |+ - SELinux interferes with icecast and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - icecast -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - TIPpass_Security - - TierCandidatesPASS - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=894387 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2156763 -adjust+: - - enabled: false - when: arch == i386, ppc, ppc64, s390 - because: the icecast package is not available for all architectures - - enabled: false - when: distro >= rhel-8 - because: the icecast package is not available there - - enabled: false - when: distro == centos-stream-8, centos-stream-9 - because: the icecast package is not available there -extra-nitrate: TC#0388472 -extra-summary: /CoreOS/selinux-policy/Regression/icecast-and-similar -extra-task: /CoreOS/selinux-policy/Regression/icecast-and-similar -id: 59e31ab5-6779-410c-8acb-97380a6843cd diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh deleted file mode 100755 index bcce208..0000000 --- a/selinux-policy/icecast-and-similar/runtest.sh +++ /dev/null @@ -1,138 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/icecast-and-similar -# Description: SELinux interferes with icecast and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/bin/icecast" -FILE_CONTEXT="icecast_exec_t" -SERVICE_PACKAGE="icecast" -SERVICE_NAME="icecast" -PROCESS_NAME="icecast" -PROCESS_CONTEXT="icecast_t" - -rlJournalStart - if rlIsRHEL ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/icecast.xml - - rlRun "setenforce 1" - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest "SELinux contexts and rules" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - - rlPhaseStartTest "bz#894387" - rlSEMatchPathCon "/usr/bin/icecast" "icecast_exec_t" - rlSEMatchPortCon tcp 8080 http_cache_port_t - rlSESearchRule "allow icecast_t http_cache_port_t : tcp_socket { name_bind } [ icecast_use_any_tcp_ports ]" - if rlIsRHEL 6 ; then - rlSESearchRule "dontaudit icecast_t tmp_t : dir { read }" - fi - rlPhaseEnd - - rlPhaseStartTest "bz#2156763" - rlSEMatchPathCon "/usr/bin/icecast" "icecast_exec_t" - rlSEMatchPathCon "/var/log/icecast" "icecast_log_t" - rlSEMatchPathCon "/var/log/icecast/error.log" "icecast_log_t" - rlSESearchRule "allow icecast_t icecast_log_t : dir { remove_name } [ ]" - rlSESearchRule "allow icecast_t icecast_log_t : file { rename } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- bz#894387" - if rlIsRHEL 5 6 ; then - rlRun "setsebool icecast_connect_any on" - else - rlRun "setsebool icecast_use_any_tcp_ports on" - fi - rlRun "sed -i \"s|8000|8080|\" /etc/icecast.xml" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "sed -i 's|^\(.*logsize>\).*\(\).*$|\1|' /etc/icecast.xml" - rlRun "grep logarchive /etc/icecast.xml" - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - if rlIsRHEL 5 6 ; then - rlRun "setsebool icecast_connect_any off" - else - rlRun "setsebool icecast_use_any_tcp_ports off" - fi - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/iio-sensor-proxy-and-similar/Makefile b/selinux-policy/iio-sensor-proxy-and-similar/Makefile deleted file mode 100644 index d79e134..0000000 --- a/selinux-policy/iio-sensor-proxy-and-similar/Makefile +++ /dev/null @@ -1,72 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar -# Description: SELinux interferes with iio-sensor-proxy and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with iio-sensor-proxy and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: iio-sensor-proxy" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console iio-sensor-proxy /usr/sbin/service gdm" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: RHEL-17346" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-62355" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-70850" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-110090" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE b/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE deleted file mode 100644 index b41c372..0000000 --- a/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE +++ /dev/null @@ -1,6 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar -Author: Milos Malik - -SELinux interferes with the iio-sensor-proxy service and related programs. - -Known interactions: iio-sensor-proxy + gdm. diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf deleted file mode 100644 index 691dbb8..0000000 --- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf +++ /dev/null @@ -1,52 +0,0 @@ -summary: SELinux interferes with iio-sensor-proxy and related programs -description: |+ - SELinux interferes with the iio-sensor-proxy and related programs. - -contact: Milos Malik -component: - - iio-sensor-proxy - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - iio-sensor-proxy - - /usr/sbin/service - - gdm -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - failinfedora - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-17346 - - verifies: https://issues.redhat.com/browse/RHEL-62355 - - verifies: https://issues.redhat.com/browse/RHEL-70850 - - verifies: https://issues.redhat.com/browse/RHEL-110090 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the iio-sensor-proxy package is not available there - - enabled: false - when: arch == s390x - because: the service is not activatable there -extra-summary: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar -extra-task: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar -extra-nitrate: TC#0617897 -id: f951c38a-3013-490f-893a-fb18e9ad7cbb diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh deleted file mode 100755 index d4b6599..0000000 --- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh +++ /dev/null @@ -1,115 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar -# Description: SELinux interferes with iio-sensor-proxy and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/libexec/iio-sensor-proxy" -SERVICE_NAME="iio-sensor-proxy" -PROCESS_NAME="iio-sensor-proxy" -if seinfo -t | grep -q iiosensor ; then - PROCESS_CONTEXT="iiosensorproxy_t" - FILE_CONTEXT="iiosensorproxy_exec_t" -else - PROCESS_CONTEXT="unconfined_service_t" - FILE_CONTEXT="bin_t" -fi - -rlJournalStart - if rlIsRHEL 7 || rlIsCentOS 7 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -qf ${FILE_PATH}" - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/systemd/system/iio-sensor-proxy.service - rlServiceStart gdm - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if seinfo -t | grep -q iiosensorproxy ; then - rlPhaseStartTest "RHEL-17346 + RHEL-62355 + RHEL-70850" - rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} - rlSESearchRule "allow xdm_t iiosensorproxy_t : dbus { send_msg } [ ]" - rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]" - rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : capability2 { bpf } [ ]" - rlPhaseEnd - fi - - if seinfo -t | grep -q iio_device_t ; then - rlPhaseStartTest "RHEL-110090" - rlRun "semanage fcontext -l | grep '/dev/iio:device.*character.*iio_device_t'" - rlSEMatchPathCon "/dev/iio:device3" "iio_device_t" - rlSESearchRule "allow iiosensorproxy_t sysfs_t : dir { write } [ ]" - rlSESearchRule "allow iiosensorproxy_t sysfs_t : file { write } [ ]" - rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : unix_dgram_socket { create } [ ]" - rlSESearchRule "allow iiosensorproxy_t iio_device_t : chr_file { read } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "cp -f /usr/lib/systemd/system/iio-sensor-proxy.service /etc/systemd/system/" - rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /etc/systemd/system/iio-sensor-proxy.service" - rlRun "systemctl daemon-reload" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_LIGHT_SENSOR=1/' /etc/systemd/system/iio-sensor-proxy.service" - rlRun "systemctl daemon-reload" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "gdbus introspect --system --dest net.hadess.SensorProxy --object-path /net/hadess/SensorProxy" 0,1 - rlWatchdog "monitor-sensor --all" 10 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlRun "systemctl daemon-reload" - rlServiceRestore ${SERVICE_NAME} - rlServiceRestore gdm - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/install-uninstall-dsp-packages/Makefile b/selinux-policy/install-uninstall-dsp-packages/Makefile deleted file mode 100644 index b801290..0000000 --- a/selinux-policy/install-uninstall-dsp-packages/Makefile +++ /dev/null @@ -1,67 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages -# Description: Test and discover conflicts if any, during installation of -# third-party or DSP packages. -# Author: Amith Kumar -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) additional-dsp-packages.txt dbus-sendmsg.pl runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Amith Kumar " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Install-uninstall dsp packages to discover conflicts" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 40m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL6 -RHELClient5 -RHELServer5 -RHEL7" >> $(METADATA) - - - rhts-lint $(METADATA) - diff --git a/selinux-policy/install-uninstall-dsp-packages/PURPOSE b/selinux-policy/install-uninstall-dsp-packages/PURPOSE deleted file mode 100644 index f065acb..0000000 --- a/selinux-policy/install-uninstall-dsp-packages/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages -Author: Amith Kumar - -Test and discover conflicts if any, during installation of third-party or -DSP packages. diff --git a/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt b/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt deleted file mode 100644 index bb3d718..0000000 --- a/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt +++ /dev/null @@ -1,13 +0,0 @@ -# List of additional DSP packages which distribute its custom SELinux module, -# but not in a subpackage with the "-selinux" suffix -# This file is being maintained manually - -BackupPC -# beah - temporary not working in rawhide -ec2-hibinit-agent -google-compute-engine-oslogin -mariadb-cracklib-password-check -mariadb-server-galera -postsrsd -qm -receptor diff --git a/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl b/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl deleted file mode 100755 index cc46f51..0000000 --- a/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl +++ /dev/null @@ -1,71 +0,0 @@ -#!/usr/bin/perl -w -### Check if dbus communication is allowed bidirectionally - -use strict; - -my $sesearch_cmd="/usr/bin/sesearch"; -my $sesearch_args="-A -c dbus -p send_msg"; -my ($line, @output); -my (@seoutarray, $seout, $seline); -my $count=0; - -# Take all allow rules matching the description -open SESEARCH, "$sesearch_cmd $sesearch_args |" - or die "Cannot run sesearch: $!"; -while ($line =) { - $count++; - #debug printf "%4d %s", $count, $line; - chomp $line; - # > sesearch -A -t systemd_timedated_t -s initrc_t -c dbus -p send_msg - # allow dbusd_unconfined nsswitch_domain:dbus send_msg; - # allow system_bus_type system_dbusd_t:dbus { acquire_svc send_msg }; - # allow NetworkManager_t xguest_t:dbus send_msg; [ xguest_connect_network ]:True - @output = split /[ :]/, $line; - next if $output[2] eq "self"; - next if $output[2] eq $output[1]; - # Look for the rule in the inverse direction - open $seout, "$sesearch_cmd $sesearch_args -s $output[2] -t $output[1] |" - or die "Cannot run sesearch: $!"; - @seoutarray = <$seout>; - if (@seoutarray == 0) { - print "No reverse match: $line\n"; - } - else { - foreach $seline (@seoutarray) { - if ($seline =~ /\]:/) { - print "Conditional rule: $seline"; - print " Original line: $line\n"; - } - } - } - close $seout; -} -print "Total dbus:send_msg rules number: $count\n"; - -__END__ - -State as of 2024.03.05 -f39: 1738 rules, 8 asymmetrical -RHEL9: 1731 rules, 6 asymmetrical -RHEL8: 2359 rules, 52 asymmetrical - -f39 -No reverse match: allow cronjob_t openshift_app_t:dbus send_msg; -No reverse match: allow cronjob_t openshift_t:dbus send_msg; -No reverse match: allow cronjob_t staff_t:dbus send_msg; -No reverse match: allow cronjob_t sysadm_t:dbus send_msg; -No reverse match: allow cronjob_t user_t:dbus send_msg; -No reverse match: allow pasta_t init_t:dbus send_msg; -No reverse match: allow pasta_t system_dbusd_t:dbus send_msg; -No reverse match: allow pasta_t systemd_hostnamed_t:dbus send_msg; - -RHEL9 -No reverse match: allow cronjob_t openshift_app_t:dbus send_msg; -No reverse match: allow cronjob_t openshift_t:dbus send_msg; -No reverse match: allow cronjob_t staff_t:dbus send_msg; -No reverse match: allow cronjob_t sysadm_t:dbus send_msg; -No reverse match: allow cronjob_t user_t:dbus send_msg; -No reverse match: allow nvme_stas_t system_dbusd_t:dbus { acquire_svc send_msg }; - -RHEL8 - diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf deleted file mode 100644 index cd594e9..0000000 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ /dev/null @@ -1,43 +0,0 @@ -summary: Install-Uninstall third-party or dsp packages to discover conflicts. -description: |+ - Test and discover rpm package installaton conflicts if any, during installation - of third-party or DSP selinux packages. - -contact: Amith Kumar -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - selinux-policy - - selinux-policy-targeted - - dnf - - perl -environment: - AVC_ERROR: +no_avc_check -duration: 60m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - TIPfail_Security - - failinfedora - - targeted - - NoRHIVOS - - rhel9_broken - - rhel10_broken - - avoidImageMode -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0617855 -extra-summary: /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages -extra-task: /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages -id: 22a728a8-c83b-49f9-8a20-57f0d35c7dc9 diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh deleted file mode 100755 index 8b77fb6..0000000 --- a/selinux-policy/install-uninstall-dsp-packages/runtest.sh +++ /dev/null @@ -1,230 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages -# Description: Test and discover conflicts if any, during installation of -# third-party or DSP packages. -# Author: Amith Kumar -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SKIP_REMOVAL=${SKIP_REMOVAL:-""} -SKIP_INSTALL=${SKIP_INSTALL:-""} -INSTALL_ONLY=${INSTALL_ONLY:-""} -ADDITIONAL_DSP_PACKAGES="additional-dsp-packages.txt" -TMPDIR=${TMPDIR-"/var/tmp"} -OUTDIR="${TMPDIR}/test-output" -FCONTEXT_LIST="${OUTDIR}/semanage-fcontext" -FCONTEXT_LIST2="${OUTDIR}/semanage-fcontext2" -FCONTEXT_LIST_VARRUN="${OUTDIR}/semanage-fcontext-varrun" -RESTORECON_RVN_RUN="${OUTDIR}/restorecon-rvn-run" -RPMQA="${OUTDIR}/rpmqa" -SEMODULE_LIST="${OUTDIR}/semodule-list" -SEMODULE_LIST_DSP="${OUTDIR}/semodule-list-dsp" -PERMISSIVE_DOMAINS="${OUTDIR}/permissive-domains" -UNCONFINED_DOMAINS="${OUTDIR}/unconfined-domains" -DBUS_SENDMSG="${OUTDIR}/dbus-sendmsg" -mkdir -p ${OUTDIR} - -# Function to create a report template for install test -function install_report() { -echo "" > pkglist.report -echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report -echo '@ LIST OF PACKAGES TO BE INSTALLED @' >> pkglist.report -echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report -cat install-pkgs >> pkglist.report -echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report -echo "" >> pkglist.report -echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report -echo '@ INSTALLATION : Test Report @' >> pkglist.report -echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report -} - -# Function to create a report template for uninstall test -function uninstall_report() { -echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report -echo '@ UNINSTALLATION : Test Report @' >> pkglist.report -echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report -} - -# Function to summarize the test report -function summary_report() { -echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report -echo '@ TEST SUMMARY @' >> pkglist.report -echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report -SEL=`cat install-pkgs | wc -l` -PASS1=`grep "installation : PASS" pkglist.report | wc -l` -FAIL1=`grep "installation : FAIL" pkglist.report | wc -l` -PASS2=`grep "removal : PASS" pkglist.report | wc -l` -FAIL2=`grep "removal : FAIL" pkglist.report | wc -l` -echo "Total no. of packages selected for installation : $SEL" >> pkglist.report -echo "Total no. of successful package installation : $PASS1" >> pkglist.report -echo "Total no. of failed package installation : $FAIL1" >> pkglist.report -echo "Total no. of successful package removal : $PASS2" >> pkglist.report -echo "Total no. of failed package removal : $FAIL2" >> pkglist.report -echo "" >> pkglist.report -if [ -f "Err_file" ]; then - echo "DETAILED ERROR LOG (IF ANY)" >> pkglist.report - echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report - cat Err_file >> pkglist.report -fi -} - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "Install test for dsp packages" - # test can fail when selinux-policy-mls is installed - if rpm -q selinux-policy-mls > /dev/null - then rlRun "dnf -y remove selinux-policy-mls" - fi - rlRun "dnf list \"*-selinux*\" --enablerepo=\"*\" --disablerepo=\"beaker-tasks\" --disablerepo=\"*-source\" --disablerepo=\"*-debuginfo\" > install-list" - # limit the list to not installed packages - rlRun "sed -i '1,/Available Packages/d' install-list" - # exclude packages from the beaker-tasks repo - rlRun "sed -i '/beaker-tasks/d' install-list" - # exclude debuginfo packages - rlRun "sed -i '/-debuginfo/d' install-list" - # packages names only - rlRun "awk '{print \$1}' install-list > pkgonlylist" - # exclude updates-source - rlRun "grep -vE '(.src)' pkgonlylist | sort -u > install-pkgs" - # include additional packages which do not match the "*-selinux" pattern - # currently for Fedora only - if rlIsFedora ">=38" - then - # remove comments and blank lines - rlRun "sed '/^[#]/d;/^$/d' ${ADDITIONAL_DSP_PACKAGES} >> install-pkgs" - fi - # use the same list for checks of the subsequent uninstallation - rlRun "cp -f install-pkgs uninstall-pkgs" - rlRun "install_report" - # Following loop will read each package from file install-pkgs - # and will attempt to install it using dnf utility. Both - # successful and failed attempts will be reported and the - # report will be published in the end. - cat install-pkgs | while read line - do - if dnf -q -y install --enablerepo="*" $line - then - rlLog "$line installation : PASS" - echo "$line installation : PASS" >> pkglist.report - else - rlLog "$line installation : FAIL" - echo "$line installation : FAIL" >> pkglist.report - sed -i "/$line/d" uninstall-pkgs - echo "Installation Failed for : $line" >> Err_file - dnf -q -y install --enablerepo="*" $line 2>> Err_file - echo "" >> Err_file - fi - done - echo "" >> pkglist.report - rlPhaseEnd - - ### Checks performed with all dsp packages installed - - ### Status of /run and /var/run equivalency - rlPhaseStartTest "Check /run equivalency status" - rlRun "semanage fcontext -l > ${FCONTEXT_LIST}" - if grep -q "/run = /var/run" ${FCONTEXT_LIST}; then - rlLogInfo "Legacy equivalency settings \"/run = /var/run\" are in place." - elif grep -q "/var/run = /run" ${FCONTEXT_LIST}; then - rlLog "New equivalency settings \"/var/run = /run\" are in place." - grep -v "/var/run = /run" ${FCONTEXT_LIST} > ${FCONTEXT_LIST2} - if grep -q "^/var/run" ${FCONTEXT_LIST2}; then - rlLogWarning "/var/run entries found in the file context database" - rlRun "sed '/^\/var\/run/!d; s|[ \t].*$||' ${FCONTEXT_LIST2} | uniq > ${FCONTEXT_LIST_VARRUN}" - - # List /var/run rules which do not have an equivalent one in /run - while read line - do - if ! grep -q "^${line#/var}" ${FCONTEXT_LIST2}; then - rlLog "Dup rule does not exist in /run: \"$line\"" - fi - done < ${FCONTEXT_LIST_VARRUN} - fi - else rlLogWarning "None or unknown /run equivalency settings." - fi - - [ "$DEBUG" = "yes" ] || - rlRun "rm -f ${FCONTEXT_LIST} ${FCONTEXT_LIST_VARRUN}" - rlPhaseEnd - - ### Store some data which might be of some use later - rlPhaseStartTest "Gather relevant data" - if [ "${DEBUG}" = "yes" ]; then - rlRun "restorecon -Rvn /run > ${RESTORECON_RVN_RUN}" - rlRun "rpm -qa | sort > ${RPMQA}" - rlRun "semanage permissive -l > ${PERMISSIVE_DOMAINS}" - rlRun "seinfo -xa unconfined_domain_type > ${UNCONFINED_DOMAINS}" - rlRun "semodule -lfull > ${SEMODULE_LIST}" - rlRun "grep -v ^100 ${SEMODULE_LIST} > ${SEMODULE_LIST_DSP}" - rlRun "./dbus-sendmsg.pl > ${DBUS_SENDMSG}" - fi - rlPhaseEnd - - rlPhaseStartTest "Uninstall test for dsp packages" - rlRun "uninstall_report" - # Following loop will read each package from file install-pkgs - # and will attempt to un-install it using dnf utility. - cat uninstall-pkgs | while read line - do - if dnf -q -y remove $line - then - rlLog "$line removal : PASS" - echo "$line removal : PASS" >> pkglist.report - else - rlLog "$line removal : FAIL" - echo "$line removal : FAIL" >> pkglist.report - echo "Removal Failed for : $line" >> Err_file - dnf -q -y remove $line 2>> Err_file - echo "" >> Err_file - fi - done - echo "" >> pkglist.report - rlRun "summary_report" - rlAssertNotGrep "FAIL" pkglist.report - rlRun "cat pkglist.report" - rlPhaseEnd - - rlPhaseStartCleanup - if [ -f "Err_file" ]; then - rlRun "rm -f Err_file" - fi - [ "$DEBUG" = "yes" ] || - rlRun "rm -f install-list pkgonlylist install-pkgs uninstall-pkgs pkglist.report" - rlSECheckAVC --ignore 'type=USER_AVC.*denied.* send_msg .*scontext=.*:unconfined_t:.*tcontext=.*:system_dbusd_t:.*tclass=dbus' \ - --ignore 'type=USER_AVC.* start .*:unconfined_t:.*:init_t:.*tclass=system' \ - --ignore 'type=USER_AVC.* start .*:unconfined_t:.*:init_var_run_t:.*tclass=service' - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/selinux-policy/interface-definitions/main.fmf b/selinux-policy/interface-definitions/main.fmf deleted file mode 100644 index 6bf6d98..0000000 --- a/selinux-policy/interface-definitions/main.fmf +++ /dev/null @@ -1,34 +0,0 @@ -summary: Are all policy interfaces defined correctly? -contact: Milos Malik -component: - - selinux-policy - - policycoreutils -recommend: - - /usr/bin/sepolgen-ifgen - - selinux-policy - - selinux-policy-devel - - selinux-policy-targeted -test: ./runtest.sh -framework: beakerlib -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - targeted - - failinfedora - - NoRHIVOS - - avoidImageMode -link: - - verifies: https://issues.redhat.com/browse/RHEL-2616 - - verifies: https://issues.redhat.com/browse/RHEL-16185 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2254169 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2254206 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2277925 - - verifies: https://issues.redhat.com/browse/RHEL-34769 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - because: decision was made not to fix the problem there -extra-nitrate: TC#0615941 -id: a6785475-8446-47cc-9167-f2d6ad52d58e diff --git a/selinux-policy/interface-definitions/runtest.sh b/selinux-policy/interface-definitions/runtest.sh deleted file mode 100755 index 29c0826..0000000 --- a/selinux-policy/interface-definitions/runtest.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm selinux-policy - rlAssertRpm policycoreutils - rlPhaseEnd - - if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then - # the bug is fixed on RHEL-8 but it was auto-closed on RHEL-9 - rlPhaseStartTest "RHEL-2616 + RHEL-16185" - rlRun "sepolgen-ifgen -v -d 2>/dev/null | sort | uniq > output.txt" - rlRun "grep -i missing output.txt" 1 - rlPhaseEnd - fi - - rlPhaseStartTest "bz#2254169 + bz#2254206 + bz#2277925" - rlRun "yum -y reinstall selinux-policy-devel >& output.txt" - rlRun "grep -i illegal output.txt" 1 - rlRun "sepolgen-ifgen --verbose >& output.txt" - rlRun "grep -i illegal output.txt" 1 - rlPhaseEnd - - rlPhaseStartCleanup - rm -f output.txt - rlPhaseEnd -rlJournalEnd - diff --git a/selinux-policy/journalctl-and-similar/Makefile b/selinux-policy/journalctl-and-similar/Makefile deleted file mode 100644 index bbc6bec..0000000 --- a/selinux-policy/journalctl-and-similar/Makefile +++ /dev/null @@ -1,88 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/journalctl-and-similar -# Description: SELinux interferes with journalctl executed by various users -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/journalctl-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh ssh.exp - chcon -t bin_t runtest.sh ssh.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with journalctl executed by various users" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients systemd shadow-utils" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 1176713" >> $(METADATA) # Fedora 21 - @echo "Bug: 1288255" >> $(METADATA) # RHEL-7 - @echo "Bug: 1685689" >> $(METADATA) # RHEL-8 - @echo "Bug: 1825894" >> $(METADATA) # RHEL-8 - @echo "Bug: 2017838" >> $(METADATA) # RHEL-9 - @echo "Bug: 2075527" >> $(METADATA) # Fedora 37 - @echo "Bug: 2124427" >> $(METADATA) # Fedora 37 - @echo "Bug: 2125762" >> $(METADATA) # Fedora 37 - @echo "Bug: 2136189" >> $(METADATA) # RHEL-8 - @echo "Bug: 2137323" >> $(METADATA) # Fedora 37 - @echo "Bug: 2139623" >> $(METADATA) # Fedora 37 - @echo "Bug: 2143157" >> $(METADATA) # Fedora 37 - @echo "Bug: 2143746" >> $(METADATA) # Fedora 37 - @echo "Bug: 2144150" >> $(METADATA) # Fedora 37 - @echo "Bug: 2149093" >> $(METADATA) # Fedora 37 - @echo "Bug: 2149346" >> $(METADATA) # Fedora 37 - @echo "Bug: 2152544" >> $(METADATA) # Fedora 37 - @echo "Bug: 2152588" >> $(METADATA) # Fedora 37 - @echo "Bug: 2152823" >> $(METADATA) # RHEL-9 - @echo "Bug: 2153782" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/journalctl-and-similar/PURPOSE b/selinux-policy/journalctl-and-similar/PURPOSE deleted file mode 100644 index 806f597..0000000 --- a/selinux-policy/journalctl-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/journalctl-and-similar -Author: Milos Malik - -SELinux interferes with journalctl executed by various users. - diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf deleted file mode 100644 index 0205049..0000000 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ /dev/null @@ -1,65 +0,0 @@ -summary: SELinux interferes with journalctl executed by various users -description: |+ - SELinux interferes with journalctl executed by various users. - -contact: Milos Malik -component: - - selinux-policy - - systemd -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - expect - - openssh-clients - - systemd - - shadow-utils -environment: - AVC_ERROR: +no_avc_check - ALLOWED_USERS: staff_u user_u sysadm_u unconfined_u - DENIED_USERS: guest_u xguest_u -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1176713 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1288255 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1685689 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825894 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2017838 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2075527 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2124427 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2125762 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2136189 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2137323 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2139623 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143157 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143746 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2144150 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149093 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149346 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152544 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152588 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152823 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2153782 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0597884 -extra-summary: /CoreOS/selinux-policy/Regression/journalctl-and-similar -extra-task: /CoreOS/selinux-policy/Regression/journalctl-and-similar -id: f56e6a4a-9f30-47ad-bf6c-cc6a388d82d9 diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh deleted file mode 100755 index 87426c5..0000000 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ /dev/null @@ -1,156 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/journalctl-and-similar -# Description: SELinux interferes with journalctl executed by various users -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/bin/journalctl" -FILE_CONTEXT="journalctl_exec_t" -SERVICE_PACKAGE="systemd" -PROCESS_NAME="journalctl" -PROCESS_CONTEXT="journalctl_t" -ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} -DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlSEConfigureSSH - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1176713" - rlSEMatchPathCon "/usr/bin/journalctl" "journalctl_exec_t" - rlSEMatchPathCon "/dev/urandom" "urandom_device_t" - rlSESearchRule "allow journalctl_t urandom_device_t : chr_file { getattr open read } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1288255" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlSEDefined "staff_t" ; then - rlSESearchRule "allow staff_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" - rlSESearchRule "allow staff_t ${PROCESS_CONTEXT} : process { transition } [ ]" - rlSESearchRule "type_transition staff_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" - fi - if rlSEDefined "sysadm_t" ; then - rlSESearchRule "allow sysadm_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" - rlSESearchRule "allow sysadm_t ${PROCESS_CONTEXT} : process { transition } [ ]" - rlSESearchRule "type_transition sysadm_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" - fi - if rlSEDefined "user_t" ; then - rlSESearchRule "allow user_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" - rlSESearchRule "allow user_t ${PROCESS_CONTEXT} : process { transition } [ ]" - rlSESearchRule "type_transition user_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" - fi - rlPhaseEnd - - rlPhaseStartTest "bz#1685689" - rlSEMatchPathCon "/usr/bin/journalctl" "journalctl_exec_t" - rlSEMatchPathCon "/run/log/journal/bfd37efc55db4f44a0f350821db2b810/system.journal" "syslogd_var_run_t" - if rlIsRHEL 7 ; then - # the domain_can_mmap_files boolean is enabled by default - rlSESearchRule "allow journalctl_t syslogd_var_run_t : file { map }" - else - # the domain_can_mmap_files boolean is disabled by default - rlSESearchRule "allow journalctl_t syslogd_var_run_t : file { map } [ ]" - fi - rlPhaseEnd - - rlPhaseStartTest "bz#1825894" - rlSEMatchPathCon "/usr/bin/journalctl" "journalctl_exec_t" - rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]" - rlPhaseEnd - - if ! rlIsFedora && rlSEDefined "user_t" ; then - rlPhaseStartTest "bz#2017838" - rlSEMatchPathCon "/run/log/journal/somehash/system.journal" "syslogd_var_run_t" - rlSEMatchPathCon "/var/lib/systemd/catalog/database" "init_var_lib_t" - rlSESearchRule "allow user_t init_var_lib_t : file { open read map } [ ]" - rlSESearchRule "allow user_t syslogd_var_run_t : file { open read map } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 7 8 && ! rlIsCentOS 7 8 ; then - rlPhaseStartTest "bz#2075527 + bz#2152823" - rlSESearchRule "allow syslogd_t syslogd_var_run_t : file { relabelfrom relabelto } [ ]" - rlRun "journalctl --rotate" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- confined users" - rlRun "setsebool ssh_sysadm_login on" - rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "usermod -G systemd-journal ${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --user" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --system" - USER_ID=`id -u ${USER_NAME}` - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl status user@${USER_ID}" - rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 - done - rlRun "setsebool ssh_sysadm_login off" - rlPhaseEnd - - if ! ( IrIsRHEL 8 && rlIsRHEL "<8.8" ) && ! ( rlIsRHEL 9 && rlIsRHEL "<9.3" ); then - rlPhaseStartTest "bz#2136189 + bz#2153782" - rlSESearchRule "allow journalctl_t journalctl_t : capability { sys_resource } [ ]" - rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]" - - rlRun "setsebool ssh_sysadm_login on" - USER_NAME="toor" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -o -u 0 -g 0 -Z sysadm_u ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -l --no-pager" - rlRun "userdel -rfZ ${USER_NAME}" - rlRun "setsebool ssh_sysadm_login off" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC --ignore 'type=AVC .* create .*systemd.* scontext=.*:user_t:.* tcontext=.*:user_tmp_t:.* tclass=dir' - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/journalctl-and-similar/ssh.exp b/selinux-policy/journalctl-and-similar/ssh.exp deleted file mode 100755 index 58c9647..0000000 --- a/selinux-policy/journalctl-and-similar/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname $command -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/kerberos-and-similar/main.fmf b/selinux-policy/kerberos-and-similar/main.fmf index a06bb2f..f55e70a 100644 --- a/selinux-policy/kerberos-and-similar/main.fmf +++ b/selinux-policy/kerberos-and-similar/main.fmf @@ -1,63 +1,5 @@ -summary: SELinux interferes with kerberos programs -description: |+ - SELinux interferes with various kerberos daemons and related programs. - -contact: Milos Malik -component: - - selinux-policy - - krb5 -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - selinux-policy - - selinux-policy-targeted - - setools-console - - libselinux - - libselinux-utils - - policycoreutils - - krb5-server - - krb5-libs -environment: - AVC_ERROR: +no_avc_check -duration: 30m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - TipWaived6 - - TipWaived7 - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=698923 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=713218 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=860666 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=910837 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1041629 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1065460 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1153561 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1210421 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1220691 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1220763 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1319933 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1337895 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1368492 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1452215 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600705 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1601004 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1619252 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1664983 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1669975 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0230498 -extra-summary: /CoreOS/selinux-policy/Regression/kerberos-and-similar -extra-task: /CoreOS/selinux-policy/Regression/kerberos-and-similar -id: 74c9284d-5001-4270-838b-8af50422631c +path: /selinux-policy/kerberos-and-similar +summary: SELinux interferes with various kerberos daemons and related programs. +description: | + Test coverage for SELinux AVC issues against kerberos daemon and related + programs. diff --git a/selinux-policy/kerberos-and-similar/runtest.sh b/selinux-policy/kerberos-and-similar/runtest.sh index e306888..79acf20 100755 --- a/selinux-policy/kerberos-and-similar/runtest.sh +++ b/selinux-policy/kerberos-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -34,11 +35,12 @@ ROOT_PASSWORD="redhat" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -qa | grep krb | sort" + rlAssertRpm krb5-libs + rlAssertRpm krb5-server rlServiceStop kprop kadmin rlFileBackup /etc/shadow @@ -65,6 +67,10 @@ rlJournalStart rlPhaseStartTest "bz#860666" rlSEMatchPathCon "/usr/sbin/krb5kdc" "krb5kdc_exec_t" rlSEMatchPathCon "/usr/sbin/kadmind" "kadmind_exec_t" + rlSESearchRule "allow krb5kdc_t anon_inodefs_t : file { getattr read write }" + rlSESearchRule "allow krb5kdc_t anon_inodefs_t : dir { getattr search }" + rlSESearchRule "allow kadmind_t anon_inodefs_t : file { getattr read write }" + rlSESearchRule "allow kadmind_t anon_inodefs_t : dir { getattr search }" rlPhaseEnd if ! rlIsRHEL 5 6 ; then @@ -196,18 +202,13 @@ rlJournalStart rlPhaseEnd fi - if [ -f /usr/lib/systemd/system/kprop.service ] ; then rlPhaseStartTest "real scenario for kpropd" - rlRun "mkdir -p /var/kerberos/krb5kdc" rlRun "touch /var/kerberos/krb5kdc/kpropd.acl" rlRun "rm -f /etc/krb5.conf" rlRun "cp ./krb5.conf /etc" rlRun "restorecon -v /etc/krb5.conf" - rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "start status restart status stop status" 1 rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf deleted file mode 100644 index 3d1594f..0000000 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ /dev/null @@ -1,41 +0,0 @@ -summary: Test that kernel cannot execute arbitrary helper binaries -description: | - Ensures that the kernel is not allowed to execute unauthorized binaries - and that a transition to a confined domain is enforced on those that it - can execute, so that overwriting usermode helper paths doesn't lead to - an exploitable privilege escalation. -contact: Ondrej Mosnacek -component: - - selinux-policy -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy - - policycoreutils - - gcc -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail -duration: 20m -tier: 2 -enabled: true -adjust+: - - enabled: false - when: distro < fedora-38 - because: This hardening applies only to F38+ - - enabled: false - when: distro < centos-stream-10 - because: Not yet backported to CentOS - - enabled: false - when: distro < rhel-10 - because: Not yet backported to RHEL -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068579 -extra-nitrate: TC#0614676 -id: 4400999a-aa60-4522-b0f7-d7b0656110a3 -tag: - - NoRHIVOS - - avoidImageMode diff --git a/selinux-policy/kernel-confined-exec/runtest.sh b/selinux-policy/kernel-confined-exec/runtest.sh deleted file mode 100755 index 274e0a0..0000000 --- a/selinux-policy/kernel-confined-exec/runtest.sh +++ /dev/null @@ -1,147 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# SPDX-License-Identifier: GPLv2 -# Copyright (c) 2022 Red Hat, Inc. -# Author: Ondrej Mosnacek - -# Include Beakerlib environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -function trigger_modprobe() { - # ensure gre modules are unloaded - modprobe -r ip_gre gre || return 2 - ip link add mygre type gretap local 127.0.0.1 remote 127.0.0.1 - ret=$? - ip link del mygre 2>/dev/null - if [ $ret -eq 0 ]; then - return 0 - else - return 1 - fi -} - -rlJournalStart - rlPhaseStartSetup - rlImport 'selinux-policy/common' 0,1 - - rlAssertRpm selinux-policy - rlAssertRpm selinux-policy-targeted - - rlSESetEnforce - rlSEStatus - - original_modprobe="$(sysctl -nb kernel.modprobe)" - original_core_pattern="$(sysctl -nb kernel.core_pattern)" - - rlRun "gcc -o trigger_segfault trigger_segfault.c" - rlPhaseEnd - - rlPhaseStartTest "Policy rules" - rlLog "kernel_t shouldn't be allowed to execute any file without transition" - - # Only check execute_no_trans and a couple of unexpected type - # transitions. Plain 'execute' has to be allowed broadly due to - # overlayfs mounter checks. (Think overlayfs mounted before policy - # is loaded.) - rlSESearchRule "allow kernel_t file_type:file { execute_no_trans } []" 1 \ - "kernel_t shouldn't be allowed to execute any file without transition" - rlSESearchRule "type_transition kernel_t user_home_t:process domain;" 1 \ - "kernel_t shouldn't have any transition defined over files in user home directories" - rlSESearchRule "type_transition kernel_t user_tmp_t:process domain;" 1 \ - "kernel_t shouldn't have any transition defined over user temporary files" - rlPhaseEnd - - rlPhaseStartTest "Legit modprobe" - rlLog "Should work with no AVCs" - - rlSESetTimestamp - sleep 1 - rlRun "trigger_modprobe" - sleep 1 - rlSECheckAVC - rlPhaseEnd - - rlPhaseStartTest "Modprobe set to /usr/bin/true" - rlLog "Should fail but cause no AVCs" - - rlRun "sysctl kernel.modprobe=/usr/bin/true" 0 \ - "Set kernel.modprobe to /usr/bin/true" - rlSESetTimestamp - sleep 1 - rlRun "trigger_modprobe" 1 - sleep 1 - rlSECheckAVC - rlRun "sysctl kernel.modprobe=\"\$original_modprobe\"" 0 \ - "Reset kernel.modprobe to default" - rlPhaseEnd - - rlPhaseStartTest "Modprobe set to /usr/sbin/load_policy" - rlLog "Should fail with AVCs denying the execution" - - rlRun "sysctl kernel.modprobe=/usr/sbin/load_policy" 0 \ - "Set kernel.modprobe to /usr/sbin/load_policy" - rlSESetTimestamp - sleep 1 - rlRun "trigger_modprobe" 1 - sleep 1 - rlRun "rlSEAVCCheck" 1 - rlRun "sysctl kernel.modprobe=\"\$original_modprobe\"" 0 \ - "Reset kernel.modprobe to default" - rlPhaseEnd - - rlPhaseStartTest "Modprobe relabeled to bin_t" - rlLog "Should fail with AVCs denying operation after transition" - rlRun "chcon -t bin_t \"\$(readlink -f \"\$original_modprobe\")\"" 0 \ - "Set kernel.modprobe to /usr/sbin/load_policy" - rlSESetTimestamp - sleep 1 - rlRun "trigger_modprobe" 1 - sleep 1 - rlRun "rlSEAVCCheck" 1 - rlRun "restorecon \"\$(readlink -f \"\$original_modprobe\")\"" 0 \ - "Reset kernel.modprobe to default" - rlPhaseEnd - - rlPhaseStartTest "Legit coredump helper" - rlLog "Should work with no AVCs" - - rlSESetTimestamp - sleep 1 - rlRun "./trigger_segfault" 139 - sleep 2 - rlSECheckAVC - rlPhaseEnd - - rlPhaseStartTest "Core pattern set to |/usr/sbin/load_policy" - rlLog "Should fail with AVCs denying the execution" - - rlRun "sysctl kernel.core_pattern='|/usr/sbin/load_policy'" 0 \ - "Set kernel.core_pattern to |/usr/sbin/load_policy" - rlSESetTimestamp - sleep 1 - rlRun "./trigger_segfault" 139 - sleep 1 - rlRun "rlSEAVCCheck" 1 - rlRun "sysctl kernel.core_pattern=\"\$original_core_pattern\"" 0 \ - "Reset kernel.core_pattern to default" - rlPhaseEnd - - rlPhaseStartTest "Core pattern set to |/usr/bin/false" - rlLog "Should work with no AVCs" - - rlRun "sysctl kernel.core_pattern='|/usr/bin/false'" 0 \ - "Set kernel.core_pattern to |/usr/bin/false" - rlSESetTimestamp - sleep 1 - rlRun "./trigger_segfault" 139 - sleep 2 - rlSECheckAVC - rlRun "sysctl kernel.core_pattern=\"\$original_core_pattern\"" 0 \ - "Reset kernel.core_pattern to default" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f trigger_segfault" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/selinux-policy/kernel-confined-exec/trigger_segfault.c b/selinux-policy/kernel-confined-exec/trigger_segfault.c deleted file mode 100644 index 0ee0ab4..0000000 --- a/selinux-policy/kernel-confined-exec/trigger_segfault.c +++ /dev/null @@ -1,6 +0,0 @@ -#include - -int main(void) -{ - return *(int *)NULL; -} diff --git a/selinux-policy/ksm-and-similar/Makefile b/selinux-policy/ksm-and-similar/Makefile deleted file mode 100644 index 9a107c7..0000000 --- a/selinux-policy/ksm-and-similar/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/ksm-and-similar -# Description: SELinux interferes with ksm and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/ksm-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with ksm and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/libexec/ksmctl /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2021131" >> $(METADATA) # RHEL-9 - @echo "Bug: 2091416" >> $(METADATA) # Fedora 36 - @echo "Bug: 2091417" >> $(METADATA) # Fedora 36 - @echo "Bug: 2091418" >> $(METADATA) # Fedora 36 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/ksm-and-similar/PURPOSE b/selinux-policy/ksm-and-similar/PURPOSE deleted file mode 100644 index 1f11e4b..0000000 --- a/selinux-policy/ksm-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/ksm-and-similar -Author: Milos Malik - -SELinux interferes with the ksm service (the ksmctl program) and related programs. - diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf deleted file mode 100644 index 03a19db..0000000 --- a/selinux-policy/ksm-and-similar/main.fmf +++ /dev/null @@ -1,46 +0,0 @@ -summary: SELinux interferes with ksm and related programs -description: |+ - SELinux interferes with the ksm service (the ksmctl program) and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/libexec/ksmctl - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -tier: 2 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2021131 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091416 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091417 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091418 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0613684 -extra-summary: /CoreOS/selinux-policy/Regression/ksm-and-similar -extra-task: /CoreOS/selinux-policy/Regression/ksm-and-similar -id: 712ce354-8733-4938-bfba-3801432e5278 diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh deleted file mode 100755 index b4533f0..0000000 --- a/selinux-policy/ksm-and-similar/runtest.sh +++ /dev/null @@ -1,106 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/ksm-and-similar -# Description: SELinux interferes with ksm and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/libexec/ksmctl" -FILE_CONTEXT="ksm_exec_t" -SERVICE_NAME="ksm" -PROCESS_NAME="ksmctl" -PROCESS_CONTEXT="ksm_t" - -rlJournalStart - if rlIsRHEL 7 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -qf ${FILE_PATH}" - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/systemd/system/ksm.service - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined ${PROCESS_CONTEXT} ; then - rlPhaseStartTest "bz#2021131" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/sys/kernel/mm/ksm" "sysfs_t" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow ${PROCESS_CONTEXT} sysfs_t : dir { write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2091416 + bz#2091417 + bz#2091418" - rlSEMatchPathCon "/usr/libexec/ksmctl" "ksm_exec_t" - rlSEMatchPathCon "/sys/kernel/mm/ksm" "sysfs_t" - rlSEMatchPathCon "/sys/kernel/mm/ksm/run" "sysfs_t" - rlSESearchRule "allow ksm_t sysfs_t : dir { write add_name } [ ]" - rlSESearchRule "allow ksm_t sysfs_t : file { create } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/ksm.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - PROCESS_CONTEXT="unconfined_service_t" - fi - rlRun "cp -f /usr/lib/systemd/system/ksm.service /etc/systemd/system/" - rlRun "sed -i 's/^ConditionVirtualization=.*$//' /etc/systemd/system/ksm.service" - rlRun "systemctl daemon-reload" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlRun "systemctl daemon-reload" - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/ladvd/Makefile b/selinux-policy/ladvd/Makefile index 45928c4..8572b36 100644 --- a/selinux-policy/ladvd/Makefile +++ b/selinux-policy/ladvd/Makefile @@ -6,7 +6,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. # # This copyrighted material is made available to anyone wishing # to use, modify, copy, or redistribute it subject to the terms diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index 4bba87f..4e8b1a5 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -1,41 +1,8 @@ -summary: Tests for ladvd service -description: |+ - Test coverage for SELinux AVC issues related to ladvd service. - -contact: Amith Kumar -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - initscripts - - kernel-headers - - ladvd - - ladvd-selinux - - libpcap - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 1h -tag: - - failinfedora - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834325 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1855163 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 - because: the ladvd package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/ladvd -extra-task: /CoreOS/selinux-policy/Regression/ladvd -extra-nitrate: TC#0614606 -id: db945166-3e6e-41cc-a76d-9e4f6e4b641c +path: /selinux-policy/ladvd +summary: Test ladvd utility to verify AVC denials +description: | + Test coverage for SELinux AVC issues related ladvd service. This + test suite primarily verifies two bugs ie bz1834325 and bz1855163. +adjust: +- enabled: false + when: distro <= rhel-8 diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh index 4af6367..b0080a9 100755 --- a/selinux-policy/ladvd/runtest.sh +++ b/selinux-policy/ladvd/runtest.sh @@ -8,7 +8,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. # # This copyrighted material is made available to anyone wishing # to use, modify, copy, or redistribute it subject to the terms @@ -27,26 +27,19 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" rlJournalStart - if rlIsRHEL ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ladvd rlAssertRpm ladvd-selinux - - rlSESetTimestamp - rlRun "setsebool domain_kernel_load_modules on" rlServiceStop ladvd rlSESetEnforce rlSEStatus @@ -55,7 +48,7 @@ rlJournalStart rlPhaseStartTest "ladvd service selinux denials, bz#1834325" rlServiceStart ladvd sleep 2 - rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 0,1 + rlRun "ausearch -m AVC -c ladvd --raw > /tmp/avcfile" 1 if grep "tclass=process2" /tmp/avcfile; then grep "tclass=process2" /tmp/avcfile > /tmp/avc_class_file rlAssertNotGrep "denied { nnp_transition }" /tmp/avc_class_file @@ -77,7 +70,7 @@ rlJournalStart rlPhaseStartTest "ladvd selinux denials due to libpcap, bz#1855163" rlServiceStart ladvd sleep 2 - rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 0,1 + rlRun "ausearch -m AVC -c 'ladvd' --raw > /tmp/avcfile" 1 if grep "tclass=netlink_rdma_socket" /tmp/avcfile; then grep "tclass=netlink_rdma_socket" /tmp/avcfile > /tmp/avc_class_file rlAssertNotGrep "denied { create }" /tmp/avc_class_file @@ -91,8 +84,6 @@ rlJournalStart rlPhaseEnd rlPhaseStartCleanup - rlSECheckAVC - rlRun "setsebool domain_kernel_load_modules off" rlServiceRestore ladvd rlRun "rm -f /tmp/avcfile" rlRun "rm -f /tmp/avc_class_file" diff --git a/selinux-policy/libvirt-dbus-and-similar/Makefile b/selinux-policy/libvirt-dbus-and-similar/Makefile deleted file mode 100644 index 127fc47..0000000 --- a/selinux-policy/libvirt-dbus-and-similar/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar -# Description: SELinux interferes with libvirt-dbus and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with libvirt-dbus and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: libvirt-dbus" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console libvirt-dbus /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: RHEL-46893" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-73914" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/libvirt-dbus-and-similar/PURPOSE b/selinux-policy/libvirt-dbus-and-similar/PURPOSE deleted file mode 100644 index 94dfc9b..0000000 --- a/selinux-policy/libvirt-dbus-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar -Author: Milos Malik - -SELinux interferes with libvirt-dbus and related programs. - diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf deleted file mode 100644 index 0b16766..0000000 --- a/selinux-policy/libvirt-dbus-and-similar/main.fmf +++ /dev/null @@ -1,44 +0,0 @@ -summary: SELinux interferes with libvirt-dbus and related programs -description: |+ - SELinux interferes with libvirt-dbus and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - libvirt-dbus - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS - - avoidImageMode -link: - - verifies: https://issues.redhat.com/browse/RHEL-46893 - - verifies: https://issues.redhat.com/browse/RHEL-73914 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the libvirt-dbus package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar -extra-task: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar -extra-nitrate: TC#0617675 -id: 051fa33d-fa04-4ccc-b4e3-91078ec2199f diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh deleted file mode 100755 index e0d9a7d..0000000 --- a/selinux-policy/libvirt-dbus-and-similar/runtest.sh +++ /dev/null @@ -1,140 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar -# Description: SELinux interferes with libvirt-dbus and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/sbin/libvirt-dbus" -SERVICE_PACKAGE="libvirt-dbus" -SERVICE_NAME="libvirt-dbus" -PROCESS_NAME="libvirt-dbus" - -if seinfo -t | grep -q virt_dbus ; then - FILE_CONTEXT="virt_dbus_exec_t" - PROCESS_CONTEXT="virt_dbus_t" -else - FILE_CONTEXT="bin_t" - PROCESS_CONTEXT="unconfined_service_t" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlRun "yum -y install libvirt\* --skip-broken -x \*i686\* -x glibc32" 0,1 - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if seinfo -t | grep -q virt_dbus ; then - rlPhaseStartTest "RHEL-46893" - rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} - rlSESearchRule "allow virt_dbus_t virtqemud_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow virtqemud_t virt_dbus_t : dir { search } [ ]" - rlSESearchRule "allow virtqemud_t virt_dbus_t : file { getattr open read } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-73914" - rlSESearchRule "allow staff_t virt_dbus_t : dbus { send_msg } [ ]" - rlSESearchRule "allow virt_dbus_t staff_t : dbus { send_msg } [ ]" - rlSESearchRule "allow sysadm_t virt_dbus_t : dbus { send_msg } [ ]" - rlSESearchRule "allow virt_dbus_t sysadm_t : dbus { send_msg } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- confined users" - if [ -f /usr/lib/systemd/system/virtqemud.service ] ; then - rlRun "service virtqemud start" - fi - rlSEConfigureSSH - rlRun "setsebool ssh_sysadm_login on" - for SELINUX_USER in staff_u sysadm_u ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} -G libvirt ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost busctl call org.libvirt /org/libvirt/QEMU org.libvirt.Connect ListDomains u 0" - rlRun "userdel -rfZ ${USER_NAME}" - done - rlRun "setsebool ssh_sysadm_login off" - if [ -f /usr/lib/systemd/system/virtqemud.service ] ; then - rlRun "service virtqemud stop" - fi - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- communication with other virt* services" - for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do - if [ -f /usr/lib/systemd/system/${VIRT_SERVICE}.service ] ; then - rlRun "service ${VIRT_SERVICE} start" - fi - done - - AVAIL_DAEMONS="QEMU" - if [ -f /usr/lib/systemd/system/virtlxcd.service ] ; then - AVAIL_DAEMONS="LXC QEMU" - fi - - for DAEMON in ${AVAIL_DAEMONS} ; do - for METHOD in ListDomains ListInterfaces ListNWFilters ListNetworks ListNodeDevices ListSecrets ListStoragePools ; do - rlRun "busctl call org.libvirt /org/libvirt/${DAEMON} org.libvirt.Connect ${METHOD} u 0" 0,1 - done - done - - for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do - if [ -f /usr/lib/systemd/system/${VIRT_SERVICE}.service ] ; then - rlRun "service ${VIRT_SERVICE} stop" - fi - done - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/libvirt-dbus-and-similar/ssh.exp b/selinux-policy/libvirt-dbus-and-similar/ssh.exp deleted file mode 100755 index 58c9647..0000000 --- a/selinux-policy/libvirt-dbus-and-similar/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname $command -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/logwatch-and-similar/Makefile b/selinux-policy/logwatch-and-similar/Makefile deleted file mode 100644 index 3292741..0000000 --- a/selinux-policy/logwatch-and-similar/Makefile +++ /dev/null @@ -1,72 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/logwatch-and-similar -# Description: SELinux interferes with logwatch and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/logwatch-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with logwatch and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console logwatch sendmail /usr/sbin/service iproute" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 2183432" >> $(METADATA) # Fedora 38 - @echo "Bug: 2270484" >> $(METADATA) # Fedora 40 - @echo "Bug: RHEL-34135" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-160896" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-160897" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/logwatch-and-similar/PURPOSE b/selinux-policy/logwatch-and-similar/PURPOSE deleted file mode 100644 index 6820548..0000000 --- a/selinux-policy/logwatch-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/logwatch-and-similar -Author: Milos Malik - -Description: SELinux interferes with logwatch and related programs - diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf deleted file mode 100644 index e2ba6c5..0000000 --- a/selinux-policy/logwatch-and-similar/main.fmf +++ /dev/null @@ -1,50 +0,0 @@ -summary: SELinux interferes with logwatch and related programs -description: |+ - SELinux interferes with logwatch and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - logwatch - - sendmail - - /usr/sbin/service - - iproute -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - NoRHIVOS -tier: 3 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2183432 - - verifies: https://issues.redhat.com/browse/RHEL-34135 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270484 - - verifies: https://issues.redhat.com/browse/RHEL-160896 - - verifies: https://issues.redhat.com/browse/RHEL-160897 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - because: the logwatch service is not available there -extra-summary: /CoreOS/selinux-policy/Regression/logwatch-and-similar -extra-task: /CoreOS/selinux-policy/Regression/logwatch-and-similar -extra-nitrate: TC#0617270 -id: 047f2fac-7362-412d-8f6a-95cb8af71230 diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh deleted file mode 100755 index 2c06f96..0000000 --- a/selinux-policy/logwatch-and-similar/runtest.sh +++ /dev/null @@ -1,127 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/logwatch-and-similar -# Description: SELinux interferes with logwatch and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_CONTEXT="logwatch_exec_t" -SERVICE_PACKAGE="logwatch" -SERVICE_NAME="logwatch" -PROCESS_NAME="logwatch" -PROCESS_CONTEXT="logwatch_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/systemd/system/logwatch.timer - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL "<9.5" ; then - rlPhaseStartTest "bz#2183432 + RHEL-34135" - rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" - rlSESearchRule "allow logwatch_mail_t sysctl_net_t : dir { search } [ ]" - rlSESearchRule "allow logwatch_mail_t sysctl_net_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then - rlPhaseStartTest "bz#2270484" - rlSEMatchPathCon "/usr/share/logwatch/scripts/logwatch.pl" "logwatch_exec_t" - rlSEMatchPathCon "/usr/sbin/sendmail.sendmail" "sendmail_exec_t" - rlSEMatchPathCon "/run/systemd/sessions/" "systemd_logind_sessions_t" - rlSESearchRule "allow logwatch_t systemd_logind_sessions_t : dir { read } [ ]" - rlSESearchRule "type_transition logwatch_t sendmail_exec_t : process logwatch_mail_t" - if rlIsFedora ; then - rlSESearchRule "allow logwatch_mail_t init_t : unix_stream_socket { getattr } [ ]" - fi - rlPhaseEnd - fi - - if rlIsRHEL '>= 9.8' || rlIsRHEL '>= 10.2' ; then - rlPhaseStartTest "RHEL-160896 + RHEL-160897" - rlSESearchRule "allow logwatch_t nsfs_t : file { getattr } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "mkdir -p /var/cache/logwatch" - NS_NAME="test-ns-${RANDOM}" - rlRun "ip netns add ${NS_NAME}" - rlRun "ip netns list | grep ${NS_NAME}" - rlRun "ls -lZ /run/netns/ | grep :nsfs_t" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for environments where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 - rlRun "ip netns del ${NS_NAME}" - rlRun "ip netns list | grep ${NS_NAME}" 1 - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.timer ] ; then - rlPhaseStartTest "real scenario -- timer" - rlRun "systemctl enable ${SERVICE_NAME}.timer" - rlRun "systemctl start ${SERVICE_NAME}.timer" - rlRun "systemctl list-timers --all" - NEXT_TIME=`date -d "now + 1 minute" "+%H:%M"` - rlRun "cp -f /usr/lib/systemd/system/${SERVICE_NAME}.timer /etc/systemd/system/" - rlRun "sed -i 's/AccuracySec=.*$/AccuracySec=1s\nOnCalendar=*-*-* $NEXT_TIME/' /etc/systemd/system/${SERVICE_NAME}.timer" - rlRun "systemctl daemon-reload" - rlRun "systemctl list-timers --all" - rlRun "sleep 2m" - rlRun "systemctl stop ${SERVICE_NAME}.timer" - rlRun "systemctl disable ${SERVICE_NAME}.timer" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/m4-bad-data/PURPOSE b/selinux-policy/m4-bad-data/PURPOSE deleted file mode 100644 index ea14daa..0000000 --- a/selinux-policy/m4-bad-data/PURPOSE +++ /dev/null @@ -1,10 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Sanity/m4-bad-data -Author: Akhil Kohli - -Description: Negative bad-data tests for the M4 preprocessing stage of modular -SELinux policy builds (.if, .te, and .fc inputs before checkmodule). - -Execution is via FMF/TMT (main.fmf -> runtest.sh) using beakerlib rlRun -phases. Support macros prefer SELINUX_POLICY_SRC, else installed -selinux-policy-devel (/usr/share/selinux/devel/include/support), else a -git clone (Fedora falls back to rawhide when f$N is missing). diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc deleted file mode 100644 index 06aec43..0000000 --- a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc +++ /dev/null @@ -1 +0,0 @@ -/usr/bin/bad not_a_valid_selinux_context diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc deleted file mode 100644 index 13821d6..0000000 --- a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc +++ /dev/null @@ -1 +0,0 @@ -only_one_field_on_this_line diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc deleted file mode 100644 index 7f4dca9..0000000 --- a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc +++ /dev/null @@ -1 +0,0 @@ -divert(-1 diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc deleted file mode 100644 index 7c14f2e..0000000 --- a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc +++ /dev/null @@ -1 +0,0 @@ -/usr/bin/foo_only_path_no_context diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc deleted file mode 100644 index 7c122e4..0000000 --- a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc +++ /dev/null @@ -1 +0,0 @@ -/usr/bin/[unclosed(regex -- system_u:object_r:test_good_exec_t:s0 diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc deleted file mode 100644 index 12b26ca..0000000 --- a/selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc +++ /dev/null @@ -1 +0,0 @@ -/usr/bin/test_good -- system_u:object_r:test_good_exec_t:s0 diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if deleted file mode 100644 index 1e887a5..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if +++ /dev/null @@ -1,6 +0,0 @@ -interface(`dup_iface',` - type dup_t; -') -interface(`dup_iface',` - type dup2_t; -') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if deleted file mode 100644 index 536347f..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if +++ /dev/null @@ -1,3 +0,0 @@ -interface(``,` - type empty_name_t; -') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if deleted file mode 100644 index bbfd2f6..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if +++ /dev/null @@ -1,3 +0,0 @@ -interface(`bad_garbage',` - @@@not_valid_selinux_or_m4@@@ -') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if deleted file mode 100644 index 02c4e15..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if +++ /dev/null @@ -1,3 +0,0 @@ -interface(`bad_gen_if_build',` - gen_require(`type $1 -') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if deleted file mode 100644 index bbfa3a8..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if +++ /dev/null @@ -1,4 +0,0 @@ -interface(`bad_gen_require',` - gen_require(`type $1 class file { read };') - allow $1 self:file read; -') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if deleted file mode 100644 index 1d9bc85..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if +++ /dev/null @@ -1 +0,0 @@ -define(`broken_define' diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if deleted file mode 100644 index 0111414..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if +++ /dev/null @@ -1,3 +0,0 @@ -interface(`bad_module_line',` - module duplicate_module_line 1.0; -') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if deleted file mode 100644 index 8f5ed17..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if +++ /dev/null @@ -1,3 +0,0 @@ -interface(`bad_trunc',` - gen_require(`type $1; class file { read };') - allow $1 self:file { diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if deleted file mode 100644 index 7c377dd..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if +++ /dev/null @@ -1,3 +0,0 @@ -interface(`bad_unclosed',` - gen_require(`type $1;') - allow $1 self:file read; diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if deleted file mode 100644 index 94b83de..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if +++ /dev/null @@ -1,4 +0,0 @@ -interface(`bad_unknown_perm',` - gen_require(`type $1; class file { read };') - allow $1 self:file circular_ref; -') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if deleted file mode 100644 index 710f141..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if +++ /dev/null @@ -1,3 +0,0 @@ -interface(`bad_unknown_type',` - allow undeclared_type_t self:file read; -') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/good.if b/selinux-policy/m4-bad-data/fixtures/interfaces/good.if deleted file mode 100644 index bc5261d..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/good.if +++ /dev/null @@ -1,4 +0,0 @@ -interface(`test_good_iface',` - gen_require(`type $1; class file { read };') - allow $1 self:file read; -') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if b/selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if deleted file mode 100644 index 00b619e..0000000 --- a/selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if +++ /dev/null @@ -1,4 +0,0 @@ -interface(`needs_arg',` - gen_require(`type $1; class file { read };') - allow $1 self:file read; -') diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te b/selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te deleted file mode 100644 index c33368a..0000000 --- a/selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te +++ /dev/null @@ -1,8 +0,0 @@ -module te_bad_mod 1.0; - -require { - type foo_t; - class file { read }; -} - -bad_module_line() diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te b/selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te deleted file mode 100644 index 7ac9436..0000000 --- a/selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te +++ /dev/null @@ -1,8 +0,0 @@ -module te_few 1.0; - -require { - type foo_t; - class file { read }; -} - -needs_arg() diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te b/selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te deleted file mode 100644 index cb7daf4..0000000 --- a/selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te +++ /dev/null @@ -1,8 +0,0 @@ -module te_garbage 1.0; - -require { - type foo_t; - class file { read }; -} - -bad_garbage() diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te b/selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te deleted file mode 100644 index 8c84961..0000000 --- a/selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te +++ /dev/null @@ -1,8 +0,0 @@ -module te_gen_require 1.0; - -require { - type foo_t; - class file { read }; -} - -bad_gen_require(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_good.te b/selinux-policy/m4-bad-data/fixtures/modules/te_good.te deleted file mode 100644 index 753237a..0000000 --- a/selinux-policy/m4-bad-data/fixtures/modules/te_good.te +++ /dev/null @@ -1,8 +0,0 @@ -module te_good 1.0; - -require { - type foo_t; - class file { read }; -} - -test_good_iface(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te b/selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te deleted file mode 100644 index e481b8a..0000000 --- a/selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te +++ /dev/null @@ -1,8 +0,0 @@ -module te_many 1.0; - -require { - type foo_t; - class file { read }; -} - -needs_arg(foo_t, extra_unused) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te b/selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te deleted file mode 100644 index 4f56f72..0000000 --- a/selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te +++ /dev/null @@ -1,8 +0,0 @@ -module te_trunc 1.0; - -require { - type foo_t; - class file { read }; -} - -bad_trunc(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te deleted file mode 100644 index 03dd324..0000000 --- a/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te +++ /dev/null @@ -1,8 +0,0 @@ -module te_unknown_perm 1.0; - -require { - type foo_t; - class file { read }; -} - -bad_unknown_perm(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te deleted file mode 100644 index ea4724c..0000000 --- a/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te +++ /dev/null @@ -1,8 +0,0 @@ -module te_unknown_type 1.0; - -require { - type foo_t; - class file { read }; -} - -bad_unknown_type() diff --git a/selinux-policy/m4-bad-data/main.fmf b/selinux-policy/m4-bad-data/main.fmf deleted file mode 100644 index 7ecf218..0000000 --- a/selinux-policy/m4-bad-data/main.fmf +++ /dev/null @@ -1,18 +0,0 @@ -summary: M4 bad-data tests for modular policy preprocessing -contact: Akhil Kohli -test: ./runtest.sh -framework: beakerlib -component: - - selinux-policy - - checkpolicy -require: - - checkpolicy - - m4 - - git - - policycoreutils - - selinux-policy-devel -recommend: - - selinux-policy - - selinux-policy-targeted -duration: 15m -enabled: true diff --git a/selinux-policy/m4-bad-data/runtest.sh b/selinux-policy/m4-bad-data/runtest.sh deleted file mode 100755 index 8a3ee22..0000000 --- a/selinux-policy/m4-bad-data/runtest.sh +++ /dev/null @@ -1,379 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Sanity/m4-bad-data -# Description: M4 bad-data tests for modular policy preprocessing -# Author: Akhil Kohli -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -POLICY_GIT="${SELINUX_POLICY_GIT:-https://github.com/fedora-selinux/selinux-policy.git}" -POLICY_DIR="${SELINUX_POLICY_SRC:-}" - -BASEDIR="$(cd "$(dirname "$0")" && pwd)" -FIXTURES="${BASEDIR}/fixtures" - -M4=${M4:-m4} -CHECKMODULE=${CHECKMODULE:-checkmodule} -SEMODULE_PACKAGE=${SEMODULE_PACKAGE:-semodule_package} - -# Prefer explicit override; otherwise pick a clone branch for local/fallback use. -# Fedora Rawhide may report VERSION_ID=rawhide or a numeric ID ahead of any fN -# branch (e.g. 45 while only rawhide/f44 exist). Clone falls back to rawhide. -if [ -n "${SELINUX_POLICY_BRANCH:-}" ]; then - POLICY_BRANCH="${SELINUX_POLICY_BRANCH}" -else - test -e /etc/os-release && os_release='/etc/os-release' || os_release='/usr/lib/os-release' - # shellcheck disable=SC1090 - . "${os_release}" - if rlIsOSLike fedora; then - fedora_rel="" - if [[ "${VERSION_ID}" =~ ^[0-9]+$ ]]; then - fedora_rel="${VERSION_ID}" - elif [[ "${REDHAT_BUGZILLA_PRODUCT_VERSION:-}" =~ ^[0-9]+$ ]]; then - fedora_rel="${REDHAT_BUGZILLA_PRODUCT_VERSION}" - elif [[ "${REDHAT_SUPPORT_PRODUCT_VERSION:-}" =~ ^[0-9]+$ ]]; then - fedora_rel="${REDHAT_SUPPORT_PRODUCT_VERSION}" - fi - if [ -n "${fedora_rel}" ]; then - POLICY_BRANCH="f${fedora_rel}" - else - POLICY_BRANCH="rawhide" - fi - else - VERSION="${VERSION_ID%.*}" - POLICY_BRANCH="c${VERSION}s" - fi -fi - -DEVEL_SUPPORT="/usr/share/selinux/devel/include/support" - -# Configure M4SUPPORT/IFERROR from a selinux-policy git checkout layout. -setup_m4_from_git_tree() { - local root="$1" - M4SUPPORT="${root}/support/divert.m4 \ - ${root}/policy/support/misc_macros.spt \ - ${root}/policy/support/mls_mcs_macros.spt \ - ${root}/policy/support/loadable_module.spt \ - ${root}/policy/support/obj_perm_sets.spt \ - ${root}/support/undivert.m4" - IFERROR="${root}/support/iferror.m4" - POLICY_ROOT="${root}" -} - -# Configure M4SUPPORT from installed selinux-policy-devel (flat support/). -setup_m4_from_devel() { - local support="$1" - M4SUPPORT="${support}/divert.m4 \ - ${support}/misc_macros.spt \ - ${support}/mls_mcs_macros.spt \ - ${support}/loadable_module.spt \ - ${support}/obj_perm_sets.spt \ - ${support}/undivert.m4" - # iferror.m4 is build-tree only; recreate the upstream one-liner when absent. - if [ -f "${support}/iferror.m4" ]; then - IFERROR="${support}/iferror.m4" - else - IFERROR="${OUTDIR}/iferror.m4" - cat >"${IFERROR}" <<'EOF' -ifdef(`__if_error',`m4exit(1)') -EOF - fi - POLICY_ROOT="${support}" -} - -# Build all_interfaces.conf from one or more .if files (usual modular M4 recipe). -build_all_interfaces() { - local out="$1" - shift - - echo 'divert(-1)' >"${out}" - # shellcheck disable=SC2086 - ${M4} ${M4PARAM} ${M4SUPPORT} "$@" "${IFERROR}" >"${out}.tmp" 2>"${out}.err" - local rc=$? - sed -e 's/dollarsstar/$*/g' "${out}.tmp" >>"${out}" - echo 'divert' >>"${out}" - return "${rc}" -} - -# Expand a module .te with interfaces (usual modular M4 recipe; /dev/null for gen defs). -expand_module_te() { - local interfaces="$1" - local te="$2" - local out="$3" - - # shellcheck disable=SC2086 - ${M4} ${M4PARAM} -s ${M4SUPPORT} "${EMPTY_GEN_DEF}" "${interfaces}" "${te}" \ - >"${out}" 2>"${out}.err" - return $? -} - -# Expand file_contexts (usual modular M4 recipe for .fc -> .mod.fc). -expand_fc() { - local fc="$1" - local out="$2" - - # shellcheck disable=SC2086 - ${M4} ${M4PARAM} ${M4SUPPORT} "${fc}" >"${out}" 2>"${out}.err" - return $? -} - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm checkpolicy - rlRun "command -v m4" - rlRun "command -v checkmodule" - rlRun "command -v semodule_package" - - OUTDIR=$(mktemp -d "${TMPDIR:-/var/tmp}/selinux-policy-m4-bad-data.XXXXXX") - rlRun "test -d ${OUTDIR}" - CLONED_POLICY_DIR="" - - # Macro source priority (Petr): explicit checkout > installed devel > git clone. - if [ -n "${POLICY_DIR}" ]; then - rlAssertExists "${POLICY_DIR}/Rules.modular" - setup_m4_from_git_tree "${POLICY_DIR}" - rlLog "Using SELINUX_POLICY_SRC=${POLICY_DIR}" - elif [ -f "${DEVEL_SUPPORT}/loadable_module.spt" ]; then - rlAssertRpm selinux-policy-devel - setup_m4_from_devel "${DEVEL_SUPPORT}" - rlLog "Using selinux-policy-devel support macros from ${DEVEL_SUPPORT}" - else - CLONED_POLICY_DIR="$(mktemp -d /var/tmp/selinux-policy-src.XXXXXX)" - rlLog "Cloning ${POLICY_GIT} branch ${POLICY_BRANCH}" - if rlIsOSLike fedora && [ "${POLICY_BRANCH}" != "rawhide" ]; then - # fN may not exist yet on Rawhide (e.g. f45); allow failure then retry. - rlRun "git clone --depth=1 -b ${POLICY_BRANCH} ${POLICY_GIT} ${CLONED_POLICY_DIR}" 0-255 - if [ ! -f "${CLONED_POLICY_DIR}/Rules.modular" ]; then - rlLog "Branch ${POLICY_BRANCH} unavailable; falling back to rawhide" - rlRun "rm -rf ${CLONED_POLICY_DIR}" - CLONED_POLICY_DIR="$(mktemp -d /var/tmp/selinux-policy-src.XXXXXX)" - rlRun "git clone --depth=1 -b rawhide ${POLICY_GIT} ${CLONED_POLICY_DIR}" - fi - else - rlRun "git clone --depth=1 -b ${POLICY_BRANCH} ${POLICY_GIT} ${CLONED_POLICY_DIR}" - fi - rlAssertExists "${CLONED_POLICY_DIR}/Rules.modular" - setup_m4_from_git_tree "${CLONED_POLICY_DIR}" - fi - - # shellcheck disable=SC2086 - rlRun "test -f $(echo ${M4SUPPORT} | awk '{print $1}')" - rlRun "test -f ${IFERROR}" - - M4PARAM="-D enable_mcs -D distro_redhat -D hide_broken_symptoms -D mls_num_sens=16 -D mls_num_cats=1024 -D mcs_num_cats=1024" - EMPTY_GEN_DEF=/dev/null - - rlRun "ln -sf /nonexistent/test_good.if ${OUTDIR}/broken_symlink.if" - rlRun "ln -sf /nonexistent/test_good.mod.fc ${OUTDIR}/broken_symlink.fc" - rlRun "printf '' > ${OUTDIR}/empty.fc" - rlPhaseEnd - - # --- .if -> all_interfaces.conf --- - rlPhaseStartTest "unclosed interface definition" - rlRun "build_all_interfaces ${OUTDIR}/b1_unclosed.interfaces ${FIXTURES}/interfaces/bad_unclosed.if" 1-255 - rlPhaseEnd - - rlPhaseStartTest "broken M4 syntax in interface file" - rlRun "build_all_interfaces ${OUTDIR}/b1_m4_syntax.interfaces ${FIXTURES}/interfaces/bad_m4_syntax.if" 1-255 - rlPhaseEnd - - rlPhaseStartTest "duplicate interface definition" - rlRun "build_all_interfaces ${OUTDIR}/b1_duplicate.interfaces ${FIXTURES}/interfaces/bad_duplicate.if" 1-255 - rlPhaseEnd - - rlPhaseStartTest "broken gen_require block in interface file" - rlRun "build_all_interfaces ${OUTDIR}/b1_bad_gen_if.interfaces ${FIXTURES}/interfaces/bad_gen_if_build.if" 1-255 - rlPhaseEnd - - rlPhaseStartTest "empty interface template name" - rlRun "build_all_interfaces ${OUTDIR}/b1_empty_ifname.interfaces ${FIXTURES}/interfaces/bad_empty_ifname.if" 1-255 - rlPhaseEnd - - rlPhaseStartTest "missing .if path" - rlRun "build_all_interfaces ${OUTDIR}/b1_missing.interfaces ${OUTDIR}/does_not_exist.if" 1-255 - rlPhaseEnd - - rlPhaseStartTest "directory instead of .if file" - rlRun "build_all_interfaces ${OUTDIR}/b1_directory.interfaces ${BASEDIR}" 1-255 - rlPhaseEnd - - rlPhaseStartTest "broken symlink for .if" - rlRun "build_all_interfaces ${OUTDIR}/b1_symlink.interfaces ${OUTDIR}/broken_symlink.if" 1-255 - rlPhaseEnd - - rlPhaseStartTest "unreadable .if file" - if [ "$(id -u)" -eq 0 ]; then - rlLog "SKIP: root can read mode 000 files; unreadable check is non-root only" - else - rlRun "cp ${FIXTURES}/interfaces/good.if ${OUTDIR}/unreadable.if" - rlRun "chmod 000 ${OUTDIR}/unreadable.if" - rlRun "build_all_interfaces ${OUTDIR}/unreadable_if.interfaces ${OUTDIR}/unreadable.if" 1-255 - fi - rlPhaseEnd - - rlPhaseStartTest "control good interface" - rlRun "build_all_interfaces ${OUTDIR}/b1_good.interfaces ${FIXTURES}/interfaces/good.if" - rlRun "test -s ${OUTDIR}/b1_good.interfaces" - rlPhaseEnd - - GOOD_IF="${OUTDIR}/b1_good.interfaces" - - # --- .te + M4 with interfaces --- - rlPhaseStartTest "control good .if + .te through M4 and checkmodule" - rlRun "expand_module_te ${GOOD_IF} ${FIXTURES}/modules/te_good.te ${OUTDIR}/b2_good.tmp" - rlRun "test -s ${OUTDIR}/b2_good.tmp" - rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_good.mod ${OUTDIR}/b2_good.tmp" - rlRun "test -s ${OUTDIR}/te_good.mod" - rlPhaseEnd - - rlPhaseStartTest "missing .te path at M4 expand" - rlRun "expand_module_te ${GOOD_IF} ${OUTDIR}/does_not_exist.te ${OUTDIR}/b2_missing_te.tmp" 1-255 - rlPhaseEnd - - NEEDS_ARG_IF="${OUTDIR}/needs_arg.interfaces" - - rlPhaseStartTest "interface called with too few arguments" - rlRun "build_all_interfaces ${NEEDS_ARG_IF} ${FIXTURES}/interfaces/needs_arg.if" - rlRun "expand_module_te ${NEEDS_ARG_IF} ${FIXTURES}/modules/te_few_args.te ${OUTDIR}/b2_few_args.tmp" - rlRun "test -s ${OUTDIR}/b2_few_args.tmp" - rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_few.mod ${OUTDIR}/b2_few_args.tmp" 1-255 - rlPhaseEnd - - rlPhaseStartTest "interface called with too many arguments" - rlLog "DOCUMENT: extra interface args are ignored by M4" - rlRun "test -s ${NEEDS_ARG_IF}" - rlRun "expand_module_te ${NEEDS_ARG_IF} ${FIXTURES}/modules/te_many_args.te ${OUTDIR}/b2_many_args.tmp" - rlRun "test -s ${OUTDIR}/b2_many_args.tmp" - rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_many.mod ${OUTDIR}/b2_many_args.tmp" - rlRun "test -s ${OUTDIR}/te_many.mod" - rlPhaseEnd - - # --- M4 OK, bad expanded TE -> checkmodule fails --- - # bad_trunc.if is unclosed at the M4 interface stage (EOF in string), so it is - # rejected before module expand — same class of failure as other broken .if files. - rlPhaseStartTest "truncated allow from interface expansion" - rlRun "build_all_interfaces ${OUTDIR}/bad_trunc.interfaces ${FIXTURES}/interfaces/bad_trunc.if" 1-255 - rlPhaseEnd - - rlPhaseStartTest "broken gen_require expanded from interface" - rlRun "build_all_interfaces ${OUTDIR}/bad_gen_require.interfaces ${FIXTURES}/interfaces/bad_gen_require.if" - rlRun "expand_module_te ${OUTDIR}/bad_gen_require.interfaces ${FIXTURES}/modules/te_gen_require.te ${OUTDIR}/b5_gen_require.tmp" - rlRun "test -s ${OUTDIR}/b5_gen_require.tmp" - rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_gen_require.mod ${OUTDIR}/b5_gen_require.tmp" 1-255 - rlPhaseEnd - - rlPhaseStartTest "unknown type from interface expansion" - rlRun "build_all_interfaces ${OUTDIR}/bad_unknown_type.interfaces ${FIXTURES}/interfaces/bad_unknown_type.if" - rlRun "expand_module_te ${OUTDIR}/bad_unknown_type.interfaces ${FIXTURES}/modules/te_unknown_type.te ${OUTDIR}/b5_unknown_type.tmp" - rlRun "test -s ${OUTDIR}/b5_unknown_type.tmp" - rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_unknown_type.mod ${OUTDIR}/b5_unknown_type.tmp" 1-255 - rlPhaseEnd - - rlPhaseStartTest "unknown permission from interface expansion" - rlRun "build_all_interfaces ${OUTDIR}/bad_unknown_perm.interfaces ${FIXTURES}/interfaces/bad_unknown_perm.if" - rlRun "expand_module_te ${OUTDIR}/bad_unknown_perm.interfaces ${FIXTURES}/modules/te_unknown_perm.te ${OUTDIR}/b5_unknown_perm.tmp" - rlRun "test -s ${OUTDIR}/b5_unknown_perm.tmp" - rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_unknown_perm.mod ${OUTDIR}/b5_unknown_perm.tmp" 1-255 - rlPhaseEnd - - rlPhaseStartTest "garbage token from interface expansion" - rlRun "build_all_interfaces ${OUTDIR}/bad_garbage.interfaces ${FIXTURES}/interfaces/bad_garbage.if" - rlRun "expand_module_te ${OUTDIR}/bad_garbage.interfaces ${FIXTURES}/modules/te_garbage.te ${OUTDIR}/b5_garbage.tmp" - rlRun "test -s ${OUTDIR}/b5_garbage.tmp" - rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_garbage.mod ${OUTDIR}/b5_garbage.tmp" 1-255 - rlPhaseEnd - - rlPhaseStartTest "invalid module line from interface expansion" - rlRun "build_all_interfaces ${OUTDIR}/bad_module_line.interfaces ${FIXTURES}/interfaces/bad_module_line.if" - rlRun "expand_module_te ${OUTDIR}/bad_module_line.interfaces ${FIXTURES}/modules/te_bad_module_line.te ${OUTDIR}/b5_module_line.tmp" - rlRun "test -s ${OUTDIR}/b5_module_line.tmp" - rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_bad_mod.mod ${OUTDIR}/b5_module_line.tmp" 1-255 - rlPhaseEnd - - # --- .fc -> M4 -> .mod.fc --- - rlPhaseStartTest "control good .fc through M4" - rlRun "expand_fc ${FIXTURES}/file_contexts/good.fc ${OUTDIR}/b3_good.mod.fc" - rlRun "test -s ${OUTDIR}/b3_good.mod.fc" - rlPhaseEnd - - rlPhaseStartTest "invalid context survives M4" - rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" - rlRun "expand_fc ${FIXTURES}/file_contexts/bad_context.fc ${OUTDIR}/b3_bad_context.mod.fc" - rlRun "test -s ${OUTDIR}/b3_bad_context.mod.fc" - rlPhaseEnd - - rlPhaseStartTest "wrong field count in .fc" - rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" - rlRun "expand_fc ${FIXTURES}/file_contexts/bad_fields.fc ${OUTDIR}/b3_bad_fields.mod.fc" - rlRun "test -s ${OUTDIR}/b3_bad_fields.mod.fc" - rlPhaseEnd - - rlPhaseStartTest "empty .fc file" - rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" - rlRun "expand_fc ${OUTDIR}/empty.fc ${OUTDIR}/b3_empty_fc.mod.fc" - rlPhaseEnd - - rlPhaseStartTest "path-only line without context in .fc" - rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" - rlRun "expand_fc ${FIXTURES}/file_contexts/bad_no_context.fc ${OUTDIR}/b3_no_context.mod.fc" - rlRun "test -s ${OUTDIR}/b3_no_context.mod.fc" - rlPhaseEnd - - rlPhaseStartTest "invalid regex metacharacters in .fc path" - rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" - rlRun "expand_fc ${FIXTURES}/file_contexts/bad_regex.fc ${OUTDIR}/b3_bad_regex.mod.fc" - rlRun "test -s ${OUTDIR}/b3_bad_regex.mod.fc" - rlPhaseEnd - - rlPhaseStartTest "missing .fc path" - rlRun "expand_fc ${OUTDIR}/does_not_exist.fc ${OUTDIR}/b3_missing.mod.fc" 1-255 - rlPhaseEnd - - rlPhaseStartTest "directory instead of .fc file" - rlRun "expand_fc ${BASEDIR} ${OUTDIR}/b3_directory.mod.fc" 1-255 - rlPhaseEnd - - rlPhaseStartTest "broken symlink for .fc" - rlRun "expand_fc ${OUTDIR}/broken_symlink.fc ${OUTDIR}/b3_symlink.mod.fc" 1-255 - rlPhaseEnd - - rlPhaseStartTest "unreadable .fc file" - if [ "$(id -u)" -eq 0 ]; then - rlLog "SKIP: root can read mode 000 files; unreadable check is non-root only" - else - rlRun "cp ${FIXTURES}/file_contexts/good.fc ${OUTDIR}/unreadable.fc" - rlRun "chmod 000 ${OUTDIR}/unreadable.fc" - rlRun "expand_fc ${OUTDIR}/unreadable.fc ${OUTDIR}/unreadable_fc.mod.fc" 1-255 - fi - rlPhaseEnd - - rlPhaseStartTest "broken M4 syntax in .fc" - rlRun "expand_fc ${FIXTURES}/file_contexts/bad_m4_syntax.fc ${OUTDIR}/b3_bad_m4.mod.fc" 1-255 - rlPhaseEnd - - # --- M4-expanded .mod.fc through semodule_package (E2E; labeling deferred) --- - rlPhaseStartTest "bad M4-expanded .mod.fc packaged with good .mod" - rlLog "DOCUMENT: M4 to package E2E; labeling validation deferred to sefcontext_compile" - rlRun "mkdir -p ${OUTDIR}/b6_e2e_build" - rlRun "expand_module_te ${GOOD_IF} ${FIXTURES}/modules/te_good.te ${OUTDIR}/b6_e2e.tmp" - rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/b6_e2e_build/te_good.mod ${OUTDIR}/b6_e2e.tmp" - rlRun "expand_fc ${FIXTURES}/file_contexts/bad_context.fc ${OUTDIR}/b6_e2e.mod.fc" - rlRun "${SEMODULE_PACKAGE} -o ${OUTDIR}/b6_e2e.pp -m ${OUTDIR}/b6_e2e_build/te_good.mod -f ${OUTDIR}/b6_e2e.mod.fc" - rlRun "test -s ${OUTDIR}/b6_e2e.pp" - rlPhaseEnd - - rlPhaseStartCleanup - if [ -n "${OUTDIR:-}" ] && [ -d "${OUTDIR}" ]; then - rlRun "rm -rf ${OUTDIR}" - fi - if [ -n "${CLONED_POLICY_DIR:-}" ] && [ -d "${CLONED_POLICY_DIR}" ]; then - rlRun "rm -rf ${CLONED_POLICY_DIR}" - fi - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/selinux-policy/nasd-and-similar/Makefile b/selinux-policy/nasd-and-similar/Makefile deleted file mode 100644 index 3d9f93c..0000000 --- a/selinux-policy/nasd-and-similar/Makefile +++ /dev/null @@ -1,68 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/nasd-and-similar -# Description: SELinux interferes with the nasd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/nasd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with the nasd service and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: nas" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nas /usr/sbin/service perl-Perl4-CoreLibs" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/selinux-policy/nasd-and-similar/PURPOSE b/selinux-policy/nasd-and-similar/PURPOSE deleted file mode 100644 index 3315a94..0000000 --- a/selinux-policy/nasd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/nasd-and-similar -Author: Milos Malik - -SELinux interferes with the nasd service and related programs. - diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf deleted file mode 100644 index 7ba0e30..0000000 --- a/selinux-policy/nasd-and-similar/main.fmf +++ /dev/null @@ -1,39 +0,0 @@ -summary: SELinux interferes with the nasd service and related programs -description: |+ - SELinux interferes with the nasd service and related programs. - -contact: Milos Malik -component: - - nas -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - nas - - perl-Perl4-CoreLibs - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - because: the nas package is not available there - - enabled: false - when: distro >= centos-stream-9 - because: the nas package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/nasd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar -extra-nitrate: TC#0614607 -id: ad784a9d-5cf4-4aac-b583-68458860acd9 -tag: - - failinfedora - - NoRHIVOS diff --git a/selinux-policy/nasd-and-similar/runtest.sh b/selinux-policy/nasd-and-similar/runtest.sh deleted file mode 100755 index fe86100..0000000 --- a/selinux-policy/nasd-and-similar/runtest.sh +++ /dev/null @@ -1,107 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/nasd-and-similar -# Description: SELinux interferes with the nasd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="N0t-1mp0rt4nT" -FILE_PATH="/usr/bin/nasd" -FILE_CONTEXT="soundd_exec_t" -SERVICE_PACKAGE="nas" -SERVICE_NAME="nasd" -PROCESS_NAME="nasd" -PROCESS_CONTEXT="soundd_t" - -rlJournalStart - if rlIsRHEL ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlFileBackup /etc/sysconfig/nasd - sed -i 's/^NASD_OPTIONS.*$/NASD_OPTIONS="-aa -pn"/' /etc/sysconfig/nasd - rlRun "uname -r" - rlRun "dnf -y install kernel-modules-`uname -r`" - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for environments where the SELinux type is not defined yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlRun "modprobe snd_pcm_oss" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "ls -lZ /dev/dsp*" - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/nfsdcld-and-similar/Makefile b/selinux-policy/nfsdcld-and-similar/Makefile index cece726..0de572a 100644 --- a/selinux-policy/nfsdcld-and-similar/Makefile +++ b/selinux-policy/nfsdcld-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit /usr/sbin/service libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nfs-utils" >> $(METADATA) + @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nfs-utils" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -63,7 +63,6 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1834234" >> $(METADATA) # Fedora 32 - @echo "Bug: 2026588" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/selinux-policy/nfsdcld-and-similar/main.fmf b/selinux-policy/nfsdcld-and-similar/main.fmf index c371bdb..5dbc685 100644 --- a/selinux-policy/nfsdcld-and-similar/main.fmf +++ b/selinux-policy/nfsdcld-and-similar/main.fmf @@ -1,44 +1,5 @@ -summary: SELinux interferes with the nfsdcld service and related programs -description: |+ - SELinux interferes with the nfsdcld service and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - /usr/sbin/service - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - nfs-utils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - failinfedora - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834234 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2026588 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0608104 -extra-summary: /CoreOS/selinux-policy/Regression/nfsdcld-and-similar -extra-task: /CoreOS/selinux-policy/Regression/nfsdcld-and-similar -id: c92c4cfe-bb32-411b-a623-fe5c7feee13b +path: /selinux-policy/nfsdcld-and-similar +tier: 2 +adjust: +- enabled: false + when: distro < rhel-8 diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh index b6e8ad4..0fd7a54 100755 --- a/selinux-policy/nfsdcld-and-similar/runtest.sh +++ b/selinux-policy/nfsdcld-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -40,7 +41,7 @@ PROCESS_CONTEXT="rpcd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -55,7 +56,7 @@ rlJournalStart sleep 2 rlPhaseEnd - rlPhaseStartTest "bz#1834234 + bz#2026588" + rlPhaseStartTest "bz#1834234" rlSEMatchPathCon "/usr/sbin/nfsdcld" "rpcd_exec_t" rlSESearchRule "allow init_t rpcd_exec_t : file { getattr open read execute } [ ]" rlSESearchRule "type_transition init_t rpcd_exec_t : process rpcd_t" @@ -63,17 +64,15 @@ rlJournalStart rlSESearchRule "allow rpcd_t nfsd_fs_t : file { getattr open read } [ ]" rlPhaseEnd - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/notself-other-keywords/main.fmf b/selinux-policy/notself-other-keywords/main.fmf deleted file mode 100644 index c64df80..0000000 --- a/selinux-policy/notself-other-keywords/main.fmf +++ /dev/null @@ -1,33 +0,0 @@ -summary: Basic test of the notself/other keywords -contact: Milos Malik -test: ./runtest.sh -framework: beakerlib -component: - - selinux-policy -recommend: - - libsepol - - libsemanage - - libselinux - - policycoreutils - - selinux-policy - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tier: 1 -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - NoRHIVOS -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 - because: notself/other keywords are not recognized/implemented there -extra-nitrate: TC#0617216 -id: 88fc548f-c1fa-48dc-a5ca-58478774911f diff --git a/selinux-policy/notself-other-keywords/notself-module.cil b/selinux-policy/notself-other-keywords/notself-module.cil deleted file mode 100644 index ae361a7..0000000 --- a/selinux-policy/notself-other-keywords/notself-module.cil +++ /dev/null @@ -1,3 +0,0 @@ -(type a_t) -(allow a_t notself ( process ( signal ))) - diff --git a/selinux-policy/notself-other-keywords/other-module.cil b/selinux-policy/notself-other-keywords/other-module.cil deleted file mode 100644 index 90e0570..0000000 --- a/selinux-policy/notself-other-keywords/other-module.cil +++ /dev/null @@ -1,9 +0,0 @@ -(typeattribute parts) -(type a_t) -(type b_t) -(type c_t) -(typeattributeset parts ( a_t )) -(typeattributeset parts ( b_t )) -(typeattributeset parts ( c_t )) -(allow parts other ( process ( signal ))) - diff --git a/selinux-policy/notself-other-keywords/runtest.sh b/selinux-policy/notself-other-keywords/runtest.sh deleted file mode 100755 index 48c5442..0000000 --- a/selinux-policy/notself-other-keywords/runtest.sh +++ /dev/null @@ -1,71 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - CUR_VERSION=`rpm -q --qf "%{version}" policycoreutils | head -n 1` - if rlTestVersion ${CUR_VERSION} '<' 3.6 ; then - rlLog "The installed SELinux userspace does NOT support the notself/other keywords." - rlLog "The automated test is NOT relevant for this environment." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlAssertRpm libsepol - rlAssertRpm libsemanage - rlAssertRpm libselinux - rlAssertRpm policycoreutils - rlAssertRpm selinux-policy - - rlRun "setenforce 1" - rlRun "sestatus" - rlPhaseEnd - - rlPhaseStartTest "rules defined via the 'notself' keyword" - rlRun "semodule -lfull | grep notself-module" 1 - rlRun "seinfo -t | grep -vi Types: | wc -l" - # FIXME: seinfo output contains 1 empty line - NO_TYPES_BEFORE=`seinfo -t | grep -vi Types: | wc -l` - rlRun "sesearch -A | wc -l" - NO_ALLOWS_BEFORE=`sesearch -A | wc -l` - rlRun "semodule -i notself-module.cil" - rlRun "semodule -lfull | grep notself-module" - rlRun "seinfo -t | grep -vi Types: | wc -l" - # FIXME: seinfo output contains 1 empty line - NO_TYPES_AFTER=`seinfo -t | grep -vi Types: | wc -l` - rlRun "sesearch -A | wc -l" - NO_ALLOWS_AFTER=`sesearch -A | wc -l` - rlLog "${NO_ALLOWS_BEFORE} + ${NO_TYPES_BEFORE} - 1 = ${NO_ALLOWS_AFTER}" - # FIXME: -1 is used because seinfo output contains 1 empty line - rlAssertEquals "the number of allow rules grows because of the 'notself' usage" $(( NO_ALLOWS_BEFORE + NO_TYPES_BEFORE - 1 )) $NO_ALLOWS_AFTER - rlRun "sesearch -A | grep notself" 1 - rlRun "semodule -r notself-module" - rlPhaseEnd - - rlPhaseStartTest "rules defined via the 'other' keyword" - rlRun "semodule -lfull | grep other-module" 1 - rlRun "seinfo -t a_t -x | grep -i 'types: *0'" - rlRun "sesearch -s a_t -A" 1 - rlRun "semodule -i other-module.cil" - rlRun "semodule -lfull | grep other-module" - rlRun "seinfo -t a_t -x | grep -C 1 -i 'types: *1'" - rlRun "sesearch -A | grep other" 1 - rlLog "the 'other' keyword should NOT generate any allow rules where scontext = tcontext" - rlRun "sesearch -s a_t -t a_t -A | grep allow" 1 - rlRun "sesearch -s b_t -t b_t -A | grep allow" 1 - rlRun "sesearch -s c_t -t c_t -A | grep allow" 1 - rlLog "the 'other' keyword should generate allow rules where scontext != tcontext" - rlRun "sesearch -s a_t -t b_t -A | grep allow" - rlRun "sesearch -s a_t -t c_t -A | grep allow" - rlRun "sesearch -s b_t -t a_t -A | grep allow" - rlRun "sesearch -s b_t -t c_t -A | grep allow" - rlRun "sesearch -s c_t -t a_t -A | grep allow" - rlRun "sesearch -s c_t -t b_t -A | grep allow" - rlRun "semodule -r other-module" - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalEnd - diff --git a/selinux-policy/ntpsec-and-similar/Makefile b/selinux-policy/ntpsec-and-similar/Makefile deleted file mode 100644 index bd21b6d..0000000 --- a/selinux-policy/ntpsec-and-similar/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/ntpsec-and-similar -# Description: SELinux interferes with the ntpsec ntpd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/ntpsec-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with the ntpsec ntpd service and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console ntpsec /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL10" >> $(METADATA) - @echo "Bug: 2246805" >> $(METADATA) # Fedora 38 - @echo "Bug: RHEL-15085" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/ntpsec-and-similar/PURPOSE b/selinux-policy/ntpsec-and-similar/PURPOSE deleted file mode 100644 index d39d82d..0000000 --- a/selinux-policy/ntpsec-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/ntpsec-and-similar -Author: Milos Malik - -SELinux interferes with the ntpsec ntpd service and related program - diff --git a/selinux-policy/ntpsec-and-similar/main.fmf b/selinux-policy/ntpsec-and-similar/main.fmf deleted file mode 100644 index 8fe3341..0000000 --- a/selinux-policy/ntpsec-and-similar/main.fmf +++ /dev/null @@ -1,47 +0,0 @@ -summary: SELinux interferes with the ntpsec ntpd service and related programs -description: |+ - SELinux interferes with the ntpsec ntpd service and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - ntpsec - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - epel - - rhel9-epel - - targeted - - NoRHIVOS -tier: '3' -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246805 - - verifies: https://issues.redhat.com/browse/RHEL-15085 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-10, centos-stream-10 - because: the ntpsec package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/ntpsec-and-similar -extra-task: /CoreOS/selinux-policy/Regression/ntpsec-and-similar -extra-nitrate: TC#0615926 -id: 258f0e8c-141f-473c-b418-d19049c464b2 diff --git a/selinux-policy/ntpsec-and-similar/runtest.sh b/selinux-policy/ntpsec-and-similar/runtest.sh deleted file mode 100755 index 30ad45c..0000000 --- a/selinux-policy/ntpsec-and-similar/runtest.sh +++ /dev/null @@ -1,91 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/ntpsec-and-similar -# Description: SELinux interferes with the ntpsec ntpd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/sbin/ntpd" -FILE_CONTEXT="ntpd_exec_t" -SERVICE_PACKAGE="ntpsec" -SERVICE_NAME="ntpd" -PROCESS_NAME="ntpd" -PROCESS_CONTEXT="ntpd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/ntp.conf - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL "<9.4" ; then - rlPhaseStartTest "bz#2246805 + RHEL-15085" - rlSEMatchPathCon "/usr/sbin/ntpd" "ntpd_exec_t" - rlSESearchRule "allow ntpd_t ntske_port_t : tcp_socket { name_connect } [ ]" - rlSEMatchPortCon tcp 4460 ntske_port_t - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for environments where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlRun "echo -en '\nserver nts.netnod.se:4460 nts iburst\n' >> /etc/ntp.conf" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/numad-and-similar/Makefile b/selinux-policy/numad-and-similar/Makefile deleted file mode 100644 index 10f6781..0000000 --- a/selinux-policy/numad-and-similar/Makefile +++ /dev/null @@ -1,86 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/numad-and-similar -# Description: SELinux interferes with numad and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/numad-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with numad and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: numad" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: expect" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Requires: initscripts" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: numad" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: procps" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: setools" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Architectures: aarch64 ppc64le x86_64" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) - @echo "Bug: 807157" >> $(METADATA) # RHEL-6 - @echo "Bug: 857086" >> $(METADATA) # RHEL-7 - @echo "Bug: 1074449" >> $(METADATA) # RHEL-7 - @echo "Bug: 1118515" >> $(METADATA) # RHEL-7 - @echo "Bug: 2026968" >> $(METADATA) # Fedora 35 - @echo "Bug: RHEL-2415" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/numad-and-similar/PURPOSE b/selinux-policy/numad-and-similar/PURPOSE deleted file mode 100644 index e3fd202..0000000 --- a/selinux-policy/numad-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/numad-and-similar -Author: Milos Malik - -SELinux interferes with numad and related programs. - diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf deleted file mode 100644 index 8a0faa1..0000000 --- a/selinux-policy/numad-and-similar/main.fmf +++ /dev/null @@ -1,55 +0,0 @@ -summary: SELinux interferes with numad and related programs -description: |+ - SELinux interferes with numad and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - expect - - grep - - /usr/sbin/service - - libselinux - - libselinux-utils - - numad - - policycoreutils - - procps - - selinux-policy - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - TIPpass - - TIPpass_FIPS - - TIPpass_Security - - TipWaived7 - - targeted - - NoRHIVOS -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=807157 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=857086 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1074449 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1118515 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2026968 - - verifies: https://issues.redhat.com/browse/RHEL-2415 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false - - enabled: false - when: arch != x86_64 and arch != aarch64 and arch != ppc64le - continue: false -extra-nitrate: TC#0202428 -extra-summary: /CoreOS/selinux-policy/Regression/numad-and-similar -extra-task: /CoreOS/selinux-policy/Regression/numad-and-similar -id: f97f6046-ee73-48ec-b3fc-7aa08648890c diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh deleted file mode 100755 index 52cbe64..0000000 --- a/selinux-policy/numad-and-similar/runtest.sh +++ /dev/null @@ -1,132 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/numad-and-similar -# Description: SELinux interferes with numad and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -SERVICE_NAME="numad" -PROCESS_NAME="numad" -PROCESS_CONTEXT="numad_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm numad - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined "numad_t numad_exec_t" ; then - rlPhaseStartTest "bz#807157" - rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" - rlSESearchRule "allow initrc_t numad_t : process { transition }" - rlPhaseEnd - fi - - if rlSEDefined "numad_exec_t cgroup_t numad_t" ; then - rlPhaseStartTest "bz#857086" - rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" - if rlIsRHEL 6 ; then - MOUNT_POINT="/cgroup/cpuset" - rlSEMatchPathCon "${MOUNT_POINT}" "cgroup_t" - else - MOUNT_POINT="/sys/fs/cgroup/cpuset" - if [ -d ${MOUNT_POINT} ] ; then - rlRun "ls -dZ ${MOUNT_POINT} | grep :cgroup_t" - else - rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t" - fi - fi - rlSESearchRule "allow numad_t cgroup_t : dir { getattr search }" - rlSESearchRule "allow numad_t numad_t : msg { send receive }" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1074449" - rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" - rlSESearchRule "allow numad_t sysfs_t : file { write }" - rlPhaseEnd - - rlPhaseStartTest "bz#1118515" - rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" - rlSEMatchPathCon "/var/log/numad.log" "numad_var_log_t" - rlSEMatchPathCon "/var/run/numad.pid" "numad_var_run_t" - rlSESearchRule "allow virtd_t numad_exec_t : file { getattr open read execute }" - rlSESearchRule "type_transition virtd_t numad_exec_t : process numad_t" - rlSESearchRule "allow virtd_t numad_t : process { transition }" - rlSESearchRule "allow numad_t numad_var_log_t : file { open }" - rlSESearchRule "allow numad_t numad_t : msg { send receive }" - rlSESearchRule "allow numad_t numad_t : msgq { associate unix_read unix_write read write }" - rlSESearchRule "allow numad_t numad_var_run_t : file { getattr open read }" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#2026968 + RHEL-2415" - rlSESearchRule "allow numad_t numad_t : capability { ipc_owner } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "mkdir -p ${MOUNT_POINT}" - if ! mount | grep -q "cgroup.*cpuset" ; then - rlRun "mount cgroup -t cgroup -o cpuset ${MOUNT_POINT}" 0,32 - fi - rlRun "semodule -l | grep numad" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "numad -S 0" - rlRun "numad -S 1" - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlFileRestore - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/nvme-stas-and-similar/Makefile b/selinux-policy/nvme-stas-and-similar/Makefile deleted file mode 100644 index fadaa75..0000000 --- a/selinux-policy/nvme-stas-and-similar/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar -# Description: SELinux interferes with stacd and stafd services -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/nvme-stas-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with stacd and stafd services" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: nvme-stas" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: avahi audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service nvme-stas" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 2111414" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-1557" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/nvme-stas-and-similar/PURPOSE b/selinux-policy/nvme-stas-and-similar/PURPOSE deleted file mode 100644 index 0f6ef81..0000000 --- a/selinux-policy/nvme-stas-and-similar/PURPOSE +++ /dev/null @@ -1,6 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar -Author: Milos Malik - -SELinux interferes with stacd and stafd services. -SELinux also affects the stacctl and stafctl programs. - diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf deleted file mode 100644 index 277ee8e..0000000 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ /dev/null @@ -1,49 +0,0 @@ -summary: SELinux interferes with stacd and stafd services -description: |+ - SELinux interferes with stacd and stafd services - -contact: Milos Malik -component: - - nvme-stas - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - avahi - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - nvme-stas -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - failinfedora - - NoRHIVOS - - epel - - rhel10-epel -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2111414 - - verifies: https://issues.redhat.com/browse/RHEL-1557 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - because: the nvme-stas package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar -extra-task: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar -extra-nitrate: TC#0614621 -id: 6a439688-11aa-4fbe-be69-666d5245e4e0 diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh deleted file mode 100755 index ba83928..0000000 --- a/selinux-policy/nvme-stas-and-similar/runtest.sh +++ /dev/null @@ -1,131 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar -# Description: SELinux interferes with stacd and stafd services -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_CONTEXT="nvme_stas_exec_t" -SERVICE_PACKAGE="nvme-stas" -PROCESS_CONTEXT="nvme_stas_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStart avahi-daemon - rlServiceStop stacd stafd - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined "${FILE_CONTEXT} ${PROCESS_CONTEXT}" ; then - rlPhaseStartTest "bz#2111414 + RHEL-1557" - rlSEMatchPathCon "/usr/sbin/stacd" "${FILE_CONTEXT}" - rlSEMatchPathCon "/usr/sbin/stafd" "${FILE_CONTEXT}" - rlSEMatchPathCon "/dev/nvme-fabrics" "fixed_disk_device_t" - rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t" - rlSEMatchPathCon "/run/stacd" "nvme_stas_var_run_t" - rlSEMatchPathCon "/run/stacd/last-known-config.pickle" "nvme_stas_var_run_t" - rlSEMatchPathCon "/run/stafd" "nvme_stas_var_run_t" - rlSEMatchPathCon "/run/stafd/last-known-config.pickle" "nvme_stas_var_run_t" - rlSEMatchPathCon "/run/udev/" "udev_var_run_t" - rlSEMatchPathCon "/run/udev/rules.d/" "udev_var_run_t" - rlSEMatchPathCon "/run/udev/rules.d/70-nvmf-autoconnect.rules" "udev_var_run_t" - rlSEMatchPathCon "/var/cache/stacd" "nvme_stas_cache_t" - rlSEMatchPathCon "/var/cache/stafd" "nvme_stas_cache_t" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlRun "semodule -lfull | grep stas" - rlSESearchRule "allow avahi_t nvme_stas_t : dbus { send_msg } [ ]" - rlSESearchRule "allow nvme_stas_t avahi_t : dbus { send_msg } [ ]" - rlSESearchRule "allow nvme_stas_t fixed_disk_device_t : chr_file { getattr } [ ]" - rlSESearchRule "allow nvme_stas_t nvme_stas_t : dbus { send_msg } [ ]" - rlSESearchRule "allow nvme_stas_t syslogd_var_run_t : sock_file { write } [ ]" - rlSESearchRule "allow nvme_stas_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]" - rlSESearchRule "allow nvme_stas_t udev_var_run_t : dir { add_name remove_name write } [ ]" - rlSESearchRule "allow nvme_stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]" - rlSESearchRule "allow nvme_stas_t nvme_stas_var_run_t : file { getattr ioctl open read write } [ ]" - rlSESearchRule "allow unconfined_t nvme_stas_t : dbus { send_msg } [ ]" - rlSESearchRule "allow nvme_stas_t unconfined_t : dbus { send_msg } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- standalone service" - for CUR_FILE in /usr/lib/systemd/system/stacd.service \ - /usr/lib/systemd/system/stafd.service ; do - if grep -q '^ExecStart=.*python' ${CUR_FILE} ; then - rlRun "cp -f ${CUR_FILE} /etc/systemd/system/" - COPIED_FILE=`echo ${CUR_FILE} | sed 's|/usr/lib|/etc|'` - rlRun "sed -i 's|^ExecStart=.*python.* /|ExecStart=/|' ${COPIED_FILE}" - rlRun "systemctl daemon-reload" - rlRun "grep '^ExecStart=' ${COPIED_FILE}" - fi - done - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for environments where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlRun "mkdir -p /etc/nvme" - rlRun "touch /etc/nvme/hostid" - rlRun "touch /etc/nvme/hostnqn" - rlSEService - stafd stafd ${PROCESS_CONTEXT} "start status" 1 - rlRun "stafctl status" - rlRun "stafctl ls" - rlSEService - stacd stacd ${PROCESS_CONTEXT} "start status" 1 - rlRun "stacctl status" - rlRun "stacctl ls" - rlRun "stasadm -v" - rlRun "stasadm hostid" - rlRun "stasadm hostnqn" - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - stacd stacd ${PROCESS_CONTEXT} "restart status stop status" 1 - rlSEService - stafd stafd ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlRun "rm -f /etc/systemd/system/stacd.service" - rlRun "rm -f /etc/systemd/system/stafd.service" - rlRun "systemctl daemon-reload" - rlServiceRestore stacd stafd - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/opensmtpd-and-similar/Makefile b/selinux-policy/opensmtpd-and-similar/Makefile deleted file mode 100644 index 1e21b4b..0000000 --- a/selinux-policy/opensmtpd-and-similar/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/opensmtpd-and-similar -# Description: SELinux interferes with the opensmtpd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/opensmtpd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with the opensmtpd service and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service /usr/bin/mailx" >> $(METADATA) # EPEL - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2208696" >> $(METADATA) # Fedora 38 - @echo "Bug: 2246115" >> $(METADATA) # Fedora rawhide - @echo "Bug: RHEL-15175" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/opensmtpd-and-similar/PURPOSE b/selinux-policy/opensmtpd-and-similar/PURPOSE deleted file mode 100644 index 7f8a9ff..0000000 --- a/selinux-policy/opensmtpd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/opensmtpd-and-similar -Author: Milos Malik - -SELinux interferes with the opensmtpd service and related programs - diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf deleted file mode 100644 index ba8c289..0000000 --- a/selinux-policy/opensmtpd-and-similar/main.fmf +++ /dev/null @@ -1,49 +0,0 @@ -summary: SELinux interferes with the opensmtpd service and related programs -description: |+ - SELinux interferes with the opensmtpd service and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - opensmtpd - - /usr/sbin/service - - /usr/bin/mailx -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - epel - - rhel8-epel - - rhel9-epel - - rhel10-epel - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246115 - - verifies: https://issues.redhat.com/browse/RHEL-15175 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the opensmtpd package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/opensmtpd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/opensmtpd-and-similar -extra-nitrate: TC#0615352 -id: cb0ae69e-3193-450f-901f-4159048d1180 diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh deleted file mode 100755 index c728060..0000000 --- a/selinux-policy/opensmtpd-and-similar/runtest.sh +++ /dev/null @@ -1,116 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/opensmtpd-and-similar -# Description: SELinux interferes with the opensmtpd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/sbin/smtpd" -FILE_CONTEXT="sendmail_exec_t" -SERVICE_PACKAGE="opensmtpd" -SERVICE_NAME="opensmtpd" -PROCESS_NAME="smtpd" -PROCESS_CONTEXT="sendmail_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi - - if [ -e /etc/pki/tls/cert.pem ] ; then - CERTIFICATE_MISSING="false" - else - CERTIFICATE_MISSING="true" - fi - rlServiceStop ${SERVICE_NAME} postfix sendmail - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then - if ! rlIsRHEL "<9.4" ; then - rlPhaseStartTest "bz#2208696" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/smtpd.sock" "sendmail_var_run_t" - rlSESearchRule "allow sendmail_t sendmail_t : capability { sys_chroot fowner } [ ]" - rlSESearchRule "type_transition sendmail_t var_run_t : sock_file sendmail_var_run_t" - rlSESearchRule "allow sendmail_t sendmail_var_run_t : sock_file { create setattr unlink write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2246115" - rlSEMatchPathCon "/run/smtpd.sock" "sendmail_var_run_t" - rlSESearchRule "allow sendmail_t sendmail_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "RHEL-15175" - # actions on the /var/run/smtpd.pid file - rlSESearchRule "allow sendmail_t sendmail_var_run_t : file { create getattr open unlink write } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! ls -Z ${FILE_PATH} | grep -q ${FILE_CONTEXT} ; then - # for environments where the service is not yet confined - PROCESS_CONTEXT="unconfined_service_t" - fi - if ${CERTIFICATE_MISSING} ; then - rlRun "touch /etc/pki/tls/cert.pem" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "sestatus | mailx -s test-email root@localhost" - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlRun "smtpctl show status" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - if ${CERTIFICATE_MISSING} ; then - rlRun "rm -f /etc/pki/tls/cert.pem" - fi - rlServiceRestore ${SERVICE_NAME} postfix sendmail - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/pam_console-and-related/main.fmf b/selinux-policy/pam_console-and-related/main.fmf index 986021c..96a80b5 100644 --- a/selinux-policy/pam_console-and-related/main.fmf +++ b/selinux-policy/pam_console-and-related/main.fmf @@ -1,55 +1,2 @@ -summary: Does SELinux cooperate with pam_console_apply and pam_console.so? -description: |+ - Does SELinux cooperate with pam_console_apply and pam_console.so? - Confined and unconfined users are tested using SSH. - - This TC uses following parameters which can be overriden: - * ALLOWED_USERS - which SELinux users should be tested? - * DENIED_USERS - which SELinux users should NOT be tested? - -contact: aborah@redhat.com -component: - - pam - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - expect - - openssh-clients - - pam - - psmisc - - binutils - - shadow-utils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - failinfedora - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=204986 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=251104 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1817690 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 or distro > fedora-38 - continue: false -extra-nitrate: TC#0606229 -extra-summary: /CoreOS/selinux-policy/Regression/pam_console-and-related -extra-task: /CoreOS/selinux-policy/Regression/pam_console-and-related -id: 622adb1b-d20a-4418-8646-3aaecd35a1e2 +path: /selinux-policy/pam_console-and-related +tier: 2 diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh index 068581b..297d590 100755 --- a/selinux-policy/pam_console-and-related/runtest.sh +++ b/selinux-policy/pam_console-and-related/runtest.sh @@ -27,9 +27,11 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" SERVICE_PACKAGE="pam" if rlIsRHEL 7 ; then DENIED_USERS=${DENIED_USERS:-"staff_u"} @@ -41,14 +43,13 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} rlFileBackup /etc/shadow - rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -98,18 +99,15 @@ rlJournalStart rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd - if [ -f /usr/sbin/pam_console_apply ] ; then rlPhaseStartTest "real scenario -- runcon under root" rlRun "runcon system_u:system_r:initrc_t:s0 /bin/bash -c '/usr/sbin/pam_console_apply -r'" rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 rlSECheckAVC rlFileRestore - rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/pam_limits-and-related/Makefile b/selinux-policy/pam_limits-and-related/Makefile deleted file mode 100644 index 2fb85ca..0000000 --- a/selinux-policy/pam_limits-and-related/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/pam_limits-and-related -# Description: Does SELinux cooperate with pam_limits.so? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/pam_limits-and-related -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh ssh.exp - chcon -t bin_t runtest.sh ssh.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does SELinux cooperate with pam_limits.so?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: pam" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients pam shadow-utils" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 1958819" >> $(METADATA) # Fedora 34 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/pam_limits-and-related/PURPOSE b/selinux-policy/pam_limits-and-related/PURPOSE deleted file mode 100644 index 9b9e9c4..0000000 --- a/selinux-policy/pam_limits-and-related/PURPOSE +++ /dev/null @@ -1,10 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/pam_limits-and-related -Author: Milos Malik - -Does SELinux cooperate with pam_limits.so? -Confined and unconfined users are tested using SSH. - -This TC uses following parameters which can be overriden: - * ALLOWED_USERS - which SELinux users should be tested? - * DENIED_USERS - which SELinux users should NOT be tested? - diff --git a/selinux-policy/pam_limits-and-related/main.fmf b/selinux-policy/pam_limits-and-related/main.fmf deleted file mode 100644 index cce5bcb..0000000 --- a/selinux-policy/pam_limits-and-related/main.fmf +++ /dev/null @@ -1,52 +0,0 @@ -summary: Does SELinux cooperate with pam_limits.so? -description: |+ - Does SELinux cooperate with pam_limits.so? - Confined and unconfined users are tested using SSH. - - This TC uses following parameters which can be overriden: - * ALLOWED_USERS - which SELinux users should be tested? - * DENIED_USERS - which SELinux users should NOT be tested? - -contact: Milos Malik -component: - - pam - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - expect - - openssh-clients - - pam - - shadow-utils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - failinfedora - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1958819 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2039453 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0612789 -extra-summary: /CoreOS/selinux-policy/Regression/pam_limits-and-related -extra-task: /CoreOS/selinux-policy/Regression/pam_limits-and-related -id: 4702e6e7-8340-475d-9b97-af2779bf2a8a diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh deleted file mode 100755 index e788de1..0000000 --- a/selinux-policy/pam_limits-and-related/runtest.sh +++ /dev/null @@ -1,91 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/pam_limits-and-related -# Description: Does SELinux cooperate with pam_limits.so? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SERVICE_PACKAGE="pam" -DENIED_USERS=${DENIED_USERS:-""} -ALLOWED_USERS=${ALLOWED_USERS:-"guest_u xguest_u user_u staff_u sysadm_u unconfined_u"} - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlFileBackup /etc/shadow - rlFileBackup /etc/security/limits.conf - rlSEConfigureSSH - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then - rlPhaseStartTest "bz#1958819" - rlSESearchRule "allow init_t guest_t : process2 { nnp_transition } [ ]" - rlSESearchRule "allow init_t staff_t : process2 { nnp_transition } [ ]" - rlSESearchRule "allow init_t sysadm_t : process2 { nnp_transition } [ ]" - rlSESearchRule "allow init_t unconfined_t : process2 { nnp_transition } [ ]" - rlSESearchRule "allow init_t user_t : process2 { nnp_transition } [ ]" - rlSESearchRule "allow init_t xguest_t : process2 { nnp_transition } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- confined users" - rlRun "setsebool ssh_sysadm_login on" - rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "echo \"${USER_NAME} - nonewprivs 1\" >> /etc/security/limits.conf" - rlRun "restorecon -RvF /home/${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost id" - rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 - done - rlRun "setsebool ssh_sysadm_login off" - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC --ignore 'type=AVC.*connectto.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*:xguest_t:.*:systemd_machined_t:' - - rlFileRestore - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/pam_limits-and-related/ssh.exp b/selinux-policy/pam_limits-and-related/ssh.exp deleted file mode 100755 index 58c9647..0000000 --- a/selinux-policy/pam_limits-and-related/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname $command -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/pam_timestamp-and-related/main.fmf b/selinux-policy/pam_timestamp-and-related/main.fmf index 5e7a835..a83b2cb 100644 --- a/selinux-policy/pam_timestamp-and-related/main.fmf +++ b/selinux-policy/pam_timestamp-and-related/main.fmf @@ -1,62 +1,2 @@ -summary: Does SELinux cooperate with pam_timestamp_check and pam_timestamp.so? -description: |+ - Does SELinux cooperate with pam_timestamp_check and pam_timestamp.so? - Confined and unconfined users are tested using SSH. - - This TC uses following parameters which can be overriden: - * ALLOWED_USERS - which SELinux users should be tested? - * DENIED_USERS - which SELinux users should NOT be tested? - * TIMESTAMP_DIR - in which directory is the _pam_timestamp_key file stored? - -contact: aborah@redhat.com -component: - - pam - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - expect - - openssh-clients - - pam - - psmisc - - binutils - - shadow-utils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass - - TIPpass_Security - - f32friendly - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1791957 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false - - environment: - TIMESTAMP_DIR: /run/sudo - when: distro == rhel-7 - continue: false - - enabled: false - when: distro ~<= rhel-8.2 - continue: false -extra-nitrate: TC#0606210 -extra-summary: /CoreOS/selinux-policy/Regression/pam_timestamp-and-related -extra-task: /CoreOS/selinux-policy/Regression/pam_timestamp-and-related -id: 8d9cd03c-0cce-4527-89ec-dab84f651e26 +path: /selinux-policy/pam_timestamp-and-related +tier: 2 diff --git a/selinux-policy/pam_timestamp-and-related/runtest.sh b/selinux-policy/pam_timestamp-and-related/runtest.sh index 1d1c61b..d808a62 100755 --- a/selinux-policy/pam_timestamp-and-related/runtest.sh +++ b/selinux-policy/pam_timestamp-and-related/runtest.sh @@ -27,9 +27,11 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" SERVICE_PACKAGE="pam" DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} @@ -37,7 +39,7 @@ TIMESTAMP_DIR=${TIMESTAMP_DIR:-"/run/pam_timestamp"} rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -45,7 +47,6 @@ rlJournalStart rlFileBackup /etc/shadow rlFileBackup ${TIMESTAMP_DIR}/_pam_timestamp_key - rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -98,9 +99,7 @@ rlJournalStart sleep 2 rlSECheckAVC rlRun "rm -f ${TIMESTAMP_DIR}/_pam_timestamp_key" - rlFileRestore - rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/pcm-sensor-server-and-similar/Makefile b/selinux-policy/pcm-sensor-server-and-similar/Makefile deleted file mode 100644 index b37360f..0000000 --- a/selinux-policy/pcm-sensor-server-and-similar/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar -# Description: SELinux interferes with pcm-sensor-server and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with pcm-sensor-server and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: pcm" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console pcm /usr/sbin/service virt-what" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) - @echo "Bug: RHEL-52838" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-80452" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/pcm-sensor-server-and-similar/PURPOSE b/selinux-policy/pcm-sensor-server-and-similar/PURPOSE deleted file mode 100644 index 521f682..0000000 --- a/selinux-policy/pcm-sensor-server-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar -Author: Milos Malik - -SELinux interferes with pcm-sensor-server and related programs. - diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf deleted file mode 100644 index 1e1f63a..0000000 --- a/selinux-policy/pcm-sensor-server-and-similar/main.fmf +++ /dev/null @@ -1,51 +0,0 @@ -summary: SELinux interferes with pcm-sensor-server and related programs -description: |+ - SELinux interferes with pcm-sensor-server and related programs. - -contact: Milos Malik -component: - - pcm - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - pcm - - /usr/sbin/service - - virt-what -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - NoRHEL9 - - targeted - - failinfedora - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-52838 - - verifies: https://issues.redhat.com/browse/RHEL-80452 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 - because: the pcm-sensor-server service is not available there - - enabled: false - when: arch == aarch64, ppc64le, s390x - because: the pcm package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar -extra-task: /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar -extra-nitrate: TC#0617904 -id: a9229ccd-ac0e-4a00-9cc2-733ddb5de881 diff --git a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh deleted file mode 100755 index e54cd3b..0000000 --- a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh +++ /dev/null @@ -1,101 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar -# Description: SELinux interferes pcm-sensor-server and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/sbin/pcm-sensor-server" -SERVICE_NAME="pcm-sensor-server" -PROCESS_NAME="pcm-sensor-server" -if seinfo -t | grep -q pcm ; then - FILE_CONTEXT="pcmsensor_exec_t" - PROCESS_CONTEXT="pcmsensor_t" -else - FILE_CONTEXT="bin_t" - PROCESS_CONTEXT="unconfined_service_t" -fi - -rlJournalStart - if rlIsRHEL 7 8 9 || rlIsCentOS 7 8 9 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -qf ${FILE_PATH}" - - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined "pcmsensor_t" ; then - rlPhaseStartTest "RHEL-80452" - rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} - rlSESearchRule "allow pcmsensor_t pcmsensor_t : capability2 { perfmon } [ ]" - rlSESearchRule "allow pcmsensor_t pcmsensor_t : perf_event { cpu kernel open read } [ ]" - rlSESearchRule "allow pcmsensor_t pcmsensor_t : tcp_socket { accept bind create listen } [ ]" - rlSESearchRule "allow pcmsensor_t node_t : tcp_socket { node_bind } [ ]" - rlPhaseEnd - fi - - rm -f output.txt - virt-what >& output.txt - if [ -s output.txt ] ; then - echo "Running on a virtual machine -- ${SERVICE_NAME} does not like that" - else - rlPhaseStartTest "real scenario -- standalone service" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "pcm-iio 1.0 -i=1" - rlRun "pcm-memory 1.0 -i=1" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "pcm-latency -i=1" - rlRun "pcm-lspci" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/pcp-daemons-and-similar/Makefile b/selinux-policy/pcp-daemons-and-similar/Makefile index a7216d7..7367625 100644 --- a/selinux-policy/pcp-daemons-and-similar/Makefile +++ b/selinux-policy/pcp-daemons-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 90m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: pcp" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console glib2 pcp pcp-manager pcp-pmda-dm pcp-webapi" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console glib2 pcp pcp-manager pcp-pmda-dm pcp-webapi" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/pcp-daemons-and-similar/main.fmf b/selinux-policy/pcp-daemons-and-similar/main.fmf index 7e65b9b..d9d0f61 100644 --- a/selinux-policy/pcp-daemons-and-similar/main.fmf +++ b/selinux-policy/pcp-daemons-and-similar/main.fmf @@ -1,72 +1,5 @@ -summary: the services were running as initrc_t, now they are confined by SELinux -description: |+ - SELinux interferes with various PCP services and related programs. +path: /selinux-policy/pcp-daemons-and-similar +summary: SELinux issues related to pcp deamons and related programs +description: | + Test coverage for SELinux AVC issues against pcp and related programs. -contact: jkurik@redhat.com -component: - - selinux-policy - - pcp -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - /usr/sbin/service - - setools-console - - glib2 - - pcp - - pcp-manager - - pcp-pmda-dm - - pcp-webapi -environment: - AVC_ERROR: +no_avc_check -duration: 90m -enabled: true -tag: - - NoRHEL4 - - TIPpass - - TIPpass_Security - - TipWaived7 - - f32friendly - - failinfedora - - targeted - - NoRHIVOS - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1028598 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1061159 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064233 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1072785 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1089912 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1130606 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1130934 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1167825 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1196926 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1203153 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1206525 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1211520 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1213709 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1213740 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1252341 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1261811 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271998 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1286234 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309883 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1379371 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1770123 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1886369 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309454 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0075517 -extra-summary: /CoreOS/selinux-policy/Regression/pcp-daemons-and-similar -extra-task: /CoreOS/selinux-policy/Regression/pcp-daemons-and-similar -id: e59269a3-9556-4441-b60b-2339499689b7 diff --git a/selinux-policy/pcp-daemons-and-similar/runtest.sh b/selinux-policy/pcp-daemons-and-similar/runtest.sh index 69dd098..0b8321c 100755 --- a/selinux-policy/pcp-daemons-and-similar/runtest.sh +++ b/selinux-policy/pcp-daemons-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -70,7 +71,7 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -106,7 +107,7 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" done rlSEMatchPathCon "/var/run/pcp" "pcp_var_run_t" - rlSEMatchPathCon "/var/run/pcp/pmcd.socket" "pcp_var_run_t" + rlSEMatchPathCon "/var/run/pmcd.socket" "pcp_var_run_t" rlSEMatchPathCon "/dev/log" "devlog_t" rlSEMatchPathCon "/dev/mapper/control" "lvm_control_t" rlSEMatchPortCon tcp 4330 dey_sapi_port_t @@ -216,7 +217,7 @@ rlJournalStart rlPhaseStartTest "bz#1286234" rlSEMatchPathCon "/usr/bin/pmlogger" "pcp_pmlogger_exec_t" rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/pcp/pmlogger.primary.socket" "pcp_var_run_t" + rlSEMatchPathCon "/var/run/pmlogger.primary.socket" "pcp_var_run_t" rlSESearchRule "allow pcp_pmlogger_t var_run_t : dir { write add_name } [ ]" rlSESearchRule "type_transition pcp_pmlogger_t var_run_t : lnk_file pcp_var_run_t [ ]" rlSESearchRule "allow pcp_pmlogger_t pcp_var_run_t : lnk_file { create } [ ]" @@ -393,20 +394,12 @@ rlJournalStart rlRun "semodule -l | grep pcp" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" for SERVICE_NAME in pmcd pmie pmlogger pmproxy ; do - if rlIsFedora '>=33' || rlIsRHEL ">=8.1" ; then - rlRun "systemctl enable ${SERVICE_NAME}" - else - rlRun "chkconfig ${SERVICE_NAME} on" - fi + rlRun "chkconfig ${SERVICE_NAME} on" done for TRIPLET in ${TRIPLETSLIST} ; do - if rlIsFedora '<33' || rlIsRHEL "<8" ; then - if ! rlSEDefined "${SEDEFINED}" ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` - fi + if ! rlSEDefined "${SEDEFINED}" ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" else PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` fi @@ -418,15 +411,11 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status" 1 done for TRIPLET in ${TRIPLETSLIST} ; do - if rlIsFedora '<33' || rlIsRHEL "<8" ; then - if ! rlSEDefined "${SEDEFINED}" ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` - fi + if ! rlSEDefined "${SEDEFINED}" ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" else - PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` + PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` fi PROCESS_NAME=`echo ${TRIPLET} | cut -d : -f 4` SERVICE_NAME=${PROCESS_NAME} @@ -436,11 +425,7 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop" 1 done for SERVICE_NAME in pmcd pmie pmlogger pmproxy ; do - if rlIsFedora '>=33' || rlIsRHEL ">=8.1" ; then - rlRun "systemctl disable ${SERVICE_NAME}" - else - rlRun "chkconfig ${SERVICE_NAME} off" - fi + rlRun "chkconfig ${SERVICE_NAME} off" done rlPhaseEnd diff --git a/selinux-policy/perf_event-and-related/Makefile b/selinux-policy/perf_event-and-related/Makefile index 5b736d9..4aaea9a 100644 --- a/selinux-policy/perf_event-and-related/Makefile +++ b/selinux-policy/perf_event-and-related/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf expect openssh-clients /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf expect openssh-clients initscripts" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,7 +64,6 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1901957" >> $(METADATA) # Fedora 34 @echo "Bug: 1901958" >> $(METADATA) # RHEL-8 - @echo "Bug: 2229936" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf index dbeb291..bc46d09 100644 --- a/selinux-policy/perf_event-and-related/main.fmf +++ b/selinux-policy/perf_event-and-related/main.fmf @@ -1,49 +1,3 @@ -summary: Is the perf_event class and its permissions defined? -description: |+ - Description: Is the perf_event class and its permissions defined? Does SELinux allow various perf_event aware programs to work? +path: /selinux-policy/perf_event-and-related +tier: 2 -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - perf - - expect - - openssh-clients - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - failinfedora - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901957 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901958 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2019929 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070982 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2229936 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0609306 -extra-summary: /CoreOS/selinux-policy/Regression/perf_event-and-related -extra-task: /CoreOS/selinux-policy/Regression/perf_event-and-related -id: 3efbd0b9-bc20-4b7a-a253-3bec809d323a diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh index 5b50dec..a971635 100755 --- a/selinux-policy/perf_event-and-related/runtest.sh +++ b/selinux-policy/perf_event-and-related/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -35,7 +36,7 @@ rlJournalStart rlLog "If this test fails, please contact mmalik on IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm perf @@ -64,12 +65,6 @@ rlJournalStart rlSESearchRule "allow sysadm_t sysadm_t : perf_event { open cpu kernel read write } [ ]" rlPhaseEnd - if ! rlIsRHEL "<9.3" && ! rlIsCentOS 8 ; then - rlPhaseStartTest "bz#2229936" - rlSESearchRule "allow sysadm_t kernel_t : bpf { prog_run } [ ]" - rlPhaseEnd - fi - rlPhaseStartTest "real scenario -- perf tool under root" rlRun "perf record -o /dev/null echo test" rlRun "seinfo -c perf_event -x" @@ -77,8 +72,11 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined root sysadm_u" - rlSEConfigureSSH - + rlRun "grep -i permit /etc/ssh/sshd_config" + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + rlRun "service sshd restart" rlRun "setsebool ssh_sysadm_login on" USER_NAME="toor" USER_SECRET="S3kr3t${RANDOM}" diff --git a/selinux-policy/ping-and-similar/main.fmf b/selinux-policy/ping-and-similar/main.fmf index 7f8098f..8d535ce 100644 --- a/selinux-policy/ping-and-similar/main.fmf +++ b/selinux-policy/ping-and-similar/main.fmf @@ -1,50 +1,2 @@ -summary: the service was running as initrc_t or init_t, now it is confined by SELinux -description: |+ - SELinux interferes with ping and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - expect - - openssh-clients - - iputils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoRHEL4 - - TIPpass - - TIPpass_Security - - TierCandidatesPASS - - targeted - - NoRHIVOS -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1552128 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1596065 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1803759 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1810403 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1848929 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070870 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0564077 -extra-summary: /CoreOS/selinux-policy/Regression/ping-and-similar -extra-task: /CoreOS/selinux-policy/Regression/ping-and-similar -id: 993738bc-3b9a-4f3d-9617-fb07484db1cb +path: /selinux-policy/ping-and-similar +tier: 2 diff --git a/selinux-policy/ping-and-similar/runtest.sh b/selinux-policy/ping-and-similar/runtest.sh index 3037afd..83a004f 100755 --- a/selinux-policy/ping-and-similar/runtest.sh +++ b/selinux-policy/ping-and-similar/runtest.sh @@ -27,9 +27,11 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" FILE_PATH="/bin/ping" FILE_CONTEXT="ping_exec_t" SERVICE_PACKAGE="iputils" @@ -38,14 +40,13 @@ PROCESS_CONTEXT="ping_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} rlFileBackup /etc/shadow - rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -115,7 +116,6 @@ rlJournalStart rlSECheckAVC rlFileRestore - rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/policy-rpm-macros/main.fmf b/selinux-policy/policy-rpm-macros/main.fmf index 261c287..498e8f4 100644 --- a/selinux-policy/policy-rpm-macros/main.fmf +++ b/selinux-policy/policy-rpm-macros/main.fmf @@ -1,42 +1,2 @@ -summary: Are necessary RPM macros defined for various policy actions? -description: |+ - Are necessary RPM macros defined for various policy actions? Are they defined correctly? - - More information at: - * https://plautrba.fedorapeople.org/blok/Fedora-SELinux-module-packaging.html - * https://github.com/fedora-selinux/selinux-policy-macros/blob/master/README.adoc - -contact: Milos Malik -component: - - selinux-policy -recommend: - - git - - selinux-policy - - /usr/sbin/semanage -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - f32friendly - - targeted - - NoRHIVOS +path: /selinux-policy/policy-rpm-macros tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1380854 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1415694 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1518609 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1488402 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1633198 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1631814 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1465824 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0546229 -extra-summary: /CoreOS/selinux-policy/Sanity/policy-rpm-macros -extra-task: /CoreOS/selinux-policy/Sanity/policy-rpm-macros -id: c88dfda5-0d87-4538-94d3-45691e3bda33 diff --git a/selinux-policy/policy-rpm-macros/runtest.sh b/selinux-policy/policy-rpm-macros/runtest.sh index 2460ddb..b203b16 100755 --- a/selinux-policy/policy-rpm-macros/runtest.sh +++ b/selinux-policy/policy-rpm-macros/runtest.sh @@ -27,11 +27,11 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" MACRO_FILE="/usr/lib/rpm/macros.d/macros.selinux-policy" -export MACRO_FILE rlJournalStart rlPhaseStartSetup @@ -48,12 +48,20 @@ rlJournalStart rlPhaseStartTest "bz#1415694" rlRun "grep selinuxenabled ${MACRO_FILE}" + rlRun "grep selinuxenabled ${MACRO_FILE} | grep _sbindir" rlRun "grep selinuxenabled ${MACRO_FILE} | grep /usr/sbin/" 1 rlPhaseEnd - # originally test from https://github.com/fedora-selinux/selinux-policy-macros - # now shipped with this test - ./selinux-policy-macros.runtest.sh + rlPhaseStartTest "download and prepare the upstream test" + rlRun "git clone https://github.com/fedora-selinux/selinux-policy-macros.git" + rlRun "rm -f selinux-policy-macros/macros.selinux-policy" + rlRun "cp /usr/lib/rpm/macros.d/macros.selinux-policy selinux-policy-macros/" + rlPhaseEnd + + pushd selinux-policy-macros + # running an upstream test written by Petr Lautrbach, thanks + ./runtest.sh + popd rlPhaseStartCleanup rlRun "rm -rf selinux-policy-macros" diff --git a/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh b/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh deleted file mode 100755 index 7ae2d68..0000000 --- a/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh +++ /dev/null @@ -1,262 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of ipp -# Description: Tests for IPP scriptlets -# Author: Petr Lautrbach -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (C) 2017 Red Hat, Inc. All rights reserved. -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include the BeakerLib environment -. /usr/share/beakerlib/beakerlib.sh - -# Set SELinux store -if rlIsRHEL "<=7" || rlIsCentOS "<=7"; then - SELINUXSTOREPATH=/etc/selinux -else - SELINUXSTOREPATH=/var/lib/selinux -fi - -# Set the full test name -TEST="IPP" - -# Package being tested -PACKAGE="IPP" - -MACRO_FILE=${MACRO_FILE:-/usr/lib/rpm/macros.d/macros.selinux-policy} - -set_booleans() { - rlRun "rpm --eval '%selinux_set_booleans -s targeted $*' > run_selinux_set_booleans.sh" 0 - rlRun "bash run_selinux_set_booleans.sh" -} - -unset_booleans() { - rlRun "rpm --eval '%selinux_unset_booleans -s targeted $*' > run_selinux_unset_booleans.sh" 0 - rlRun "bash run_selinux_unset_booleans.sh" -} - - -rlJournalStart - rlPhaseStartSetup "Setup" - rlRun "rlFileBackup --clean ~/.rpmmacros" 0,1 "Backing up ~/.rpmmacros" - rlRun "sed 's|SELINUXSTOREPATH|$SELINUXSTOREPATH|' ${MACRO_FILE} >> ~/.rpmmacros" 0 "Updating ~/.rpmmacros" - rlRun "rlFileBackup --clean ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0,1 "Backing up ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0,1 "Updating ~/.rpmmacros" - rlRun 'TmpDir=$(mktemp -d)' 0 - pushd $TmpDir - rlRun "semanage boolean -E > boolean.import" 0 "Backup local boolean modifications" - rlRun "semanage boolean -D" 0 "Drop local boolean modifications" - rlPhaseEnd - - rlPhaseStartTest "Test install on a clean system" - set_booleans secure_mode=1 secure_mode_insmod=1 - - rlRun "semanage boolean -E > boolean.local" - # test if local changes are applied - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" - # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty - rlAssertNotGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlPhaseEnd - - rlPhaseStartTest "Test uninstall on a clean system" - unset_booleans secure_mode=0 secure_mode_insmod=0 - - # test if local changes are removed - rlRun "semanage boolean -E > boolean.local" - rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" - rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" - rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" - rlRun "semanage boolean -D" 0 "cleanup" - rlPhaseEnd - - rlPhaseStartTest "Test install on a system with secure_mode is already on" - rlRun "semanage boolean -m --on secure_mode" 0 "Setting secure_mode=on" - - set_booleans secure_mode=1 secure_mode_insmod=1 - - rlRun "semanage boolean -E > boolean.local" - # test if local changes are applied - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" - # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty - rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlPhaseEnd - - rlPhaseStartTest "Test uninstall on a system where secure_mode was on before install" - - unset_booleans secure_mode=0 secure_mode_insmod=0 - - # test if local changes are removed - rlRun "semanage boolean -E > boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" - rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - - rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" - rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" - rlRun "semanage boolean -D" 0 "cleanup" - - rlPhaseEnd - - rlPhaseStartTest "Test install on a system with secure_mode was changed to off" - rlRun "semanage boolean -m --off secure_mode" 0 "Setting secure_mode=on" - - set_booleans secure_mode=1 secure_mode_insmod=1 - - rlRun "semanage boolean -E > boolean.local" - # test if local changes are applied - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" - # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty - rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlPhaseEnd - - rlPhaseStartTest "Test uninstall on a system where secure_mode was on before install" - - unset_booleans secure_mode=0 secure_mode_insmod=0 - - # test if local changes are removed - rlRun "semanage boolean -E > boolean.local" - rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode' "boolean.local" - rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local" - rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - - rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" - rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" - rlRun "semanage boolean -D" 0 "cleanup" - - rlPhaseEnd - -# ============ Install twice, remove once ====================== - - rlPhaseStartTest "Test install twice on a clean system" - set_booleans secure_mode=1 secure_mode_insmod=1 - set_booleans secure_mode=1 ssh_sysadm_login=1 - - rlRun "semanage boolean -E > boolean.local" - # test if local changes are applied - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) ssh_sysadm_login' "boolean.local" - # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty - rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertNotGrep '\(-1\|--on\) ssh_sysadm_login' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlPhaseEnd - - rlPhaseStartTest "Test uninstall once after install twice" - unset_booleans secure_mode=0 secure_mode_insmod=0 - - # test if local changes are removed - rlRun "semanage boolean -E > boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) ssh_sysadm_login' "boolean.local" - rlAssertGrep 'secure_mode$' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertGrep 'ssh_sysadm_login' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" - rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" - rlRun "semanage boolean -m --off ssh_sysadm_login" 0 "cleanup" - rlRun "semanage boolean -D" 0 "cleanup" - rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0 "cleanup" - rlPhaseEnd - - rlPhaseStartTest "Test install twice on a system with secure_mode is already on" - rlRun "semanage boolean -m --on secure_mode" 0 "Setting secure_mode=on" - - set_booleans secure_mode=1 secure_mode_insmod=1 - set_booleans secure_mode=1 - - rlRun "semanage boolean -E > boolean.local" - # test if local changes are applied - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" - # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty - rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlPhaseEnd - - rlPhaseStartTest "Test uninstall once after install twice on a system where secure_mode was on before install" - - unset_booleans secure_mode=0 secure_mode_insmod=0 - - # test if local changes are removed - rlRun "semanage boolean -E > boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local" - rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - - rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" - rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" - rlRun "semanage boolean -D" 0 "cleanup" - rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0 "cleanup" - - rlPhaseEnd - - rlPhaseStartTest "Test install twice on a system with secure_mode was changed to off" - rlRun "semanage boolean -m --off secure_mode" 0 "Setting secure_mode=on" - - set_booleans secure_mode=1 secure_mode_insmod=1 - set_booleans secure_mode=1 - - rlRun "semanage boolean -E > boolean.local" - # test if local changes are applied - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" - # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty - rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlPhaseEnd - - rlPhaseStartTest "Test uninstall once after install twice on a system where secure_mode was off before install" - - unset_booleans secure_mode=0 secure_mode_insmod=0 - - # test if local changes are removed - rlRun "semanage boolean -E > boolean.local" - rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" - rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local" - rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" - - rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" - rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" - rlRun "semanage boolean -D" 0 "cleanup" - rlPhaseEnd - - rlPhaseStartCleanup "Cleanup" - rlRun "semanage boolean -D" 0 "Clean all boolean changes" - rlRun "semanage import < boolean.import" 0 "Import local boolean modifications back" - popd - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlRun "rlFileRestore" - rlPhaseEnd - -rlJournalEnd - -# Print the test report -rlJournalPrintText diff --git a/selinux-policy/policykit-general/Makefile b/selinux-policy/policykit-general/Makefile deleted file mode 100644 index 0309190..0000000 --- a/selinux-policy/policykit-general/Makefile +++ /dev/null @@ -1,77 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/policykit-general -# Description: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd) -# Author: Michal Trunecka -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/policykit-general -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh ssh.exp - chcon -t bin_t runtest.sh ssh.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Michal Trunecka " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd)" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 20m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: polkit" >> $(METADATA) - @echo "Requires: audit selinux-policy polkit glib2 libselinux libselinux-utils policycoreutils setools-console psmisc shadow-utils expect openssh-clients" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) - @echo "Bug: 960669" >> $(METADATA) # RHEL-7 - @echo "Bug: 962791" >> $(METADATA) # RHEL-7 - @echo "Bug: 965143" >> $(METADATA) # RHEL-7 - @echo "Bug: 1003799" >> $(METADATA) # RHEL-6 - @echo "Bug: 1301561" >> $(METADATA) # RHEL-6 - @echo "Bug: 1364513" >> $(METADATA) # RHEL-7 - @echo "Bug: 1574389" >> $(METADATA) # RHEL-7 - @echo "Bug: 1583082" >> $(METADATA) # RHEL-7 - @echo "Bug: 1727902" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/policykit-general/PURPOSE b/selinux-policy/policykit-general/PURPOSE deleted file mode 100644 index 98cfd05..0000000 --- a/selinux-policy/policykit-general/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/policykit-general -Author: Michal Trunecka - -SELinux interferes with polkitd and related programs. - diff --git a/selinux-policy/policykit-general/main.fmf b/selinux-policy/policykit-general/main.fmf deleted file mode 100644 index 897de7c..0000000 --- a/selinux-policy/policykit-general/main.fmf +++ /dev/null @@ -1,61 +0,0 @@ -summary: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd) -description: |+ - SELinux interferes with polkitd and related programs. - -contact: Milos Malik -component: - - polkit - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - selinux-policy - - polkit - - glib2 - - libselinux - - libselinux-utils - - policycoreutils - - setools-console - - psmisc - - shadow-utils - - expect - - openssh-clients -environment: - AVC_ERROR: +no_avc_check -duration: 20m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - TIPpass - - TIPpass_FIPS - - TIPpass_Security - - TipWaived7 - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=960669 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=962791 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=965143 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1003799 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1301561 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1364513 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574389 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1583082 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1727902 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0267065 -extra-summary: /CoreOS/selinux-policy/Regression/policykit-general -extra-task: /CoreOS/selinux-policy/Regression/policykit-general -id: f021b6cd-fc34-4335-b7e0-ed0254ed333e diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh deleted file mode 100755 index 79fa26e..0000000 --- a/selinux-policy/policykit-general/runtest.sh +++ /dev/null @@ -1,182 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/policykit-general -# Description: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd) -# Author: Michal Trunecka -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -SERVICE_NAME="polkit" -SERVICE_PACKAGE="polkit" -PROCESS_NAME="polkitd" -PROCESS_CONTEXT="policykit_t" -if rlIsRHEL 6 7 ; then - ALLOWED_USERS="staff_u user_u xguest_u sysadm_u unconfined_u" -else - ALLOWED_USERS="staff_u user_u guest_u xguest_u sysadm_u unconfined_u" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlSEConfigureSSH - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#960669 + bz#962791 + bz#965143" - if rlIsRHEL 6 ; then - rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" - else - rlSEMatchPathCon "/usr/lib/polkit-1/polkitd" "policykit_exec_t" - rlSESearchRule "allow policykit_t cgroup_t : dir { open read getattr lock search ioctl }" - fi - rlSESearchRule "allow initrc_t policykit_exec_t : file { getattr open read execute }" - rlSESearchRule "type_transition initrc_t policykit_exec_t : process policykit_t" - rlSESearchRule "allow initrc_t policykit_t : process { transition }" - rlSESearchRule "allow system_dbusd_t policykit_exec_t : file { getattr open read execute }" - rlSESearchRule "type_transition system_dbusd_t policykit_exec_t : process policykit_t" - rlSESearchRule "allow system_dbusd_t policykit_t : process { transition }" - rlPhaseEnd - - rlPhaseStartTest "bz#1003799" - if rlIsRHEL 6 ; then - rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" - else - rlSEMatchPathCon "/usr/lib/polkit-1/polkitd" "policykit_exec_t" - fi - rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" - rlSESearchRule "allow policykit_t sssd_var_lib_t : dir { getattr open search }" - rlSESearchRule "allow policykit_t sssd_public_t : dir { getattr open search }" - rlSESearchRule "allow policykit_t sssd_public_t : file { getattr open read }" - rlSESearchRule "allow policykit_t sssd_var_lib_t : sock_file { getattr open write }" - rlSESearchRule "allow policykit_t sssd_t : unix_stream_socket { connectto }" - rlPhaseEnd - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest "bz#1301561" - rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" - rlSESearchRule "allow policykit_t fs_t : filesystem { getattr }" - rlPhaseEnd - fi - - DESTINATION="org.freedesktop.PolicyKit1" - if busctl | grep -iq ${DESTINATION} ; then - rlPhaseStartTest "real scenario -- DBus service" - rlRun "killall polkitd" 0,1 - sleep 1 - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" - sleep 1 - rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" - rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1364513" - rlSESearchRule "allow dhcpc_t policykit_t : dbus { send_msg }" - rlSESearchRule "allow policykit_t dhcpc_t : dbus { send_msg }" - rlPhaseEnd - - rlPhaseStartTest "bz#1574389 + bz#1583082" - rlSEMatchPathCon "/usr/bin/pkla-check-authorization" "policykit_auth_exec_t" - rlSESearchRule "allow policykit_t policykit_auth_exec_t : file { map } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1727902" - rlSEMatchPathCon "/run/dbus" "system_dbusd_var_run_t" - rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t" - rlSESearchRule "allow guest_t system_dbusd_var_run_t : dir { search } [ ]" - rlSESearchRule "allow guest_t system_dbusd_var_run_t : sock_file { write } [ ]" - rlSESearchRule "allow guest_t system_dbusd_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow guest_t policykit_t : dbus { send_msg } [ ]" - rlSESearchRule "allow policykit_t guest_t : dbus { send_msg } [ ]" - rlSESearchRule "allow guest_t system_dbusd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow system_dbusd_t guest_t : dbus { send_msg } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- confined users" - CREATED_USERS="" - rlRun "setsebool ssh_sysadm_login on" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "restorecon -Rv /home/${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost pkaction" - sleep 2 - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" - done - rlRun "setsebool ssh_sysadm_login off" - for USER_NAME in ${CREATED_USERS} ; do - rlRun "userdel -rfZ ${USER_NAME}" - done - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/policykit-general/ssh.exp b/selinux-policy/policykit-general/ssh.exp deleted file mode 100755 index 1244013..0000000 --- a/selinux-policy/policykit-general/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname "$command ; sleep 5" -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/power-profiles-daemon-and-similar/Makefile b/selinux-policy/power-profiles-daemon-and-similar/Makefile deleted file mode 100644 index 430f31e..0000000 --- a/selinux-policy/power-profiles-daemon-and-similar/Makefile +++ /dev/null @@ -1,72 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar -# Description: SELinux interferes with power-profiles-daemon and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with power-profiles-daemon and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: power-profiles-daemon" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console power-profiles-daemon python3-gobject-base /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: RHEL-61117" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-62356" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-100718" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-105423" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/power-profiles-daemon-and-similar/PURPOSE b/selinux-policy/power-profiles-daemon-and-similar/PURPOSE deleted file mode 100644 index e6ef280..0000000 --- a/selinux-policy/power-profiles-daemon-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar -Author: Milos Malik - -SELinux interferes with power-profiles-daemon and related programs. - diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf deleted file mode 100644 index e028f53..0000000 --- a/selinux-policy/power-profiles-daemon-and-similar/main.fmf +++ /dev/null @@ -1,47 +0,0 @@ -summary: SELinux interferes with power-profiles-daemon and related programs -description: |+ - SELinux interferes with power-profiles-daemon and related programs. - -contact: Milos Malik -component: - - selinux-policy - - power-profiles-daemon -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - python3-gobject-base - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-61117 - - verifies: https://issues.redhat.com/browse/RHEL-62356 - - verifies: https://issues.redhat.com/browse/RHEL-100718 - - verifies: https://issues.redhat.com/browse/RHEL-105423 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-10, centos-stream-10 - because: the power-profiles-daemon package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar -extra-task: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar -extra-nitrate: TC#0617900 -id: 8cbc1f54-edde-4301-a19e-3a4cfe29920d diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh deleted file mode 100755 index 692df51..0000000 --- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh +++ /dev/null @@ -1,132 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar -# Description: SELinux interferes with power-profiles-daemon and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/libexec/power-profiles-daemon" -SERVICE_PACKAGE="power-profiles-daemon" -SERVICE_NAME="power-profiles-daemon" -PROCESS_NAME="power-profiles-daemon" -if seinfo -t | grep -q powerprofile ; then - PROCESS_CONTEXT="powerprofiles_t" - FILE_CONTEXT="powerprofiles_exec_t" -else - PROCESS_CONTEXT="unconfined_service_t" - FILE_CONTEXT="bin_t" -fi - -rlJournalStart - if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - if rpm -q tuned-ppd ; then - rlRun "yum -y remove tuned-ppd" - fi - rlRun "yum -y install ${SERVICE_PACKAGE}" - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -qf ${FILE_PATH}" - - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ( rlIsRHEL 9 && rlIsRHEL ">9.5" ) || rlIsCentOS 9 ; then - rlPhaseStartTest "RHEL-61117" - rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} - rlSESearchRule "allow powerprofiles_t powerprofiles_t : capability2 { bpf } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL '<9.7'; then - rlPhaseStartTest "RHEL-100718" - if [ -d /sys/devices/system/cpu/cpufreq ] ; then - for CUR_FILE in `find /sys/devices/system/cpu/cpufreq -type f -name energy_performance_preference` ; do - CUR_TYPE=`secon --type --file ${CUR_FILE}` - rlSESearchRule "allow powerprofiles_t $CUR_TYPE : file { write } [ ]" - done - fi - rlSESearchRule "allow powerprofiles_t fs_t : filesystem { getattr } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "RHEL-105423" - if [ -d /sys/firmware/acpi ] ; then - rlRun "ls -dZ /sys/firmware/acpi | grep :sysfs_t" - rlRun "ls -lZ /sys/firmware/acpi" - fi - rlSESearchRule "allow powerprofiles_t sysfs_t : dir { watch } [ ]" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "powerprofilesctl list" - rlRun "powerprofilesctl list-holds" - rlRun "powerprofilesctl version" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - if ! rlIsRHEL '<9.7' ; then - ORIG_PROFILE=`powerprofilesctl get` - if echo ${ORIG_PROFILE} | grep -q balanced ; then - rlRun "powerprofilesctl set power-saver" 0,1 - else - rlRun "powerprofilesctl set balanced" 0,1 - fi - sleep 2 - rlRun "powerprofilesctl get" - rlRun "powerprofilesctl set ${ORIG_PROFILE}" - sleep 2 - else - rlRun "powerprofilesctl get" - fi - rlRun "powerprofilesctl launch echo" 0,1 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/qat-service-and-similar/main.fmf b/selinux-policy/qat-service-and-similar/main.fmf deleted file mode 100644 index 0accdbb..0000000 --- a/selinux-policy/qat-service-and-similar/main.fmf +++ /dev/null @@ -1,49 +0,0 @@ -summary: SELinux interferes with qatlib and related programs -description: |+ - SELinux interferes with qatlib and related programs. - -contact: Milos Malik -component: - - qatlib - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - qatlib - - qatlib-service - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-211077 - - verifies: https://issues.redhat.com/browse/RHEL-211089 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the qatlib package is not available there - - enabled: false - when: arch == aarch64, ppc64le, s390x - because: the qatlib package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/qat-service-and-similar -extra-task: /CoreOS/selinux-policy/Regression/qat-service-and-similar - diff --git a/selinux-policy/qat-service-and-similar/runtest.sh b/selinux-policy/qat-service-and-similar/runtest.sh deleted file mode 100755 index f52788b..0000000 --- a/selinux-policy/qat-service-and-similar/runtest.sh +++ /dev/null @@ -1,88 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/qat-service-and-similar -# Description: SELinux interferes qatlib and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2026 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, see -# . -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/bin/qat_init.sh" -SERVICE_NAME="qat" -PROCESS_NAME="qat_init.sh" -if seinfo -t | grep -q qatlib ; then - FILE_CONTEXT="qatlib_exec_t" - PROCESS_CONTEXT="qatlib_t" -else - FILE_CONTEXT="bin_t" - PROCESS_CONTEXT="unconfined_service_t" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -qf ${FILE_PATH}" - - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined ${PROCESS_CONTEXT} ; then - rlPhaseStartTest "RHEL-211077" - rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} - rlSEMatchPathCon "/dev/hugepages" "hugetlbfs_t" - rlSESearchRule "allow qatlib_t hugetlbfs_t : dir { getattr } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-211089" - rlSEMatchPathCon "/dev/hugepages/qat" "hugetlbfs_t" - rlSESearchRule "allow qatlib_t hugetlbfs_t : dir { search create add_name write setattr } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status" 1 - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/restorecond-fcontext-equivalences/main.fmf b/selinux-policy/restorecond-fcontext-equivalences/main.fmf deleted file mode 100644 index a568133..0000000 --- a/selinux-policy/restorecond-fcontext-equivalences/main.fmf +++ /dev/null @@ -1,32 +0,0 @@ -summary: the restorecond service honors fcontext equivalences -description: | - The restorecond service mislabels files when fcontext equivalences - (shipped by the selinux-policy component) are not configured properly. -test: ./test.sh -framework: beakerlib -contact: Milos Malik -component: - - selinux-policy -recommend: - - selinux-policy - - policycoreutils - - policycoreutils-restorecond - - /usr/sbin/service -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS - - avoidImageMode -link: - - verifies: https://issues.redhat.com/browse/RHEL-5032 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0615936 -id: 14b57b44-c644-48fb-a3a1-b4c57da675a6 diff --git a/selinux-policy/restorecond-fcontext-equivalences/test.sh b/selinux-policy/restorecond-fcontext-equivalences/test.sh deleted file mode 100755 index c49bdd4..0000000 --- a/selinux-policy/restorecond-fcontext-equivalences/test.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm selinux-policy - rlAssertRpm policycoreutils-restorecond - rlServiceStop restorecond - rlFileBackup /etc/selinux/restorecond.conf - # add locations which are in fact symlinks - rlRun "echo -en '\n/bin/*\n/sbin/*\n/lib/*\n/lib64/*\n' >> /etc/selinux/restorecond.conf" - rlPhaseEnd - - if ! rlIsRHEL "<9.4" ; then - rlPhaseStartTest "RHEL-5032" - rlRun "service restorecond start" - rlRun "service restorecond status" - rlRun -s "restorecon -Rv /usr/bin /usr/sbin /usr/lib /usr/lib64" - rlRun "grep -i 'relabeled.*from.*to' $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlRun "service restorecond stop" - rlPhaseEnd - fi - - rlPhaseStartCleanup - rlFileRestore - rlServiceRestore restorecond - rlPhaseEnd -rlJournalEnd - diff --git a/selinux-policy/rhsmcertd-and-similar/main.fmf b/selinux-policy/rhsmcertd-and-similar/main.fmf deleted file mode 100644 index 283c71f..0000000 --- a/selinux-policy/rhsmcertd-and-similar/main.fmf +++ /dev/null @@ -1,28 +0,0 @@ -summary: Test that rhsmcertd have access to gconf_home_t site-packages -description: |+ - rhsmcertd is denied read access to /root/.local/lib/pythonX.Y/site-packages/ - which has gconf_home_t context. This occurs when user runs 'pip install --user' from root. - -contact: Veronika Syncakova -component: - - selinux-policy -require: - - library(selinux-policy/common) -recommend: - - audit - - selinux-policy - - python3 - - python3-pip -duration: 15m -enabled: true -tag: - - NoRHEL7 - - NoRHEL8 -environment: - AVC_ERROR: +no_avc_check -link: - - verifies: https://redhat.atlassian.net/browse/RHEL-106483 -adjust+: - - enabled: false - when: distro < rhel-9 - continue: false diff --git a/selinux-policy/rhsmcertd-and-similar/runtest.sh b/selinux-policy/rhsmcertd-and-similar/runtest.sh deleted file mode 100755 index 82942d5..0000000 --- a/selinux-policy/rhsmcertd-and-similar/runtest.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k - -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0 - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - - rlSESetTimestamp - - # Install required packages - rlRun "dnf install -y python3-pip" 0 - rlFileBackup --clean /root/.local - rlPhaseEnd - - rlPhaseStartTest "RHEL-106483" - # Create /root/.local/lib/pythonX.Y/site-packages/ with gconf_home_t context - rlRun "pip3 install --user abcd" 0 "pip install creates site-packages" - SITE_PACKAGES=$(find /root/.local/lib -type d -name "site-packages" 2>/dev/null | head -1) - rlAssertExists "${SITE_PACKAGES}" - - # Set SELinux to permissive to log AVCs without blocking - rlRun "setenforce 0" 0 "Set SELinux to permissive mode" - rlRun "runcon -t rhsmcertd_t -r system_r -u system_u -- /usr/bin/python3 -c 'import sys'" 0 - rlPhaseEnd - - rlPhaseStartCleanup - # Restore backed up files (removes /root/.local if it didn't exist before) - rlFileRestore - rlSECheckAVC --ignore 'type=AVC .* entrypoint .*runcon .*:rhsmcertd_t:' - # Restore SELinux to enforcing mode - rlRun "setenforce 1" 0 "Restore SELinux to enforcing mode" - - rlPhaseEnd - -rlJournalEnd diff --git a/selinux-policy/rngd-and-similar/Makefile b/selinux-policy/rngd-and-similar/Makefile deleted file mode 100644 index e4d0031..0000000 --- a/selinux-policy/rngd-and-similar/Makefile +++ /dev/null @@ -1,93 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/rngd-and-similar -# Description: SELinux interferes with rngd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/rngd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with rngd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: rng-tools" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console rng-tools /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 869810" >> $(METADATA) # Fedora 18 - @echo "Bug: 869813" >> $(METADATA) # Fedora 18 - @echo "Bug: 1451735" >> $(METADATA) # RHEL-7 - @echo "Bug: 1452629" >> $(METADATA) # RHEL-7 - @echo "Bug: 1496260" >> $(METADATA) # RHEL-7 - @echo "Bug: 1609466" >> $(METADATA) # RHEL-7 - @echo "Bug: 1611413" >> $(METADATA) # RHEL-7 - @echo "Bug: 1612456" >> $(METADATA) # RHEL-7 - @echo "Bug: 1653872" >> $(METADATA) # RHEL-8 - @echo "Bug: 1655079" >> $(METADATA) # RHEL-8 - @echo "Bug: 1656054" >> $(METADATA) # RHEL-8 - @echo "Bug: 1657250" >> $(METADATA) # RHEL-8 - @echo "Bug: 1658234" >> $(METADATA) # RHEL-8 - @echo "Bug: 1698575" >> $(METADATA) # RHEL-8 - @echo "Bug: 1699278" >> $(METADATA) # RHEL-8 - @echo "Bug: 1700222" >> $(METADATA) # RHEL-8 - @echo "Bug: 1787663" >> $(METADATA) # Fedora 32 - @echo "Bug: 1789902" >> $(METADATA) # Fedora 32 - @echo "Bug: 1787661" >> $(METADATA) # Fedora 32 - @echo "Bug: 1928572" >> $(METADATA) # Fedora 33 - @echo "Bug: 1929360" >> $(METADATA) # Fedora 33 - @echo "Bug: 1929366" >> $(METADATA) # Fedora 33 - @echo "Bug: 2058914" >> $(METADATA) # Fedora 36 - @echo "Bug: 2076641" >> $(METADATA) # RHEL-8 - @echo "Bug: 2076642" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/rngd-and-similar/PURPOSE b/selinux-policy/rngd-and-similar/PURPOSE deleted file mode 100644 index 8c46dd0..0000000 --- a/selinux-policy/rngd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/rngd-and-similar -Author: Milos Malik - -SELinux interferes with rngd and related programs. - diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf deleted file mode 100644 index 3afd2ad..0000000 --- a/selinux-policy/rngd-and-similar/main.fmf +++ /dev/null @@ -1,77 +0,0 @@ -summary: SELinux interferes with rngd and related programs -description: |+ - SELinux interferes with rngd and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - rng-tools - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass - - TIPpass_Security - - TierCandidatesPASS - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=869810 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=869813 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1451735 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1452629 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1496260 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1609466 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1611413 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1612456 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1653872 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1655079 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1656054 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1657250 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1658234 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1698575 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699278 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700222 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1787663 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1789902 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1787661 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928572 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929360 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929366 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1931450 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2058914 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076641 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076642 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false - - enabled: false - when: arch == aarch64, s390x - continue: false -extra-nitrate: TC#0300433 -extra-summary: /CoreOS/selinux-policy/Regression/rngd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/rngd-and-similar -id: 604042eb-81de-4ede-808c-8e6cc38cdd15 diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh deleted file mode 100755 index 1987510..0000000 --- a/selinux-policy/rngd-and-similar/runtest.sh +++ /dev/null @@ -1,198 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/rngd-and-similar -# Description: SELinux interferes with rngd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/sbin/rngd" -FILE_CONTEXT="rngd_exec_t" -SERVICE_PACKAGE="rng-tools" -SERVICE_NAME="rngd" -PROCESS_NAME="rngd" -PROCESS_CONTEXT="rngd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlFileBackup /etc/sysconfig/rngd - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" - rlPhaseEnd - - rlPhaseStartTest "bz#869810 + bz#869813" - rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" - rlRun "ls -Z /proc | grep :proc_t" - rlRun "ls -Z /proc/sys | grep :sysctl_t" - rlRun "ls -Z /proc/sys/kernel | grep :sysctl_kernel_t" - rlRun "ls -Z /proc/sys/kernel/random | grep :sysctl_kernel_t" - rlRun "ls -Z /proc/sys/kernel/random/poolsize | grep :sysctl_kernel_t" - rlSESearchRule "allow rngd_t proc_t : dir { getattr open search }" - rlSESearchRule "allow rngd_t sysctl_t : dir { getattr open search }" - rlSESearchRule "allow rngd_t sysctl_kernel_t : dir { getattr open search }" - rlSESearchRule "allow rngd_t sysctl_kernel_t : file { getattr open read }" - rlPhaseEnd - - rlPhaseStartTest "bz#1451735 + bz#1452629" - rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" - rlSESearchRule "allow rngd_t sysfs_t : dir { getattr open search }" - rlSESearchRule "allow rngd_t sysfs_t : file { getattr open read }" - rlPhaseEnd - - rlPhaseStartTest "bz#1496260" - rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" - rlSEMatchPathCon "/dev/ttyUSB0" "usbtty_device_t" - rlSESearchRule "allow rngd_t usbtty_device_t : chr_file { getattr open read }" - rlPhaseEnd - - rlPhaseStartTest "bz#1609466 + bz#1611413 + bz#1612456" - rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" - rlSEMatchPathCon "/etc/pki" "cert_t" - rlSEMatchPathCon "/etc/pki/tls" "cert_t" - rlSEMatchPathCon "/etc/pki/tls/legacy-settings" "cert_t" - rlSESearchRule "allow rngd_t cert_t : dir { getattr open search }" - rlSESearchRule "allow rngd_t cert_t : file { getattr open read }" - rlPhaseEnd - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1653872 + bz#1655079 + bz#1657250 + bz#1658234" - rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" - rlSESearchRule "allow rngd_t rngd_t : process { setsched } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1656054" - rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" - rlRun "ls -Z /proc/cpuinfo | grep :proc_t" - rlSESearchRule "allow rngd_t proc_t : file { getattr open read } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1698575 + bz#1699278 + bz#1700222" - rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" - rlRun "ls -Z /proc/sys/kernel/random/write_wakeup_threshold | grep :sysctl_kernel_t" - rlSESearchRule "allow rngd_t sysctl_kernel_t : file { write } [ ]" - rlPhaseEnd - fi - - if rlIsFedora ; then - rlPhaseStartTest "bz#1787661 + bz#1787663 + bz#1789902" - rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" - rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" - rlSESearchRule "allow rngd_t passwd_file_t : file { getattr open read } [ ]" - rlSESearchRule "allow rngd_t sssd_public_t : dir { search } [ ]" - rlSESearchRule "allow rngd_t sssd_public_t : file { getattr open read map } [ ]" - rlSESearchRule "allow rngd_t sssd_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow rngd_t sssd_var_lib_t : dir { search } [ ]" - rlSESearchRule "allow rngd_t sssd_var_lib_t : sock_file { getattr open write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1928572 + bz#1929360 + bz#1929366" - rlSEMatchPathCon "/sys" "sysfs_t" - rlSESearchRule "allow rngd_t sysfs_t : filesystem { getattr } [ ]" - rlPhaseEnd - fi - - DROP_PRIV=false - if rngd --help | grep -qi 'drop.*priv' ; then - DROP_PRIV=true - rlPhaseStartTest "bz#2076641 + bz#2076642" - rlSESearchRule "allow rngd_t rngd_t : capability { setgid setuid } [ ]" - rlSESearchRule "allow rngd_t rngd_t : process { setcap } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - rlRun "modprobe tpm-rng" 0,1 - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - if rlIsRHEL 5 6 ; then - PROCESS_CONTEXT="initrc_t" - else - PROCESS_CONTEXT="unconfined_service_t" - fi - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "setsebool daemons_use_tty on" - rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rngd -l'" 0-255 - rlRun "setsebool daemons_use_tty off" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - if ${DROP_PRIV} ; then - rlLog "modifying the /etc/sysconfig/rngd file" - if ! grep -q '^RNGD_ARGS.*daemon:daemon' /etc/sysconfig/rngd ; then - sed -i 's/^\(RNGD_ARGS=.*\)"$/\1 -D daemon:daemon"/' /etc/sysconfig/rngd - fi - if ! grep -q '^RNGD_ARGS.*jitter' /etc/sysconfig/rngd ; then - sed -i 's/^\(RNGD_ARGS=.*\)"$/\1 -x jitter"/' /etc/sysconfig/rngd - fi - fi - rlRun "grep ^RNGD_ARGS= /etc/sysconfig/rngd" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/rpc.idmapd-and-similar/Makefile b/selinux-policy/rpc.idmapd-and-similar/Makefile deleted file mode 100644 index 4ed9dbb..0000000 --- a/selinux-policy/rpc.idmapd-and-similar/Makefile +++ /dev/null @@ -1,67 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar -# Description: SELinux interferes with rpc.idmapd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with rpc.idmapd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service nfs-utils" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/selinux-policy/rpc.idmapd-and-similar/PURPOSE b/selinux-policy/rpc.idmapd-and-similar/PURPOSE deleted file mode 100644 index f64abec..0000000 --- a/selinux-policy/rpc.idmapd-and-similar/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar -Description: SELinux interferes with rpc.idmapd and related programs -Author: Milos Malik - diff --git a/selinux-policy/rpc.idmapd-and-similar/main.fmf b/selinux-policy/rpc.idmapd-and-similar/main.fmf deleted file mode 100644 index 8a84ff9..0000000 --- a/selinux-policy/rpc.idmapd-and-similar/main.fmf +++ /dev/null @@ -1,42 +0,0 @@ -summary: SELinux interferes with rpc.idmapd and related programs -description: |+ - SELinux interferes with rpc.idmapd and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - nfs-utils - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - failinfedora - - NoRHIVOS -tier: 3 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar -extra-nitrate: TC#0614824 -id: d96b0115-5a88-4aaf-b26b-1572a9c816b6 diff --git a/selinux-policy/rpc.idmapd-and-similar/runtest.sh b/selinux-policy/rpc.idmapd-and-similar/runtest.sh deleted file mode 100755 index 10fed7c..0000000 --- a/selinux-policy/rpc.idmapd-and-similar/runtest.sh +++ /dev/null @@ -1,95 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar -# Description: SELinux interferes with rpc.idmapd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/rpc.idmapd" -FILE_CONTEXT="rpcd_exec_t" -SERVICE_PACKAGE="nfs-utils" -SERVICE_NAME="nfs-idmapd" -PROCESS_NAME="rpc.idmapd" -PROCESS_CONTEXT="rpcd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/rpm-cant-read-rpmmacros/main.fmf b/selinux-policy/rpm-cant-read-rpmmacros/main.fmf deleted file mode 100644 index db0b6eb..0000000 --- a/selinux-policy/rpm-cant-read-rpmmacros/main.fmf +++ /dev/null @@ -1,42 +0,0 @@ -summary: setroubleshootd process should not cause an AVC when trying to read /root/.rpmmacros -description: |+ - setroubleshootd process should not cause an AVC when trying to read /root/.rpmmacros - -contact: Veronika Syncakova -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy - - setroubleshoot-server -recommend: - - audit - - libselinux - - selinux-policy - - selinux-policy-targeted -environment: - AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -tier: 2 -link: - - verifies: https://issues.redhat.com/browse/RHEL-147470 - - verifies: https://issues.redhat.com/browse/RHEL-142548 -adjust+: - - enabled: false - when: distro < rhel-9.9 - continue: false - because: RHEL-147470 is fixed in RHEL-9.9 and RHEL-142548 in RHEL-10.3 diff --git a/selinux-policy/rpm-cant-read-rpmmacros/runtest.sh b/selinux-policy/rpm-cant-read-rpmmacros/runtest.sh deleted file mode 100755 index 2f75068..0000000 --- a/selinux-policy/rpm-cant-read-rpmmacros/runtest.sh +++ /dev/null @@ -1,61 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of selinux-policy/rpm-cant-read-rpmmacros -# Description: setroubleshootd process should not cause an AVC when trying to read /root/.rpmmacros -# Author: Veronika Syncakova -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2026 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="setroubleshoot-server" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlAssertRpm ${PACKAGE} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - rlRun "rlFileBackup --clean /root/.rpmmacros" - rlPhaseEnd - - rlPhaseStartTest "RHEL-142548 + RHEL-147470" - # check that sedispatch is running and therefore setroubleshoot-server is installed - rlRun "ps -efZ | grep sedispatch" - rlSESearchRule "dontaudit setroubleshootd_t admin_home_t : file { read } [ ]" - rlRun "touch /root/.rpmmacros" - # trigger selinux denial - rlRun "passwd --help >& /root/output.txt" - sleep 5 - rlPhaseEnd - - rlPhaseStartCleanup - rlSECheckAVC --ignore 'type=AVC .* denied { write } .*:passwd_t.* ' \ - --ignore '.*passwd.*' - rlRun "rlFileRestore" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd \ No newline at end of file diff --git a/selinux-policy/rpm-suppress-stderr/main.fmf b/selinux-policy/rpm-suppress-stderr/main.fmf deleted file mode 100644 index baa0bfd..0000000 --- a/selinux-policy/rpm-suppress-stderr/main.fmf +++ /dev/null @@ -1,21 +0,0 @@ -summary: Does rpm install generate any output on stderr? -component: - - selinux-policy -require: - - fuse - - fuse-overlayfs - - dnf -test: ./test.sh -framework: beakerlib -duration: 10m -enabled: true -tag: - - NoRHIVOS - - avoidImageMode -link: - - https://issues.redhat.com/browse/RHEL-59192 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 - continue: false -extra-nitrate: TC#0617968 diff --git a/selinux-policy/rpm-suppress-stderr/test.sh b/selinux-policy/rpm-suppress-stderr/test.sh deleted file mode 100755 index 17a537f..0000000 --- a/selinux-policy/rpm-suppress-stderr/test.sh +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*- -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -INSTALL_OPTION="" -DOWNLOAD_OPTION="" -if dnf --help | grep -q use-host-config ; then - INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" -fi -if rlIsCentOS 9 ; then - INSTALL_OPTION="${INSTALL_OPTION} --releasever 9" -elif rlIsFedora ; then - RELEASEVER=`grep VERSION_ID /etc/os-release | cut -d = -f 2` - INSTALL_OPTION="${INSTALL_OPTION} --releasever ${RELEASEVER}" -fi -DOWNLOAD_OPTION=${INSTALL_OPTION} -# dnf sometimes fails to detect the release version on CentOS 9 -if dnf install --help | grep -q skip-broken ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" -fi -if dnf install --help | grep -q skip-unavailable ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" - rlRun "pushd $tmp" - rlRun "set -o pipefail" - rlAssertRpm fuse - rlAssertRpm fuse-overlayfs - rlPhaseEnd - - rlPhaseStartTest - rlRun "mkdir $tmp/lower $tmp/upper $tmp/work $tmp/merged" - rlRun "dnf -y install --installroot=$tmp/lower diffutils libfdisk libselinux-utils libutempter policycoreutils util-linux rpm ${INSTALL_OPTION}" - rlRun "mkdir download" - rlRun "cd download" - rlRun "dnf download rpm-plugin-selinux selinux-policy selinux-policy-targeted ${DOWNLOAD_OPTION}" - rlRun "mv -v *rpm $tmp/lower" - rlRun "cd .." - rlRun "fuse-overlayfs -o lowerdir=$tmp/lower/ -o upperdir=$tmp/upper/ -o workdir=$tmp/work/ $tmp/merged/" - RPMS=$(ls $tmp/merged/ | grep .rpm | xargs) - rlRun "chroot $tmp/merged/ /usr/bin/rpm -i $RPMS 2> error.log" - # warnings can be ignored/removed - rlRun "sed -i 's/^warning.*$//' error.log" - # whitespaces can be ignored/removed - rlRun "sed -i 's/^[[:space:]]*$//' error.log" - rlRun "sed -i '/^$/d' error.log" - rlAssert0 "error.log should be empty" `stat -c "%s" error.log` - rlRun "cat error.log" - rlRun "fusermount -u $tmp/merged/" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $tmp" 0 "Remove tmp directory" - rlPhaseEnd -rlJournalEnd diff --git a/selinux-policy/rpmdb-and-similar/Makefile b/selinux-policy/rpmdb-and-similar/Makefile index 89d9191..f7d2876 100644 --- a/selinux-policy/rpmdb-and-similar/Makefile +++ b/selinux-policy/rpmdb-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service sssd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts sssd" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -62,10 +62,13 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 1461313" >> $(METADATA) # Fedora 32 + @echo "Bug: 1898298" >> $(METADATA) # Fedora 33 @echo "Bug: 1899548" >> $(METADATA) # Fedora 33 - @echo "Bug: 2023163" >> $(METADATA) # Fedora 35 - @echo "Bug: 2164752" >> $(METADATA) # Fedora 37 + @echo "Bug: 1900383" >> $(METADATA) # Fedora 33 + @echo "Bug: 1900386" >> $(METADATA) # Fedora 33 + @echo "Bug: 1900388" >> $(METADATA) # Fedora 33 + @echo "Bug: 1900390" >> $(METADATA) # Fedora 33 + @echo "Bug: 1900391" >> $(METADATA) # Fedora 33 rhts-lint $(METADATA) diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index 5bb99a6..9090977 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -1,48 +1,3 @@ -summary: SELinux interferes with rpmdb program, rpmdb-rebuild service and related - programs -description: |+ - SELinux interferes with rpmdb program, rpmdb-rebuild service and related programs. +path: /selinux-policy/rpmdb-and-similar +tier: 2 -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - sssd -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - NoRHIVOS - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1461313 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899548 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2023163 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2164752 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - continue: false -extra-nitrate: TC#0609732 -extra-summary: /CoreOS/selinux-policy/Regression/rpmdb-and-similar -extra-task: /CoreOS/selinux-policy/Regression/rpmdb-and-similar -id: 7444ab1f-9138-4ac1-b92c-825adc7a5436 diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index e0c0b55..b4187f8 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -27,25 +27,21 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" SERVICE_PACKAGE="rpm" SERVICE_NAME="rpmdb-rebuild" PROCESS_NAME="rpmdb" PROCESS_CONTEXT="rpmdb_t" rlJournalStart - if rlIsRHEL '<9' || rlIsCentOS '<9' ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - rlLog "If this test fails, please contact mmalik or IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -61,22 +57,38 @@ rlJournalStart sleep 2 rlPhaseEnd - rlPhaseStartTest "bz#1899548" + rlPhaseStartTest "bz#1898298" rlSEMatchPathCon "/usr/bin/rpmdb" "rpmdb_exec_t" + rlSEMatchPathCon "/etc/resolv.conf" "net_conf_t" + rlSESearchRule "allow rpmdb_t net_conf_t : lnk_file { getattr read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1899548" + # also covers duplicates: 1900383, 1900386, 1900388, 1900389, 1900390, 1900391 + rlSEMatchPathCon "/usr/bin/rpmdb" "rpmdb_exec_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t" rlSESearchRule "allow rpmdb_t user_devpts_t : chr_file { read write } [ ]" + rlSESearchRule "dontaudit rpmdb_t sssd_public_t : file { getattr open map } [ ]" + rlSESearchRule "dontaudit rpmdb_t sssd_var_lib_t : sock_file { write } [ ]" + rlSESearchRule "dontaudit rpmdb_t sssd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "dontaudit rpmdb_t system_dbusd_var_run_t : sock_file { write } [ ]" + rlSESearchRule "dontaudit rpmdb_t system_dbusd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "dontaudit rpmdb_t system_dbusd_t : dbus { send_msg } [ ]" + rlSESearchRule "dontaudit system_dbusd_t rpmdb_t : dbus { send_msg } [ ]" rlPhaseEnd - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "touch /var/lib/rpm/.rebuilddb" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" rlRun "touch /var/lib/rpm/.rebuilddb" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - fi rlPhaseStartTest "rpmdb executed by root/unconfined_t" + rlRun "semodule -DB" rlRun "restorecon -Rv /var/lib/rpm" rlRun "ls -Z `which rpmdb`" rlRun "rpmdb --help" @@ -89,29 +101,9 @@ rlJournalStart rlRun "ls -dZ /var/lib/rpm | grep :rpm_var_lib_t" rlRun "ls -Z /var/lib/rpm" rm -f ${OUTPUT_FILE} + rlRun "semodule -B" rlPhaseEnd - if [ -f /usr/lib/systemd/system/rpmdb-migrate.service ] ; then - rlPhaseStartTest "bz#2164752" - rlSEMatchPathCon "/usr/bin/rpm" "rpm_exec_t" - rlSEMatchPathCon "/usr/lib/rpm/rpmdb_migrate" "rpmdb_exec_t" - rlSEMatchPathCon "/var/lib/rpm" "rpm_var_lib_t" - rlSEMatchPathCon "/var/lib/rpm/.migratedb" "rpm_var_lib_t" - rlSESearchRule "allow rpmdb_t shell_exec_t : file { map execute } [ ]" - rlSESearchRule "allow rpmdb_t rpm_exec_t : file { getattr open read map execute } [ ]" - rlSESearchRule "allow rpmdb_t bin_t : file { getattr open read execute execute_no_trans } [ ]" - rlSESearchRule "allow rpmdb_t rpm_var_lib_t : lnk_file { getattr read } [ ]" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- rpmdb-migrate service" - rlRun "touch /var/lib/rpm/.migratedb" - rlSEService - rpmdb-migrate - rpmdb_t "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlRun "touch /var/lib/rpm/.migratedb" - rlSEService - rpmdb-migrate - rpmdb_t "restart status stop status" 1 - rlPhaseEnd - fi - rlPhaseStartCleanup sleep 2 rlSECheckAVC diff --git a/selinux-policy/rrdcached-service-and-related/main.fmf b/selinux-policy/rrdcached-service-and-related/main.fmf index d310cd8..9d47d7a 100644 --- a/selinux-policy/rrdcached-service-and-related/main.fmf +++ b/selinux-policy/rrdcached-service-and-related/main.fmf @@ -1,45 +1,2 @@ -summary: Basic test for rrdcached service -description: '' -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - initscripts - - libselinux-utils - - policycoreutils - - rrdtool - - selinux-policy - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - CI-Tier-1 - - NoFedora30 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - TIPpass - - TIPpass_Security - - f32friendly - - f33friendly - - targeted - - NoRHIVOS -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1726255 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0604406 -extra-summary: /CoreOS/selinux-policy/Regression/rrdcached-service-and-related -extra-task: /CoreOS/selinux-policy/Regression/rrdcached-service-and-related -id: da5dd8fd-2a99-4a50-97bc-2c3b3ac16747 +path: /selinux-policy/rrdcached-service-and-related +tier: 2 diff --git a/selinux-policy/rrdcached-service-and-related/runtest.sh b/selinux-policy/rrdcached-service-and-related/runtest.sh index aa774dd..56b1a25 100755 --- a/selinux-policy/rrdcached-service-and-related/runtest.sh +++ b/selinux-policy/rrdcached-service-and-related/runtest.sh @@ -26,6 +26,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -44,7 +45,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlAssertRpm $PACKAGE rlAssertRpm $SERVICE_PACKAGE rlSESetEnforce @@ -84,13 +85,11 @@ rlJournalStart rlSESearchRule "typeattribute ${PROCESS_CONTEXT} syslog_client_type" rlPhaseEnd - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 2 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2 rlPhaseEnd - fi # TODO: add test scenario for rrdcached.socket diff --git a/selinux-policy/rsyslog-and-similar/main.fmf b/selinux-policy/rsyslog-and-similar/main.fmf index 34fd90d..5e28009 100644 --- a/selinux-policy/rsyslog-and-similar/main.fmf +++ b/selinux-policy/rsyslog-and-similar/main.fmf @@ -1,47 +1,8 @@ -summary: SELinux AVCs with rsyslog in various configurations -description: |+ - SELinux interferes with rsyslogd and related programs. - -contact: Milos Malik -component: - - rsyslog - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - /usr/sbin/service - - libselinux - - libselinux-utils - - logwatch - - policycoreutils - - policycoreutils-devel - - rsyslog - - rsyslog-gnutls - - selinux-policy - - selinux-policy-targeted - - setools-console - - shadow-utils - - /usr/sbin/semanage -environment: - AVC_ERROR: +no_avc_check -duration: 30m -enabled: true -tag: - - NoRHEL4 - - targeted - - NoRHIVOS - - avoidImageMode -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823669 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823672 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 - continue: false -extra-nitrate: TC#0609007 -extra-summary: /CoreOS/selinux-policy/Regression/rsyslog-and-similar -extra-task: /CoreOS/selinux-policy/Regression/rsyslog-and-similar -id: 42688797-d2d6-4acc-acd2-dc54f18150c4 +path: /selinux-policy/rsyslog-and-similar +summary: Test rsyslog service and verify AVC denials +description: | + Test coverage for rsyslog service with different configurations and + verify related SELinux AVC issues. +adjust: +- enabled: false + when: distro < rhel-8 diff --git a/selinux-policy/rsyslog-and-similar/runtest.sh b/selinux-policy/rsyslog-and-similar/runtest.sh index ee1b641..24f0b0e 100755 --- a/selinux-policy/rsyslog-and-similar/runtest.sh +++ b/selinux-policy/rsyslog-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment +. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" @@ -64,7 +65,7 @@ EOF rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -86,7 +87,7 @@ rlJournalStart rlRun "update_rsys" rlRun "systemctl restart rsyslog" sleep 3 - rlRun "ausearch -m AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC --start $tst_Time" 1 rlRun "cp -rv /etc/rsyslog.conf-orig /etc/rsyslog.conf" rlRun "systemctl restart rsyslog" rlPhaseEnd @@ -104,7 +105,7 @@ rlJournalStart rlRun "echo ' ' >> /etc/rsyslog.conf" rlRun "systemctl restart rsyslog" sleep 3 - rlRun "ausearch -m AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC --start $tst_Time" 1 rlRun 'semanage fcontext -d -t public_content_rw_t "/my/custom(/.*)?"' rlRun "semodule -r rsyslog_imfile_policy" rlRun "cp -rv /etc/rsyslog.conf-orig /etc/rsyslog.conf" diff --git a/selinux-policy/rtkit-daemon-and-similar/Makefile b/selinux-policy/rtkit-daemon-and-similar/Makefile index 35430d8..4e5588f 100644 --- a/selinux-policy/rtkit-daemon-and-similar/Makefile +++ b/selinux-policy/rtkit-daemon-and-similar/Makefile @@ -1,7 +1,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Makefile of /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar -# Description: SELinux interferes with rtkit daemon and related programs +# Description: the service was running as initrc_t, now it is confined by SELinux # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/selinux-policy/rtkit-daemon-and-similar/main.fmf b/selinux-policy/rtkit-daemon-and-similar/main.fmf index 161244b..358e482 100644 --- a/selinux-policy/rtkit-daemon-and-similar/main.fmf +++ b/selinux-policy/rtkit-daemon-and-similar/main.fmf @@ -1,58 +1,4 @@ -summary: SELinux interferes with rtkit-daemon and related programs -description: |+ - SELinux interferes with rtkit daemon and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - /usr/sbin/service - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - glib2 - - setools-console - - rtkit -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - TIPpass_FIPS - - TIPpass_Security - - TierCandidatesPASS - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1626982 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1703241 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1720546 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1750024 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1752583 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754408 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1755572 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1756755 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1758097 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1760214 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1873658 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1910507 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0300678 -extra-summary: /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar -extra-task: /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar -id: 9c4bfed2-36f7-4f37-ac14-629721ab5934 +path: /selinux-policy/rtkit-daemon-and-similar +summary: SELinux interferes with rtkit daemon and related programs +description: | + Test coverage for SELinux AVC issues against rtkit daemon and related programs. diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh index 855902c..b6e88e8 100755 --- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh +++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh @@ -3,7 +3,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # runtest.sh of /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar -# Description: SELinux interferes with rtkit daemon and related programs +# Description: the service was running as initrc_t, now it is confined by SELinux # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -40,7 +41,7 @@ PROCESS_CONTEXT="rtkit_daemon_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -76,9 +77,9 @@ rlJournalStart rlPhaseEnd fi - DESTINATION="org.freedesktop.RealtimeKit1" - if busctl | grep -iq ${DESTINATION} ; then + if ! rlIsRHEL 5 ; then rlPhaseStartTest "real scenario -- DBus service" + DESTINATION="org.freedesktop.RealtimeKit1" rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" @@ -97,7 +98,7 @@ rlJournalStart rlPhaseEnd fi - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + if ! rlIsRHEL 5 6 ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -108,7 +109,7 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd fi diff --git a/selinux-policy/samba-bgqd-and-similar/Makefile b/selinux-policy/samba-bgqd-and-similar/Makefile deleted file mode 100644 index e53e298..0000000 --- a/selinux-policy/samba-bgqd-and-similar/Makefile +++ /dev/null @@ -1,74 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar -# Description: SELinux interferes with samba-bgqd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/samba-bgqd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with samba-bgqd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba samba-client samba-common-tools cups /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: RHEL-53124" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-64908" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-69512" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-69517" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-72860" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-72861" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-93731" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/samba-bgqd-and-similar/PURPOSE b/selinux-policy/samba-bgqd-and-similar/PURPOSE deleted file mode 100644 index eda41a5..0000000 --- a/selinux-policy/samba-bgqd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar -Author: Milos Malik - -SELinux interferes with samba-bgqd and related programs. - diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf deleted file mode 100644 index 956c2eb..0000000 --- a/selinux-policy/samba-bgqd-and-similar/main.fmf +++ /dev/null @@ -1,53 +0,0 @@ -summary: SELinux interferes with samba-bgqd and related programs -description: |+ - SELinux interferes with samba-bgqd and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - samba - - samba-client - - samba-common-tools - - cups - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-53124 - - verifies: https://issues.redhat.com/browse/RHEL-64908 - - verifies: https://issues.redhat.com/browse/RHEL-69512 - - verifies: https://issues.redhat.com/browse/RHEL-69517 - - verifies: https://issues.redhat.com/browse/RHEL-72860 - - verifies: https://issues.redhat.com/browse/RHEL-72861 - - verifies: https://issues.redhat.com/browse/RHEL-93731 - - verifies: https://issues.redhat.com/browse/RHEL-95985 -adjust+: - - enabled: false - when: distro < rhel-9 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar -extra-nitrate: TC#0617974 -id: 1da15d16-92c5-405e-bc80-ed0ab0ea65a8 diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh deleted file mode 100755 index 71bae99..0000000 --- a/selinux-policy/samba-bgqd-and-similar/runtest.sh +++ /dev/null @@ -1,130 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar -# Description: SELinux interferes with samba-bgqd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SERVICE_PACKAGE="samba" -FILE_PATH="/usr/libexec/samba/samba-bgqd" -PROCESS_NAME="samba-bgqd" -SERVICE_NAME="samba-bgqd" -if seinfo -t | grep -q samba_bgqd ; then - PROCESS_CONTEXT="samba_bgqd_t" - FILE_CONTEXT="samba_bgqd_exec_t" -else - PROCESS_CONTEXT="unconfined_service_t" - FILE_CONTEXT="bin_t" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - rlAssertRpm cups - - rlFileBackup /etc/shadow - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if seinfo -t | grep -q samba_bgqd ; then - rlPhaseStartTest "RHEL-53124 + RHEL-64908" - rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} - rlSEMatchPathCon "/run/samba-bgqd.pid" "samba_bgqd_var_run_t" - rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" - rlSESearchRule "allow winbind_rpcd_t samba_bgqd_var_run_t : file { open write lock } [ ]" - rlSESearchRule "allow winbind_rpcd_t samba_bgqd_t : unix_dgram_socket { sendto } [ ]" - rlSESearchRule "allow winbind_rpcd_t samba_bgqd_exec_t : file { getattr open read map execute } [ ]" - rlSESearchRule "allow samba_bgqd_t sssd_public_t : dir { search } [ ]" - rlSESearchRule "allow samba_bgqd_t sssd_var_lib_t : dir { search } [ ]" - rlSESearchRule "allow samba_bgqd_t winbind_rpcd_t : fifo_file { write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-69512 + RHEL-69517" - rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} - rlSEMatchPathCon "/etc/cups" "cupsd_etc_t" - rlSEMatchPathCon "/run/cups" "cupsd_var_run_t" - rlSESearchRule "allow samba_bgqd_t cupsd_etc_t : dir { search } [ ]" - rlSESearchRule "allow samba_bgqd_t cupsd_var_run_t : dir { search } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-72860 + RHEL-72861" - rlSEMatchPathCon "/run/cups/cups.sock" "cupsd_var_run_t" - rlSESearchRule "allow samba_bgqd_t cupsd_var_run_t : sock_file { read write } [ ]" - rlSESearchRule "allow samba_bgqd_t cupsd_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - - if ! rlIsRHEL "<9.8" && ! ( rlIsRHEL 10 && rlIsRHEL "<10.2" ); then - rlPhaseStartTest "RHEL-93731 + RHEL-95985" - rlSEMatchPathCon "/var/lib/samba/private/msg.sock/668534" "samba_var_t" - rlSESearchRule "allow samba_bgqd_t smbd_t : unix_dgram_socket { sendto } [ ]" - rlPhaseEnd - fi - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "service cups start" - USER_NAME="smbuser${RANDOM}" - USER_SECRET="S3kr3T${RANDOM}" - rlRun "useradd ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "echo -en '${USER_SECRET}\n${USER_SECRET}\n' | smbpasswd -s -a ${USER_NAME}" - rlRun "systemctl start samba-bgqd" - rlRun "systemctl start smb" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - sleep 2 - rlRun "rpcclient ncacn_np:localhost -c 'enumprinters' -U${USER_NAME}%${USER_SECRET}" - sleep 2 - rlRun "systemctl stop smb" - rlRun "systemctl stop samba-bgqd" - rlRun "smbpasswd -x ${USER_NAME}" - rlRun "userdel -rf ${USER_NAME}" - rlRun "service cups stop" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile deleted file mode 100644 index e483fa0..0000000 --- a/selinux-policy/smbcontrol-and-similar/Makefile +++ /dev/null @@ -1,77 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/smbcontrol-and-similar -# Description: SELinux interferes with smbcontrol and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/smbcontrol-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with smbcontrol and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba-common samba-common-tools" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) - @echo "Bug: 1326371" >> $(METADATA) # RHEL-7 - @echo "Bug: 1326621" >> $(METADATA) # RHEL-6 - @echo "Bug: 1574518" >> $(METADATA) # RHEL-8 - @echo "Bug: 1574521" >> $(METADATA) # RHEL-7 - @echo "Bug: 2025931" >> $(METADATA) # Fedora 35 - @echo "Bug: 2027740" >> $(METADATA) # RHEL-8 - @echo "Bug: 2027751" >> $(METADATA) # RHEL-9 - @echo "Bug: 2033873" >> $(METADATA) # RHEL-8 - @echo "Bug: 2038157" >> $(METADATA) # RHEL-9 - @echo "Bug: 2038963" >> $(METADATA) # Fedora 35 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/smbcontrol-and-similar/PURPOSE b/selinux-policy/smbcontrol-and-similar/PURPOSE deleted file mode 100644 index fe8b846..0000000 --- a/selinux-policy/smbcontrol-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/smbcontrol-and-similar -Author: Milos Malik - -SELinux interferes with smbcontrol and related programs. - diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf deleted file mode 100644 index b7eae14..0000000 --- a/selinux-policy/smbcontrol-and-similar/main.fmf +++ /dev/null @@ -1,54 +0,0 @@ -summary: SELinux interferes with smbcontrol and related programs -description: |+ - SELinux interferes with smbcontrol and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - samba-common - - samba-common-tools -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - TierCandidatesPASS - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1326371 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1326621 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574518 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574521 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2025931 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027740 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027751 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2033873 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2038157 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2038963 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0522115 -extra-summary: /CoreOS/selinux-policy/Regression/smbcontrol-and-similar -extra-task: /CoreOS/selinux-policy/Regression/smbcontrol-and-similar -id: c0f43867-cee7-47ae-869f-9247d2ba9dfb diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh deleted file mode 100755 index 9e8a384..0000000 --- a/selinux-policy/smbcontrol-and-similar/runtest.sh +++ /dev/null @@ -1,120 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/smbcontrol-and-similar -# Description: SELinux interferes with smbcontrol and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/bin/smbcontrol" -FILE_CONTEXT="smbcontrol_exec_t" -if rlIsRHEL 6 ; then - SERVICE_PACKAGE="samba-common" -else - SERVICE_PACKAGE="samba-common-tools" -fi -PROCESS_NAME="smbcontrol" -PROCESS_CONTEXT="smbcontrol_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1326371 + bz#1326621" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - SOURCE_TYPE="unconfined_t" - BOOLEANS="[ ]" - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow smbcontrol_t samba_var_t : dir { ioctl read write getattr lock add_name remove_name search open }" - rlSESearchRule "allow smbcontrol_t samba_var_t : file { ioctl read write create getattr setattr lock append unlink link rename open }" - rlSESearchRule "allow smbcontrol_t samba_var_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open }" - rlSESearchRule "allow smbd_t smbcontrol_t : unix_dgram_socket { sendto }" - rlSESearchRule "allow smbcontrol_t smbd_t : unix_dgram_socket { sendto }" - rlSESearchRule "allow nmbd_t smbcontrol_t : unix_dgram_socket { sendto }" - rlSESearchRule "allow smbcontrol_t nmbd_t : unix_dgram_socket { sendto }" - rlSESearchRule "allow winbind_t smbcontrol_t : unix_dgram_socket { sendto }" - rlSESearchRule "allow smbcontrol_t winbind_t : unix_dgram_socket { sendto }" - rlSESearchRule "allow smbcontrol_t smbcontrol_t : unix_dgram_socket { create ioctl read getattr lock write setattr append bind connect getopt setopt shutdown }" - rlSESearchRule "allow smbcontrol_t smbcontrol_t : process { signal signull }" - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#1574518 + bz#1574521" - rlSEMatchPathCon "/usr/bin/smbcontrol" "smbcontrol_exec_t" - rlSEMatchPathCon "/var/lib/samba/lock" "samba_var_t" - # following rule assumes that samba_var_lock_t type is not defined - rlSESearchRule "allow smbcontrol_t samba_var_t : dir { create add_name write }" - rlPhaseEnd - fi - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#2025931 + bz#2027740 + bz#2027751" - rlSESearchRule "allow smbcontrol_t smbcontrol_t : netlink_route_socket { create bind getattr nlmsg_read} [ ]" - rlSESearchRule "allow smbcontrol_t smbcontrol_t : udp_socket { create ioctl } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2033873 + bz#2038157 + bz#2038963" - rlRun "ls -Z /proc/net/unix | grep :proc_net_t" - rlSESearchRule "allow smbcontrol_t proc_net_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario" - if ! rlIsRHEL 5 6 ; then - rlRun "ls -Z /var/lib/samba/lock" - fi - rlRun "smbcontrol nmbd ping" 0,1 - rlRun "smbcontrol smbd ping" 0,1 - rlRun "smbcontrol winbindd ping" 0,1 - if ! rlIsRHEL 5 6 ; then - rlRun "ls -Z /var/lib/samba/lock" - fi - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/snapd-and-similar/Makefile b/selinux-policy/snapd-and-similar/Makefile deleted file mode 100644 index e44655c..0000000 --- a/selinux-policy/snapd-and-similar/Makefile +++ /dev/null @@ -1,68 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/snapd-and-similar -# Description: SELinux interferes with the snapd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/snapd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with the snapd service and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console snapd snapd-selinux /usr/sbin/service spamassassin" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2207725" >> $(METADATA) # Fedora 38 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/snapd-and-similar/PURPOSE b/selinux-policy/snapd-and-similar/PURPOSE deleted file mode 100644 index 6788078..0000000 --- a/selinux-policy/snapd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/snapd-and-similar -Author: Milos Malik - -SELinux interferes with the snapd service and related programs - diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf deleted file mode 100644 index db9a930..0000000 --- a/selinux-policy/snapd-and-similar/main.fmf +++ /dev/null @@ -1,51 +0,0 @@ -summary: SELinux interferes with the snapd service and related programs -description: |+ - SELinux interferes with the snapd service and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - snapd - - snapd-selinux - - /usr/sbin/service - - spamassassin -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - failinfedora - - targeted - - epel - - rhel8-epel - - rhel9-epel - - rhel10-epel - - rhel9_broken - - rhel10_broken - - NoRHIVOS - - avoidImageMode -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2207725 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - because: the snapd package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/snapd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/snapd-and-similar -extra-nitrate: TC#0615881 -id: 7483a2b6-5a30-4538-b728-85e75d0542ef diff --git a/selinux-policy/snapd-and-similar/runtest.sh b/selinux-policy/snapd-and-similar/runtest.sh deleted file mode 100755 index 8fbc405..0000000 --- a/selinux-policy/snapd-and-similar/runtest.sh +++ /dev/null @@ -1,96 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/snapd-and-similar -# Description: SELinux interferes with the snapd service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/libexec/snapd/snapd" -FILE_CONTEXT="snappy_exec_t" -SERVICE_PACKAGE="snapd" -SERVICE_NAME="snapd" -PROCESS_NAME="snapd" -PROCESS_CONTEXT="snappy_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi - rlAssertRpm spamassassin - - # rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#2207725" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/var/lib/snapd" "snappy_var_lib_t" - rlSESearchRule "allow init_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" - rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]" - rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" - rlSESearchRule "allow spamd_t snappy_var_lib_t : dir { search } [ ]" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "ls -alRZ /var/lib/snapd" - rlRun "semodule -lfull | grep snap" - rlRun "service spamassassin start" - rlRun "service spamassassin status" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for environments where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlRun "service spamassassin stop" - rlRun "service spamassassin status" 3 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - # rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/sslh-and-similar/Makefile b/selinux-policy/sslh-and-similar/Makefile deleted file mode 100644 index 7740655..0000000 --- a/selinux-policy/sslh-and-similar/Makefile +++ /dev/null @@ -1,68 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/sslh-and-similar -# Description: SELinux interferes with sslh and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/sslh-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with sslh and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console sslh /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) - @echo "Bug: 1534624" >> $(METADATA) # Fedora 27 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/sslh-and-similar/PURPOSE b/selinux-policy/sslh-and-similar/PURPOSE deleted file mode 100644 index 774a1be..0000000 --- a/selinux-policy/sslh-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/sslh-and-similar -Author: Milos Malik - -SELinux interferes with sslh and related programs. - diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf deleted file mode 100644 index fae3684..0000000 --- a/selinux-policy/sslh-and-similar/main.fmf +++ /dev/null @@ -1,54 +0,0 @@ -summary: SELinux interferes with sslh and related programs -description: |+ - SELinux interferes with sslh and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - sslh - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TierCandidatesPASS - - f32friendly - - f33friendly - - targeted - - failinfedora - - epel - - rhel8-epel - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1534624 -adjust+: - - enabled: false - when: distro >= rhel-9 - because: the sslh package is not available there - - enabled: false - when: distro >= centos-stream-9 - because: the sslh package is not available there - - enabled: false - when: arch == i386, ppc, s390, s390x - because: the sslh package is not available for all architectures -extra-nitrate: TC#0563428 -extra-summary: /CoreOS/selinux-policy/Regression/sslh-and-similar -extra-task: /CoreOS/selinux-policy/Regression/sslh-and-similar -id: da6c2b1a-6db2-4c2b-b258-311438d26aef diff --git a/selinux-policy/sslh-and-similar/runtest.sh b/selinux-policy/sslh-and-similar/runtest.sh deleted file mode 100755 index 90a231a..0000000 --- a/selinux-policy/sslh-and-similar/runtest.sh +++ /dev/null @@ -1,114 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/sslh-and-similar -# Description: SELinux interferes with sslh and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/sslh" -FILE_CONTEXT="sslh_exec_t" -SERVICE_PACKAGE="sslh" -SERVICE_NAME="sslh" -PROCESS_NAME="sslh" -PROCESS_CONTEXT="sslh_t" - -rlJournalStart - if rlIsRHEL && ! rlIsRHEL 7 8 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - rlFileBackup /etc/sslh.cfg - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined ${PROCESS_CONTEXT} ; then - rlPhaseStartTest "bz#1534624" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" - rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow sslh_t sssd_var_lib_t : dir { search }" - rlSESearchRule "allow sslh_t sssd_public_t : file { getattr open read map }" - rlSESearchRule "allow sslh_t sssd_var_lib_t : sock_file { write }" - rlSESearchRule "allow sslh_t sssd_t : unix_stream_socket { connectto }" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - rlRun "sed -i 's/thelonious/localhost/' /etc/sslh.cfg" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # RHEL-4, RHEL-5, RHEL-6 are excluded - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile deleted file mode 100644 index ac07019..0000000 --- a/selinux-policy/stalld-and-similar/Makefile +++ /dev/null @@ -1,75 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/stalld-and-similar -# Description: SELinux interferes with stalld and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/stalld-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with stalld and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: stalld" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console stalld /usr/sbin/service binutils" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 2042614" >> $(METADATA) # RHEL-9 - @echo "Bug: 2092864" >> $(METADATA) # RHEL-9 - @echo "Bug: 2096776" >> $(METADATA) # RHEL-9 - @echo "Bug: 2102224" >> $(METADATA) # RHEL-9 - @echo "Bug: 2105038" >> $(METADATA) # RHEL-9 - @echo "Bug: 2140673" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-50356" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/stalld-and-similar/PURPOSE b/selinux-policy/stalld-and-similar/PURPOSE deleted file mode 100644 index 5d0d6a3..0000000 --- a/selinux-policy/stalld-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/stalld-and-similar -Author: Milos Malik - -SELinux interferes with stalld and related programs. - diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf deleted file mode 100644 index bb3e31f..0000000 --- a/selinux-policy/stalld-and-similar/main.fmf +++ /dev/null @@ -1,51 +0,0 @@ -summary: SELinux interferes with stalld and related programs -description: |+ - SELinux interferes with stalld and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - stalld - - /usr/sbin/service - - binutils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - NoRHIVOS -tier: 2 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096776 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2102224 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2105038 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2140673 - - verifies: https://issues.redhat.com/browse/RHEL-50356 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - continue: false -extra-nitrate: TC#0613202 -extra-summary: /CoreOS/selinux-policy/Regression/stalld-and-similar -extra-task: /CoreOS/selinux-policy/Regression/stalld-and-similar -id: 19ce8a2d-bea8-45d8-a9d1-f46612e94f34 diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh deleted file mode 100755 index eebb2dd..0000000 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ /dev/null @@ -1,150 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/stalld-and-similar -# Description: SELinux interferes with stalld and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/bin/stalld" -FILE_CONTEXT="stalld_exec_t" -SERVICE_PACKAGE="stalld" -SERVICE_NAME="stalld" -PROCESS_NAME="stalld" -PROCESS_CONTEXT="stalld_t" - -rlJournalStart - if ! rpm -q ${SERVICE_PACKAGE} >& /dev/null ; then - rlLog "Required packages are not available/installed." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/sysconfig/stalld - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#2042614" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlRun "ls -Z /proc/sys/kernel/sched_rt_runtime_us | grep :sysctl_kernel_t:" - rlRun "ls -Z /sys/kernel/debug/sched/debug | grep :debugfs_t:" - rlRun "ls -Z /sys/kernel/debug/sched/features | grep :debugfs_t:" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow ${PROCESS_CONTEXT} sysctl_kernel_t : file { getattr open read } [ fips_mode ]" - rlSESearchRule "allow ${PROCESS_CONTEXT} debugfs_t : file { getattr open read } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2092864" - rlSESearchRule "allow stalld_t stalld_t : capability { sys_nice } [ ]" - rlSESearchRule "allow stalld_t stalld_t : process { setsched } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2096776" - rlSESearchRule "allow stalld_t kernel_t : process { getsched } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2102224" - rlSESearchRule "allow stalld_t kernel_t : process { setsched } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2105038" - rlRun "sesearch -s stalld_t -t domain -c process -p getsched -A -ds -dt | grep allow" - rlRun "sesearch -s stalld_t -t domain -c process -p setsched -A -ds -dt | grep allow" - rlPhaseEnd - - rlPhaseStartTest "bz#2140673" - rlRun "ls -Z /sys/kernel/security/lockdown | grep :security_t" - rlSESearchRule "allow stalld_t security_t : file { getattr open read } [ ]" - rlPhaseEnd - - if strings `which stalld` | grep -q queue_track ; then - # if the program recognizes the queue_track option then test it and use it - rlPhaseStartTest "RHEL-50356" - rlSEMatchPathCon "/sys/fs/bpf" "bpf_t" - rlSESearchRule "allow stalld_t stalld_t : capability { sys_resource } [ ]" - rlSESearchRule "allow stalld_t stalld_t : process { setrlimit } [ ]" - rlSESearchRule "allow stalld_t bpf_t : dir { getattr open read } [ ]" - rlSESearchRule "allow stalld_t stalld_t : capability2 { bpf perfmon } [ ]" - rlSESearchRule "allow stalld_t stalld_t : bpf { prog_run prog_load map_read map_write map_create } [ ]" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- RHEL-50356" - rlRun "grep ^AGGR= /etc/sysconfig/stalld" - rlRun "sed -i 's/^AGGR=.*$/AGGR=\"--backend queue_track\"/' /etc/sysconfig/stalld" - rlRun "grep ^AGGR= /etc/sysconfig/stalld" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status stop status" 5 - rlRun "sed -i 's/^AGGR=.*$/AGGR=/' /etc/sysconfig/stalld" - rlRun "grep ^AGGR= /etc/sysconfig/stalld" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_syslog/' /etc/sysconfig/stalld" - rlRun "journalctl -u ${SERVICE_NAME} > before.txt" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_kmsg/' /etc/sysconfig/stalld" - rlRun "journalctl -u ${SERVICE_NAME} > after.txt" - rlRun "setsebool domain_can_write_kmsg on" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 - rlRun "setsebool domain_can_write_kmsg off" - rlRun "diff before.txt after.txt | grep -i -e 'operation not permitted' -e 'permission denied'" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rm -f before.txt after.txt - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/sudo-and-dnf/Makefile b/selinux-policy/sudo-and-dnf/Makefile deleted file mode 100644 index 8fd75e9..0000000 --- a/selinux-policy/sudo-and-dnf/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/sudo-and-dnf -# Description: SELinux interferes with the dnf command executed via sudo -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/sudo-and-dnf -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh ssh.exp - chcon -t bin_t runtest.sh ssh.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with the dnf command executed via sudo" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients shadow-utils sudo dnf /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2233065" >> $(METADATA) # RHEL-8 - @echo "Bug: RHEL-9947" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/sudo-and-dnf/PURPOSE b/selinux-policy/sudo-and-dnf/PURPOSE deleted file mode 100644 index a3b1b5c..0000000 --- a/selinux-policy/sudo-and-dnf/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/sudo-and-dnf -Author: Milos Malik - -SELinux interferes with the dnf command executed via sudo - diff --git a/selinux-policy/sudo-and-dnf/main.fmf b/selinux-policy/sudo-and-dnf/main.fmf deleted file mode 100644 index 53ec209..0000000 --- a/selinux-policy/sudo-and-dnf/main.fmf +++ /dev/null @@ -1,49 +0,0 @@ -summary: SELinux interferes with the dnf command executed via sudo -description: |+ - SELinux interferes with the dnf command executed via sudo. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - expect - - openssh-clients - - shadow-utils - - sudo - - dnf - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2233065 - - verifies: https://issues.redhat.com/browse/RHEL-1679 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/sudo-and-dnf -extra-task: /CoreOS/selinux-policy/Regression/sudo-and-dnf -extra-nitrate: TC#0615928 -id: 5d15cec5-e128-4e5c-9f60-80e852df3936 diff --git a/selinux-policy/sudo-and-dnf/runtest.sh b/selinux-policy/sudo-and-dnf/runtest.sh deleted file mode 100755 index 4bcb027..0000000 --- a/selinux-policy/sudo-and-dnf/runtest.sh +++ /dev/null @@ -1,79 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/sudo-and-dnf -# Description: SELinux interferes with the dnf command executed via sudo -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -q --whatprovides dnf" - rlAssertRpm sudo - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "real scenario -- bz#2233065 + RHEL-9947" - rlSEConfigureSSH - rlRun "setsebool ssh_sysadm_login on" - USER_NAME="sysadm${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z sysadm_u ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "echo \"${USER_NAME} ALL=(ALL) NOPASSWD: ALL\" > /etc/sudoers.d/dnf-test" - rlRun "ls -dlZ /var/lib/rpm" - - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost sudo dnf clean all" - rlRun "grep -i 'rpmdb open failed' $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost sudo dnf update -y" - rlRun "grep -i 'rpmdb open failed' $rlRun_LOG" 1 - rm -f $rlRun_LOG - - rlRun "rm -f /etc/sudoers.d/dnf-test" - rlRun "userdel -rfZ ${USER_NAME}" - rlRun "setsebool ssh_sysadm_login off" - rlFileRestore - rlRun "service sshd restart" - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/sudo-and-dnf/ssh.exp b/selinux-policy/sudo-and-dnf/ssh.exp deleted file mode 100755 index 096b9b8..0000000 --- a/selinux-policy/sudo-and-dnf/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname "id -Z ; $command" -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/sulogin-and-similar/main.fmf b/selinux-policy/sulogin-and-similar/main.fmf deleted file mode 100644 index 4412192..0000000 --- a/selinux-policy/sulogin-and-similar/main.fmf +++ /dev/null @@ -1,41 +0,0 @@ -summary: SELinux interferes with sulogin and related programs -test: ./runtest.sh -framework: beakerlib -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - binutils - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 5m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2265391 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/sulogin-and-similar -extra-task: /CoreOS/selinux-policy/Regression/sulogin-and-similar -extra-nitrate: TC#0617279 -id: 3128d079-084d-4c82-a01e-e2a8457a67d0 diff --git a/selinux-policy/sulogin-and-similar/runtest.sh b/selinux-policy/sulogin-and-similar/runtest.sh deleted file mode 100755 index 2a52952..0000000 --- a/selinux-policy/sulogin-and-similar/runtest.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlAssertRpm selinux-policy - rlAssertRpm selinux-policy-targeted - rlAssertRpm systemd - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL 8 9 && ! rlIsCentOS 8 9 ; then - rlPhaseStartTest "bz#2265391" - rlSEMatchPathCon "/usr/sbin/sulogin" "sulogin_exec_t" - rlSESearchRule "dontaudit sulogin_t sulogin_t : capability2 { checkpoint_restore } [ ]" - rlSESearchRule "allow sulogin_t tty_device_t : chr_file { relabelfrom relabelto } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/rescue.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "grep ExecStart= /usr/lib/systemd/system/rescue.service" - rlRun "strings /usr/lib/systemd/systemd-sulogin-shell | grep bin/sulogin" - rlRun "service rescue start" - sleep 2 - rlRun "service rescue status" - rlRun "service rescue stop" - sleep 2 - rlRun "service rescue status" 3 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd -rlJournalEnd - diff --git a/selinux-policy/swap-file-and-systemd-access/Makefile b/selinux-policy/swap-file-and-systemd-access/Makefile index 8ec066f..dc3fe58 100644 --- a/selinux-policy/swap-file-and-systemd-access/Makefile +++ b/selinux-policy/swap-file-and-systemd-access/Makefile @@ -67,10 +67,6 @@ $(METADATA): Makefile @echo "Bug: 1798872" >> $(METADATA) # RHEL 8 @echo "Bug: 1845594" >> $(METADATA) # Fedora 32 @echo "Bug: 1850177" >> $(METADATA) # RHEL 8 - @echo "Bug: 1912385" >> $(METADATA) # Fedora 32 - @echo "Bug: 1926536" >> $(METADATA) # RHEL 9 - @echo "Bug: 1928539" >> $(METADATA) # Fedora 32 - @echo "Bug: 1968610" >> $(METADATA) # RHEL 8 rhts-lint $(METADATA) diff --git a/selinux-policy/swap-file-and-systemd-access/PURPOSE b/selinux-policy/swap-file-and-systemd-access/PURPOSE index 83177ef..e92b3f3 100644 --- a/selinux-policy/swap-file-and-systemd-access/PURPOSE +++ b/selinux-policy/swap-file-and-systemd-access/PURPOSE @@ -1,5 +1,5 @@ PURPOSE of /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access Author: Milos Malik -SELinux interferes with systemd when accessing swap files or swap partitions. +SELinux interferes with systemd when accessing a swap file. diff --git a/selinux-policy/swap-file-and-systemd-access/main.fmf b/selinux-policy/swap-file-and-systemd-access/main.fmf index bf8ed59..b2d17da 100644 --- a/selinux-policy/swap-file-and-systemd-access/main.fmf +++ b/selinux-policy/swap-file-and-systemd-access/main.fmf @@ -1,53 +1,2 @@ -summary: SELinux interferes with systemd when accessing a swap file -description: |+ - SELinux interferes with systemd when accessing swap files or swap partitions. - -contact: Milos Malik -component: - - selinux-policy - - systemd -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux-utils - - policycoreutils - - selinux-policy - - setools-console - - systemd - - util-linux - - binutils -environment: - AVC_ERROR: +no_avc_check - REAL_SCENARIOS: 'false' -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - TIPpass - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1367279 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1797543 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1798872 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1845594 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1850177 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1912385 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1926536 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928539 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1968610 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1890884 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0605834 -extra-summary: /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access -extra-task: /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access -id: 00f29f1a-3bbb-4775-84b9-c7d524ea1b6b +path: /selinux-policy/swap-file-and-systemd-access +tier: 2 diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh index 3c04729..6ce368d 100755 --- a/selinux-policy/swap-file-and-systemd-access/runtest.sh +++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh @@ -26,14 +26,11 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -# The real scenario phase is not executed by default, because some -# machines do not survive the start of systemd-hybrid-sleep or -# systemd-hibernate services, even though their configuration contains -# PrivateDevices=yes. Override is possible by setting REAL_SCENARIOS=true. -REAL_SCENARIOS=${REAL_SCENARIOS:-false} +REAL_SCENARIOS=${REAL_SCENARIOS:-true} rlJournalStart if ! seinfo -t | grep -q systemd_sleep ; then @@ -41,7 +38,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -82,17 +79,6 @@ rlJournalStart rlPhaseEnd fi - rlPhaseStartTest "bz#1912385 + bz#1926536 + bz#1928539" - rlSESearchRule "allow systemd_sleep_t fixed_disk_device_t : blk_file { getattr } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1968610" - rlSEMatchPathCon "/sys/power" "sysfs_t" - rlSEMatchPathCon "/sys/power/state" "sysfs_t" - rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { add_name write } [ ]" - rlSESearchRule "allow systemd_sleep_t sysfs_t : file { create } [ ]" - rlPhaseEnd - if ${REAL_SCENARIOS} ; then rlPhaseStartTest "real scenario" rlRun "rm -f /swapfile" diff --git a/selinux-policy/switcheroo-control-and-similar/Makefile b/selinux-policy/switcheroo-control-and-similar/Makefile deleted file mode 100644 index 1174fbd..0000000 --- a/selinux-policy/switcheroo-control-and-similar/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar -# Description: SELinux interferes with switcheroo-control and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/switcheroo-control-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with switcheroo-control and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: switcheroo-control" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console switcheroo-control python3-gobject-base /usr/sbin/service gdm" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: RHEL-24268" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-93335" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-93535" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/switcheroo-control-and-similar/PURPOSE b/selinux-policy/switcheroo-control-and-similar/PURPOSE deleted file mode 100644 index 4738c63..0000000 --- a/selinux-policy/switcheroo-control-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar -Author: Milos Malik - -SELinux interferes with switcheroo-control and related programs. - diff --git a/selinux-policy/switcheroo-control-and-similar/main.fmf b/selinux-policy/switcheroo-control-and-similar/main.fmf deleted file mode 100644 index 6db9ecc..0000000 --- a/selinux-policy/switcheroo-control-and-similar/main.fmf +++ /dev/null @@ -1,49 +0,0 @@ -summary: SELinux interferes with switcheroo-control and related programs -description: |+ - SELinux interferes with switcheroo-control and related programs - -contact: Milos Malik -component: - - selinux-policy - - switcheroo-control -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - switcheroo-control - - python3-gobject-base - - /usr/sbin/service - - gdm -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-24268 - - verifies: https://issues.redhat.com/browse/RHEL-93335 - - verifies: https://issues.redhat.com/browse/RHEL-93535 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the switcheroo-control package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar -extra-task: /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar -extra-nitrate: TC#0617899 -id: b03995ad-99dc-46ae-a584-d860d8777b74 diff --git a/selinux-policy/switcheroo-control-and-similar/runtest.sh b/selinux-policy/switcheroo-control-and-similar/runtest.sh deleted file mode 100755 index 3d972e1..0000000 --- a/selinux-policy/switcheroo-control-and-similar/runtest.sh +++ /dev/null @@ -1,113 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar -# Description: SELinux interferes with switcheroo-control and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/libexec/switcheroo-control" -SERVICE_PACKAGE="switcheroo-control" -SERVICE_NAME="switcheroo-control" -PROCESS_NAME="switcheroo-control" -if seinfo -t | grep -q switcheroo ; then - PROCESS_CONTEXT="switcheroo_control_t" - FILE_CONTEXT="switcheroo_control_exec_t" -else - PROCESS_CONTEXT="unconfined_service_t" - FILE_CONTEXT="bin_t" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlServiceStart gdm - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if seinfo -t | grep -q switcheroo ; then - rlPhaseStartTest "RHEL-24268" - rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} - rlSEMatchPathCon "/run/udev/" "udev_var_run_t" - rlSEMatchPathCon "/run/dbus/" "system_dbusd_var_run_t" - rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t" - rlSESearchRule "allow switcheroo_control_t udev_var_run_t : dir { search } [ ]" - rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : netlink_kobject_uevent_socket { create setopt bind getattr } [ ]" - rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : capability2 { bpf } [ ]" - rlSESearchRule "allow switcheroo_control_t sysfs_t : dir { read } [ ]" - rlSESearchRule "allow switcheroo_control_t sysfs_t : lnk_file { getattr read } [ ]" - rlSESearchRule "allow switcheroo_control_t sysfs_t : file { getattr open read } [ ]" - rlSESearchRule "allow switcheroo_control_t system_dbusd_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : sock_file { write } [ ]" - rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : dir { search } [ ]" - rlSESearchRule "allow switcheroo_control_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]" - rlSESearchRule "allow system_dbusd_t switcheroo_control_t : dbus { send_msg } [ ]" - rlSESearchRule "allow unconfined_t switcheroo_control_t : dbus { send_msg } [ ]" - rlSESearchRule "allow switcheroo_control_t unconfined_t : dbus { send_msg } [ ]" - rlPhaseEnd - - if ! rlIsRHEL "<9.7" && ! ( rlIsRHEL 10 && rlIsRHEL "<10.1" ); then - rlPhaseStartTest "RHEL-93335 + RHEL-93535" - rlSESearchRule "allow xdm_t switcheroo_control_t : dbus { send_msg } [ ]" - rlSESearchRule "allow switcheroo_control_t xdm_t : dbus { send_msg } [ ]" - rlPhaseEnd - fi - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "switcherooctl version" - rlRun "switcherooctl list" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlRun "touch ./empty-file" - rlRun "switcherooctl launch ./empty-file" 0,1 - rlRun "rm -f ./empty-file" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/synce4l-and-similar/Makefile b/selinux-policy/synce4l-and-similar/Makefile deleted file mode 100644 index a84a939..0000000 --- a/selinux-policy/synce4l-and-similar/Makefile +++ /dev/null @@ -1,68 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/synce4l-and-similar -# Description: SELinux interferes with synce4l service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/synce4l-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with synce4l service and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service synce4l" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2158402" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/synce4l-and-similar/PURPOSE b/selinux-policy/synce4l-and-similar/PURPOSE deleted file mode 100644 index ac65ec7..0000000 --- a/selinux-policy/synce4l-and-similar/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/synce4l-and-similar -Description: SELinux interferes with synce4l service and related programs -Author: Milos Malik - diff --git a/selinux-policy/synce4l-and-similar/main.fmf b/selinux-policy/synce4l-and-similar/main.fmf deleted file mode 100644 index e8a6dda..0000000 --- a/selinux-policy/synce4l-and-similar/main.fmf +++ /dev/null @@ -1,43 +0,0 @@ -summary: SELinux interferes with synce4l service and related programs -description: |+ - SELinux interferes with synce4l service and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - synce4l -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -tier: 3 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2158402 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the synce4l package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/synce4l-and-similar -extra-task: /CoreOS/selinux-policy/Regression/synce4l-and-similar -extra-nitrate: TC#0614832 -id: f8bc6347-fce8-458d-b0e3-376cf0c718da diff --git a/selinux-policy/synce4l-and-similar/runtest.sh b/selinux-policy/synce4l-and-similar/runtest.sh deleted file mode 100755 index fefa8f7..0000000 --- a/selinux-policy/synce4l-and-similar/runtest.sh +++ /dev/null @@ -1,91 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/synce4l-and-similar -# Description: SELinux interferes with synce4l service and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/sbin/synce4l" -FILE_CONTEXT="bin_t" -SERVICE_PACKAGE="synce4l" -SERVICE_NAME="synce4l" -PROCESS_NAME="synce4l" -PROCESS_CONTEXT="unconfined_service_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/synce4l.conf - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#2158402" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - BOOLEANS="[ ]" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if grep -q _cmd /etc/synce4l.conf ; then - rlRun "sed -i 's/^\(.*_cmd\) .*$/\1 echo 0/' /etc/synce4l.conf" - rlRun "grep _cmd /etc/synce4l.conf" - fi - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-bootchart-and-similar/main.fmf b/selinux-policy/systemd-bootchart-and-similar/main.fmf index ca2e193..4b59e45 100644 --- a/selinux-policy/systemd-bootchart-and-similar/main.fmf +++ b/selinux-policy/systemd-bootchart-and-similar/main.fmf @@ -1,42 +1,2 @@ -summary: SELinux interferes with systemd-bootchart and related programs -description: |+ - SELinux interferes with systemd-bootchart and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - initscripts - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd-bootchart -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: false -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1757050 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838163 -adjust+: - - enabled: true - when: distro == fedora - because: the systemd-bootchart package is not available elsewhere -extra-nitrate: TC#0608092 -extra-summary: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar -id: 63b5a536-231a-44f8-931a-24d737c86359 +path: /selinux-policy/systemd-bootchart-and-similar +tier: 2 diff --git a/selinux-policy/systemd-bootchart-and-similar/runtest.sh b/selinux-policy/systemd-bootchart-and-similar/runtest.sh index c650b15..8577ea3 100755 --- a/selinux-policy/systemd-bootchart-and-similar/runtest.sh +++ b/selinux-policy/systemd-bootchart-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -50,7 +51,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -75,17 +76,15 @@ rlJournalStart rlSESearchRule "allow syslogd_t systemd_bootchart_tmpfs_t : file { getattr read write map } [ ]" rlPhaseEnd - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-creds/Makefile b/selinux-policy/systemd-creds/Makefile deleted file mode 100644 index 83eda9d..0000000 --- a/selinux-policy/systemd-creds/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-creds -# Description: SELinux interferes with services which use credentials -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-creds -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE dmesg.service - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with services which use credentials" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 2096857" >> $(METADATA) # Fedora 36 - @echo "Bug: 2097681" >> $(METADATA) # Fedora 36 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-creds/PURPOSE b/selinux-policy/systemd-creds/PURPOSE deleted file mode 100644 index ca6475f..0000000 --- a/selinux-policy/systemd-creds/PURPOSE +++ /dev/null @@ -1,9 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/systemd-creds -Author: Milos Malik - -SELinux interferes with services which use credentials: - * LoadCredential= - * LoadCredentialEncrypted= - -More about this systemd feature can be found at https://systemd.io/CREDENTIALS/ - diff --git a/selinux-policy/systemd-creds/dmesg.service b/selinux-policy/systemd-creds/dmesg.service deleted file mode 100644 index 661f441..0000000 --- a/selinux-policy/systemd-creds/dmesg.service +++ /dev/null @@ -1,4 +0,0 @@ -[Service] -ExecStart=/usr/bin/dmesg -LoadCredentialEncrypted=bar:/bar - diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf deleted file mode 100644 index 79d9e67..0000000 --- a/selinux-policy/systemd-creds/main.fmf +++ /dev/null @@ -1,40 +0,0 @@ -summary: SELinux interferes with services which use credentials -description: |+ - SELinux interferes with services which use credentials - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - targeted - - NoRHIVOS - - avoidImageMode -tier: 2 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - because: the systemd-creds program is not available there -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096857 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2097681 -extra-nitrate: TC#0613921 -extra-summary: /CoreOS/selinux-policy/Regression/systemd-creds -extra-task: /CoreOS/selinux-policy/Regression/systemd-creds -id: 01fe9246-a9bf-4424-8c76-db4f214ca5a7 diff --git a/selinux-policy/systemd-creds/runtest.sh b/selinux-policy/systemd-creds/runtest.sh deleted file mode 100755 index 6b66567..0000000 --- a/selinux-policy/systemd-creds/runtest.sh +++ /dev/null @@ -1,82 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-creds -# Description: SELinux interferes with services which use credentials -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SERVICE_PACKAGE="systemd" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlRun "cp dmesg.service /etc/systemd/system/" - rlRun "systemctl daemon-reload" - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#2096857 + bz#2097681" - rlSEMatchPathCon "/usr/bin/systemd-creds" "bin_t" - rlSEMatchPathCon "/dev/shm" "tmpfs_t" - rlSESearchRule "allow init_t tmpfs_t : file { read write open setattr rename create } [ ]" - rlPhaseEnd - - rlPhaseStartTest "a systemd service loading credentials" - rlRun "setsebool daemons_use_tty on" - rlRun "echo hello > /foo" - rlRun "ls -alZ /foo" - rlRun "systemd-creds encrypt /foo /bar" - rlRun "ls -alZ /bar" - rlRun "systemctl start dmesg.service" 0-255 - rlRun "systemctl status dmesg.service" 0-255 - rlRun "systemctl stop dmesg.service" 0-255 - rlRun "systemctl status dmesg.service" 0-255 - rlRun "rm -f /foo /bar" - rlRun "systemd-run -P --wait -p LoadCredential=abc:/etc/hosts systemd-creds cat abc" - rlRun "setsebool daemons_use_tty off" - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlRun "rm -f /etc/systemd/system/dmesg.service" - rlRun "systemctl daemon-reload" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-generators/71-default-off.network b/selinux-policy/systemd-generators/71-default-off.network deleted file mode 100644 index bb9ad91..0000000 --- a/selinux-policy/systemd-generators/71-default-off.network +++ /dev/null @@ -1,14 +0,0 @@ -# Automatically generated by systemd-network-generator - -[Match] -Kind=!* -Type=!loopback - -[Link] - -[Network] -DHCP=no -LinkLocalAddressing=no -IPv6AcceptRA=no - -[DHCP] diff --git a/selinux-policy/systemd-generators/71-default.network b/selinux-policy/systemd-generators/71-default.network deleted file mode 100644 index c94c3cb..0000000 --- a/selinux-policy/systemd-generators/71-default.network +++ /dev/null @@ -1,13 +0,0 @@ -# Automatically generated by systemd-network-generator - -[Match] -Kind=!* -Type=!loopback - -[Link] - -[Network] -DHCP=ipv4 -DNS=8.8.8.8 - -[DHCP] diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile deleted file mode 100644 index f2b644f..0000000 --- a/selinux-policy/systemd-generators/Makefile +++ /dev/null @@ -1,85 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Sanity/systemd-generators -# Description: Testing systemd system generators which are SELinux confined -# Author: Zdenek Pytela -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Sanity/systemd-generators -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE 71-default.network 71-default-off.network mnt-loop.mount tty.conf - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Zdenek Pytela " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Testing SELinux confined systemd system generators" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: nfs-utils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Requires: zram-generator" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Environment: SYSTEMD_PAGER=\"\"" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Releases: -RHEL5" >> $(METADATA) - @echo "Releases: -RHEL6" >> $(METADATA) - @echo "Releases: -RHEL7" >> $(METADATA) - @echo "Bug: 2230226" >> $(METADATA) # Fedora 39 - @echo "Bug: RHEL-72549" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-75879" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-98656" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-100415" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-100721" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-111556" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-generators/PURPOSE b/selinux-policy/systemd-generators/PURPOSE deleted file mode 100644 index 7300302..0000000 --- a/selinux-policy/systemd-generators/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Sanity/systemd-generators -Author: Zdenek Pytela - -Test systemd system generators which are SELinux confined and show all installed generators. - diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf deleted file mode 100644 index f1e9d66..0000000 --- a/selinux-policy/systemd-generators/main.fmf +++ /dev/null @@ -1,51 +0,0 @@ -summary: Systemd system generators -description: |+ - Testing systemd system generators which are SELinux confined - -contact: Zdenek Pytela -component: - - selinux-policy - - systemd -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux-utils - - nfs-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - zram-generator -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - TierCandidatesPASS - - f32friendly - - targeted - - NoRHIVOS - - avoidImageMode -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226 - - verifies: https://issues.redhat.com/browse/RHEL-72549 - - verifies: https://issues.redhat.com/browse/RHEL-75879 - - verifies: https://issues.redhat.com/browse/RHEL-98656 - - verifies: https://issues.redhat.com/browse/RHEL-100415 - - verifies: https://issues.redhat.com/browse/RHEL-100721 - - verifies: https://issues.redhat.com/browse/RHEL-111556 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0617500 -id: f92a6183-91e3-407a-9ac7-9b7df460109a diff --git a/selinux-policy/systemd-generators/mnt-loop.mount b/selinux-policy/systemd-generators/mnt-loop.mount deleted file mode 100644 index 840dd8c..0000000 --- a/selinux-policy/systemd-generators/mnt-loop.mount +++ /dev/null @@ -1,12 +0,0 @@ -# Automatically generated by systemd-fstab-generator - -[Unit] -Documentation=man:fstab(5) man:systemd-fstab-generator(8) -SourcePath=/tmp/fstab -Before=local-fs.target -After=blockdev@dev-loop17.target - -[Mount] -What=/dev/loop17 -Where=/mnt/loop -Type=ext4 diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh deleted file mode 100755 index e6a2405..0000000 --- a/selinux-policy/systemd-generators/runtest.sh +++ /dev/null @@ -1,276 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Sanity/systemd-generators -# Description: Testing systemd system generators which are SELinux confined -# Author: Zdenek Pytela -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SD_SYSTEM_GENERATOR_PATH="/usr/lib/systemd/system-generators /usr/local/lib/systemd/system-generators /etc/systemd/system-generators /run/systemd/system-generators" -SD_SYSTEM_GENERATORS="" - -# To make testing easier, systemd implements various tweaks into its services: -# - variables like SYSTEMD_FSTAB or SYSTEMD_PROC_CMDLINE can be used to point to files -# which will be taken into account instead of the original ones -# - SYSTEMD_IN_INITRD=1 forges being executed in initial ramdisk -# - network generator accepts position arguments as proc-command-line entries -# systemd-network-generator [OPTIONS...] [-- KERNEL_CMDLINE] - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - ### Information about the system (release, systemd and policy versions) - rlPhaseStartTest "Display basic system information" - rlRun "cat /etc/system-release" - rlRun "uname -a" - rlRun "rpm -qa \"systemd*\"|sort" - rlRun "rpm -qa \"selinux-*\" \"*-selinux\" | sort" - rlPhaseEnd - - ### Look for executables in the directories for systemd-system-generators - rlPhaseStartTest "Find all generators" - for dir in ${SD_SYSTEM_GENERATOR_PATH}; do - [ -d "${dir}" ] || continue - for file in ${dir}/*; do - FILEPATH=$(realpath "${file}") - [ "$?" = 0 ] || continue - [ -x "$FILEPATH" ] || continue - CONTEXT=$(stat -c"%C" "${FILEPATH}") - [ "$?" = 0 ] || continue - if [[ ${CONTEXT} =~ ":init_exec_t:" ]] || [[ ${CONTEXT} =~ ":lib_t:" ]] || [[ ${CONTEXT} =~ ":usr_t:" ]] || [[ ${CONTEXT} =~ ":systemd_generic_generator_exec_t:" ]] - then - SD_SYSTEM_GENERATORS_NOTCONFINED="${SD_SYSTEM_GENERATORS_NOTCONFINED} $FILEPATH" - else - SD_SYSTEM_GENERATORS="${SD_SYSTEM_GENERATORS} $FILEPATH" - fi - done - done - echo "List of confined generators:" - echo "${SD_SYSTEM_GENERATORS}" - echo "List of non-confined generators:" - echo "${SD_SYSTEM_GENERATORS_NOTCONFINED}" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/systemd-networkd.service ] ; then - - ### network-generator actually is a service, not a generator - # systemd-network-generator.service is a system service that translates ip= and the - # related settings on the kernel command line (see below) into systemd.network(5), - # systemd.netdev(5), and systemd.link(5) configuration files - rlPhaseStartTest "systemd-network-generator" - rlRun "systemd-run -u sdng-manual.service /usr/lib/systemd/systemd-network-generator -- nameserver=8.8.8.8 ip=dhcp" - rlRun "journalctl -u sdng-manual.service" - rlRun "systemctl restart systemd-networkd" - rlRun "systemctl status systemd-networkd" - rlRun "networkctl" - rlRun "diff /run/systemd/network/71-default.network 71-default.network" - rlPhaseEnd - - rlPhaseStartTest "systemd-network-generator: ip=off" - rlRun "systemd-run -u sdng-manual-off.service /usr/lib/systemd/systemd-network-generator -- ip=off" - rlRun "journalctl -u sdng-manual-off.service" - rlRun "systemctl restart systemd-networkd" - rlRun "systemctl status systemd-networkd" - rlRun "networkctl" - rlRun "diff /run/systemd/network/71-default.network 71-default-off.network" - rlPhaseEnd - - fi - - ### fstab-generator - # systemd-fstab-generator is a generator that translates /etc/fstab (see fstab(5) - # for details) into native systemd units early at boot and when configuration of - # the system manager is reloaded. This will instantiate mount and swap - # units as necessary. - - # fstab-generator 1 - use /etc/fstab - rlPhaseStartTest "systemd-fstab-generator /etc" - rlFileBackup "/etc/fstab" - rlRun "mkdir -p /newproc" - rlRun "echo \"/proc /newproc none bind 0 0\" >> /etc/fstab" - rlRun "SYSTEMD_LOG_LEVEL=debug systemd-run -u sdfg-manual.service /usr/lib/systemd/system-generators/systemd-fstab-generator /run/systemd/generator" - rlRun "journalctl -u sdfg-manual.service" - rlRun "systemctl daemon-reload" - rlRun "systemctl start newproc.mount" - rlRun "systemctl status newproc.mount" - rlRun "ls -lZd /newproc/1" - rlRun "systemctl stop newproc.mount" - rlPhaseEnd - - # fstab-generator 2 - use a local fstab-like file - rlPhaseStartTest "systemd-fstab-generator /tmp" - rlRun "> /tmp/fstab" - rlRun "echo \"/dev/loop17 /mnt/loop ext4 defaults 0 0\" >> /tmp/fstab" - rlRun "mkdir -p /mnt/loop" - rlRun "chcon --reference /etc/fstab /tmp/fstab" - rlRun "dd if=/dev/zero of=/tmp/loopfile bs=16M count=1" - rlRun "chcon -t user_tmp_t /tmp/loopfile" - rlRun "losetup /dev/loop17 /tmp/loopfile" - rlRun "losetup -j /tmp/loopfile" - rlRun "mkfs.ext4 /dev/loop17" - rlRun "systemd-run -E SYSTEMD_FSTAB=/tmp/fstab -u sdfg-tmpfstab.service /usr/lib/systemd/system-generators/systemd-fstab-generator /run/systemd/generator" - rlRun "diff /run/systemd/generator/mnt-loop.mount mnt-loop.mount" - rlRun "ls -lZa /mnt/loop" - rlPhaseEnd - - # fstab-generator 3: nfs - - ### gpt-generator - #rlPhaseStartTest "systemd-gpt-generator" - #rlPhaseEnd - - ### nfs-generator - # 7a76dc1c4eba7a6cd3b59cdd40b6b4bd90312e07 needs to be reverted - #rlPhaseStartTest "systemd-nfs-generator" - #rlPhaseEnd - - ### systemd-rc-local-generator - # systemd-rc-local-generator is a generator that checks whether /etc/rc.d/rc.local - # exists and is executable, and if it is, pulls the rc-local.service unit into the - # boot process. - # the service unit file already exists: /usr/lib/systemd/system/rc-local.service - # the generator just creates - # /run/systemd/generator/multi-user.target.wants/rc-local.service symlink - rlPhaseStartTest "systemd-rc-local-generator" - if [ -x /usr/lib/systemd/system-generators/systemd-rc-local-generator ]; then - cat > /etc/rc.d/rc.local << EOF -#!/bin/bash -echo "This is a script to check rc-local generator." -EOF - rlRun "chmod +x /etc/rc.d/rc.local" - rlRun "restorecon -v /etc/rc.d/rc.local" - rlRun "systemd-run -u sdrg-manual.service /usr/lib/systemd/system-generators/systemd-rc-local-generator /run/systemd/generator" - rlRun "journalctl -u sdrg-manual.service" - rlRun "systemctl daemon-reload" - rlRun "systemctl start rc-local.service" - rlRun "systemctl status rc-local.service" - rlRun "systemctl stop rc-local.service" - fi - rlPhaseEnd - - ### sysv-generator - # systemd-sysv-generator is a generator that creates wrapper .service units - # for SysV init[1] scripts in /etc/init.d/* at boot and when configuration - # of the system manager is reloaded. - rlPhaseStartTest "systemd-sysv-generator" - if [ -x /usr/lib/systemd/system-generators/systemd-sysv-generator ]; then - cat > /etc/rc.d/init.d/sysv-generator-test.sh << EOF -#!/bin/bash -echo "This is a script to check sysv generator." -EOF - rlRun "chmod +x /etc/rc.d/init.d/sysv-generator-test.sh" - rlRun "restorecon -Fv /etc/rc.d/init.d/sysv-generator-test.sh" - rlRun "systemd-run -u sdsg-manual.service /usr/lib/systemd/system-generators/systemd-sysv-generator /run/systemd/generator /run/systemd/generator.early /run/systemd/generator.late" - rlRun "journalctl -u sdsg-manual.service" - rlRun "systemctl daemon-reload" - rlRun "systemctl start sysv-generator-test.service" - rlRun "systemctl status sysv-generator-test.service" - rlRun "systemctl stop sysv-generator-test.service" - fi - rlPhaseEnd - - if rlIsCentOS 10 || rlIsRHEL 10 ; then - rlPhaseStartTest "RHEL-72549" - rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-ssh-generator" "systemd_ssh_generator_exec_t" - rlSEMatchPathCon "/dev/vsock" "vsock_device_t" - rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_generator_unit_file_t" - rlSESearchRule "allow init_t systemd_ssh_generator_exec_t : file { getattr open read execute } [ ]" - rlSESearchRule "type_transition init_t systemd_ssh_generator_exec_t : process systemd_ssh_generator_t" - rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]" - rlSESearchRule "allow systemd_ssh_generator_t systemd_unit_file_t : file { create getattr write open } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-75879" - rlRun "seinfo -a systemd_generator -x" - rlSESearchRule "allow systemd_fstab_generator_t syslogd_t : unix_dgram_socket { sendto } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-98656" - rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-cryptsetup-generator" "systemd_cryptsetup_generator_exec_t" - rlSESearchRule "allow systemd_cryptsetup_generator_t systemd_unit_file_t : file { getattr create open write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "RHEL-100415 + RHEL-100721" - rlSEMatchPathCon "/usr/lib/systemd/system-generators/vsftpd-generator" "systemd_vsftpd_generator_exec_t" - rlSESearchRule "allow systemd_vsftpd_generator_t bin_t : file { execute execute_no_trans map } [ ]" - rlPhaseEnd - fi - - if seinfo -a | grep -q systemd_generator ; then - rlPhaseStartTest "RHEL-111556" - rlSEMatchPathCon "/usr/lib/systemd/system-generators/nfs-server-generator" "systemd_nfs_generator_exec_t" - rlSESearchRule "allow init_t systemd_nfs_generator_exec_t : file { getattr open read map execute } [ ]" - rlSESearchRule "type_transition init_t systemd_nfs_generator_exec_t : process systemd_nfs_generator_t" - rlSESearchRule "allow init_t systemd_nfs_generator_t : process { transition } [ ]" - rlSESearchRule "allow systemd_nfs_generator_t systemd_nfs_generator_t : udp_socket { getattr create setopt connect } [ ]" - rlPhaseEnd - fi - - ### generators from other packages: install them all? - # dnf install "/usr/lib/systemd/system-generators/*" - # cloud-init-generator nfs-server-generator rpc-pipefs-generator selinux-autorelabel-generator.sh zram-generator - # cloud-init nfs-utils policycoreutils zram-generator - - ### selinux-autorelabel-generator - # This systemd.generator(7) detects if SELinux is running and if the - # user requested an autorelabel, and if so sets the default target to - # selinux-autorelabel.target. - rlPhaseStartTest "selinux-autorelabel-generator" - rlFileBackup "/etc/selinux/config" - rlRun "echo AUTORELABEL=0 >> /etc/selinux/config" - rlRun "touch /.autorelabel" - rlRun "SYSTEMD_LOG_LEVEL=debug systemd-run -u sdsa-manual.service /usr/lib/systemd/system-generators/selinux-autorelabel-generator.sh /run/systemd/generator /run/systemd/generator.early /run/systemd/generator.late" - rlRun "journalctl -u sdsa-manual.service" - rlRun "test \"$(readlink /run/systemd/generator.early/default.target)\" = \"/usr/lib/systemd/system/selinux-autorelabel.target\"" - rlRun "diff /run/systemd/generator.early/selinux-autorelabel.service.d/tty.conf tty.conf" - rlPhaseEnd - - ### cleanup, restoring the previous content - # re-run again all generators as an effect of daemon-reload; - # changes which used special systemd variables will go away - rlPhaseStartCleanup - sleep 2 - rlRun "rmdir /mnt/loop" - rlRun "losetup -d /dev/loop17" - rlRun "rm -f /dev/loop17" - rlRun "rm /tmp/loopfile" - rlFileRestore - # fixme: remove non-natural generators - rlRun "systemctl daemon-reload" - rlSECheckAVC - rlPhaseEnd - rlJournalPrintText -rlJournalEnd diff --git a/selinux-policy/systemd-generators/tty.conf b/selinux-policy/systemd-generators/tty.conf deleted file mode 100644 index f0d8106..0000000 --- a/selinux-policy/systemd-generators/tty.conf +++ /dev/null @@ -1,2 +0,0 @@ -[Service] -StandardInput=tty diff --git a/selinux-policy/systemd-homed/Makefile b/selinux-policy/systemd-homed/Makefile index 5b03c59..d067913 100644 --- a/selinux-policy/systemd-homed/Makefile +++ b/selinux-policy/systemd-homed/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 1h" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit expect /usr/sbin/service systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) + @echo "Requires: audit expect initscripts systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -64,11 +64,6 @@ $(METADATA): Makefile @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) @echo "Bug: 1809878" >> $(METADATA) # Fedora 32 - @echo "Bug: 2036108" >> $(METADATA) # Fedora 42 - @echo "Bug: 2315087" >> $(METADATA) # Fedora 41 - @echo "Bug: 2316163" >> $(METADATA) # Fedora 41 - @echo "Bug: 2315812" >> $(METADATA) # Fedora 42 - @echo "Bug: 2315587" >> $(METADATA) # Fedora 41 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index e726217..2858935 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -1,40 +1,10 @@ -summary: Tests for systemd-homed service -contact: Amith Kumar -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - expect - - /usr/sbin/service - - systemd - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 1h -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1809878 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2036108 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315087 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315587 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315812 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2316163 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10 - because: the systemd-homed program is not available there -extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed -extra-task: /CoreOS/selinux-policy/Regression/systemd-homed -extra-nitrate: TC#0614608 -id: 880ecade-0976-4303-a521-aead43e7f8c7 -tag: - - failinfedora - - NoRHIVOS +path: /selinux-policy/systemd-homed +summary: Test homectl utility and its sub-commands to verify AVC denials +description: | + Test coverage for SELinux AVC issues associated with systemd-homed + service. The homectl program calls the systemd-homed service, which + is not yet confined, but it triggers SELinux denials. This test suite + covers command homectl with its subcommands and checks for avc denials. +adjust: +- enabled: false + when: distro < rhel-9 diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index 0776bb8..7c0a45f 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -27,22 +27,19 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE1="selinux-policy" PACKAGE2="systemd" -INSTALL_OPTION="" -if dnf install --help | grep -q skip-broken ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" -fi function create_u() { expect -f - <<<' set timeout -1 spawn homectl create test_u --disk-size=500M - expect "*test_u: " + expect "*: " send -- "Red_123hat\r" - expect "*test_u*: " + expect "*: " send -- "Red_123hat\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break @@ -78,12 +75,10 @@ function passwd_u() { expect -f - <<<' set timeout -1 spawn homectl passwd test_u - expect "*test_u: " + expect "*: " send -- "Sim_123pl1\r" - expect "*test_u*: " + expect "*: " send -- "Sim_123pl1\r" - expect "*test_u: " - send -- "Red_123hat\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break exit $value @@ -94,7 +89,7 @@ function auth_u() { expect -f - <<<' set timeout -1 spawn homectl authenticate test_u - expect "*test_u: " + expect "*: " send -- "Sim_123pl1\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break @@ -106,7 +101,7 @@ function resize_u() { expect -f - <<<' set timeout -1 spawn homectl resize test_u 425.0M - expect "*test_u: " + expect "*: " send -- "Sim_123pl1\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break @@ -115,14 +110,8 @@ expect -f - <<<' } rlJournalStart - if ! seinfo -t systemd_homed_t | grep -q systemd_homed_t ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE1} rlAssertRpm ${PACKAGE1}-targeted @@ -131,13 +120,12 @@ rlJournalStart rlSEStatus rlSESetTimestamp sleep 2 - rlRun "systemctl enable systemd-homed" rlPhaseEnd rlPhaseStartTest "homectl create" rlRun "create_u" - rlRun "ausearch -m AVC -m USER_AVC -c systemd-homed -f mail --input-logs" 1 - rlRun "ausearch -m AVC -m USER_AVC -c systemd-homewor --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC -c systemd-homed -f mail" 1 + rlRun "ausearch -m AVC -m USER_AVC -c systemd-homewor" 1 rlPhaseEnd rlPhaseStartTest "homectl list" @@ -145,7 +133,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl list" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartTest "homectl activate" @@ -153,15 +141,15 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "activate_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartTest "homectl inspect" sleep 20 tst_Time="$(date '+%T')" - rlRun "homectl inspect test_u --no-pager" + rlRun "homectl inspect test_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartTest "homectl update" @@ -169,7 +157,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl update test_u --email-address=test_u@redhat.com" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartTest "homectl lock" @@ -177,7 +165,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl lock test_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartTest "homectl unlock" @@ -185,7 +173,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "unlock_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartTest "homectl passwd" @@ -193,7 +181,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "passwd_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartTest "homectl authenticate" @@ -201,7 +189,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "auth_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartTest "homectl deactivate and resize" @@ -211,7 +199,7 @@ rlJournalStart sleep 60 rlRun "resize_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartTest "homectl remove" @@ -219,19 +207,10 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl remove test_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 - rlPhaseEnd - - rlPhaseStartTest "bz#2036108 + bz#2315087" - rlSEMatchPathCon "/usr/lib/systemd/systemd-homed" "systemd_homed_exec_t" - rlSEMatchPathCon "/var/cache/systemd/" "systemd_cache_t" - rlSEMatchPathCon "/var/cache/systemd/home/" "systemd_homed_cache_t" - rlSESearchRule "allow systemd_homed_t systemd_homed_cache_t : dir { read } [ ]" - rlRun "service systemd-homed restart" + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlPhaseEnd rlPhaseStartCleanup - rlRun "systemctl disable systemd-homed" sleep 2 rlSECheckAVC rlRun "rm -f /tmp/avcfile" diff --git a/selinux-policy/systemd-importd-and-similar/Makefile b/selinux-policy/systemd-importd-and-similar/Makefile deleted file mode 100644 index dc0acf1..0000000 --- a/selinux-policy/systemd-importd-and-similar/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-importd-and-similar -# Description: SELinux interferes with systemd-importd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2025 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-importd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with systemd-importd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd systemd-container /usr/sbin/service shadow-utils" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: RHEL-98490" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-importd-and-similar/PURPOSE b/selinux-policy/systemd-importd-and-similar/PURPOSE deleted file mode 100644 index 9be09c0..0000000 --- a/selinux-policy/systemd-importd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/systemd-importd-and-similar -Author: Milos Malik - -SELinux interferes with systemd-importd and related programs. - diff --git a/selinux-policy/systemd-importd-and-similar/main.fmf b/selinux-policy/systemd-importd-and-similar/main.fmf deleted file mode 100644 index 5754646..0000000 --- a/selinux-policy/systemd-importd-and-similar/main.fmf +++ /dev/null @@ -1,44 +0,0 @@ -summary: SELinux interferes with systemd-importd and related programs -description: |+ - SELinux interferes with systemd-importd and related programs. - -contact: Milos Malik -component: - - selinux-policy - - systemd -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd - - /usr/sbin/service - - shadow-utils - - systemd-container -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - failinfedora - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-98490 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 - because: the systemd-importd program is not available there -extra-nitrate: TC#0619330 -id: b692e9f4-64d8-4cb3-bba9-f4281d8075a2 diff --git a/selinux-policy/systemd-importd-and-similar/runtest.sh b/selinux-policy/systemd-importd-and-similar/runtest.sh deleted file mode 100755 index c61d8c9..0000000 --- a/selinux-policy/systemd-importd-and-similar/runtest.sh +++ /dev/null @@ -1,102 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-importd-and-similar -# Description: SELinux interferes with systemd-importd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2025 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/lib/systemd/systemd-importd" -FILE_CONTEXT="systemd_importd_exec_t" -SERVICE_PACKAGE="systemd-container" -SERVICE_NAME="systemd-importd" -PROCESS_NAME="systemd-importd" -PROCESS_CONTEXT="systemd_importd_t" - -rlJournalStart - if [ ! -f /usr/lib/systemd/systemd-importd ] ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined ${PROCESS_CONTEXT} ; then - rlPhaseStartTest "SELinux contexts and rules" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - fi - - if rlIsRHEL 10 || rlIsCentOS 10 || rlIsFedora ; then - rlPhaseStartTest "RHEL-98490" - rlSEMatchPathCon "/run/systemd/io.systemd.Import" "init_var_run_t" - rlSESearchRule "allow systemd_importd_t init_var_run_t : sock_file { create unlink } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-journal-upload/Makefile b/selinux-policy/systemd-journal-upload/Makefile deleted file mode 100644 index 2ede7ea..0000000 --- a/selinux-policy/systemd-journal-upload/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-journal-upload -# Description: SELinux interferes with systemd-journal-upload and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-journal-upload -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - test -x runtest.sh || chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with systemd-localed and localectl" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service systemd-journal-remote" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: RHEL-57774" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-62196" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-journal-upload/main.fmf b/selinux-policy/systemd-journal-upload/main.fmf deleted file mode 100644 index d286ba5..0000000 --- a/selinux-policy/systemd-journal-upload/main.fmf +++ /dev/null @@ -1,42 +0,0 @@ -summary: SELinux interferes with systemd-journal-upload and related programs -test: ./runtest.sh -framework: beakerlib -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - systemd-journal-remote -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-57774 - - verifies: https://issues.redhat.com/browse/RHEL-62196 -adjust+: - - enabled: false - when: distro < rhel-9.7 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/systemd-journal-upload -extra-task: /CoreOS/selinux-policy/Regression/systemd-journal-upload -extra-nitrate: TC#0617895 -id: 70a20eff-d2b4-458c-84e8-8e6f18a71d84 diff --git a/selinux-policy/systemd-journal-upload/runtest.sh b/selinux-policy/systemd-journal-upload/runtest.sh deleted file mode 100755 index fe8367e..0000000 --- a/selinux-policy/systemd-journal-upload/runtest.sh +++ /dev/null @@ -1,58 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SERVICE_PACKAGE="systemd-journal-remote" -SERVICE_NAME="systemd-journal-upload" -PROCESS_NAME="systemd-journal-upload" -PROCESS_CONTEXT="systemd_journal_upload_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if rlSEDefined ${PROCESS_CONTEXT} ; then - rlPhaseStartTest "RHEL-57774 + RHEL-62196" - rlSEMatchPathCon "/usr/lib/systemd/systemd-journal-upload" "systemd_journal_upload_exec_t" - if rlSEDefined "systemd_conf_t" ; then - rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "systemd_conf_t" - rlSESearchRule "allow systemd_journal_upload_t systemd_conf_t : dir { read } [ ]" - else - rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "init_var_run_t" - rlSESearchRule "allow systemd_journal_upload_t init_var_run_t : dir { read } [ ]" - fi - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- RHEL-57774" - rlRun "mkdir -pZ /run/systemd/journal-upload.conf.d" - rlRun "echo -e '[Upload]\nURL=http://localhost/\n' > /run/systemd/journal-upload.conf.d/test.conf" - rlRun "restorecon -Rv /run/systemd" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rm -f /run/systemd/journal-upload.conf.d/test.conf - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalEnd - diff --git a/selinux-policy/systemd-localed/Makefile b/selinux-policy/systemd-localed/Makefile deleted file mode 100644 index 8727c1e..0000000 --- a/selinux-policy/systemd-localed/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-localed -# Description: SELinux interferes with systemd-localed and localectl -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2023 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-localed -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - test -x runtest.sh || chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with systemd-localed and localectl" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service systemd" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2240159" >> $(METADATA) # Fedora 38 - @echo "Bug: RHEL-16715" >> $(METADATA) # RHEL-8 - @echo "Bug: RHEL-16716" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-localed/main.fmf b/selinux-policy/systemd-localed/main.fmf deleted file mode 100644 index 5b5fa64..0000000 --- a/selinux-policy/systemd-localed/main.fmf +++ /dev/null @@ -1,41 +0,0 @@ -summary: SELinux interferes with systemd-localed and localectl -test: ./runtest.sh -framework: beakerlib -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - systemd -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2240159 - - verifies: https://issues.redhat.com/browse/RHEL-16715 - - verifies: https://issues.redhat.com/browse/RHEL-16716 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0615919 -id: c61c5a74-f9d6-4d1f-b1cc-a7a25b0f3ec7 diff --git a/selinux-policy/systemd-localed/runtest.sh b/selinux-policy/systemd-localed/runtest.sh deleted file mode 100755 index 579438d..0000000 --- a/selinux-policy/systemd-localed/runtest.sh +++ /dev/null @@ -1,55 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SERVICE_PACKAGE="systemd" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop systemd-localed - rlFileBackup --clean --missing-ok /etc/X11/xorg.conf.d - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! ( rlIsRHEL 9 && rlIsRHEL "<9.4" ) ; then - rlPhaseStartTest "bz#2240159 + RHEL-16715 + RHEL-16716" - rlSEMatchPathCon "/usr/lib/systemd/systemd-localed" "systemd_localed_exec_t" - rlSEMatchPathCon "/etc/X11/xorg.conf.d" "xserver_etc_t" - rlSESearchRule "allow systemd_localed_t xserver_etc_t : dir { create } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/systemd-localed.service ] ; then - rlPhaseStartTest "real scenario -- bz#2240159" - if [ -d /etc/X11/xorg.conf.d ] ; then - rlRun "rpm -qf /etc/X11/xorg.conf.d" 0,1 - rlRun "rm -rf /etc/X11/xorg.conf.d" - fi - rlRun "service systemd-localed start" - rlRun "service systemd-localed status" - rlRun "localectl set-x11-keymap us" - rlRun "ls -lZ /etc/X11/xorg.conf.d" - rlRun "service systemd-localed stop" - rlRun "service systemd-localed status" 3 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore systemd-localed - rlPhaseEnd -rlJournalEnd - diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile deleted file mode 100644 index f99a7c8..0000000 --- a/selinux-policy/systemd-machined-and-similar/Makefile +++ /dev/null @@ -1,80 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-machined-and-similar -# Description: SELinux interferes with systemd-machined and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-machined-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.cil - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with systemd-machined and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd-container /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 1847545" >> $(METADATA) # Fedora 32 - @echo "Bug: 1900869" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900888" >> $(METADATA) # Fedora 35 - @echo "Bug: RHEL-49567" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-74280" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-76352" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-77087" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-78088" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-85379" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-86528" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-105966" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-108849" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-machined-and-similar/PURPOSE b/selinux-policy/systemd-machined-and-similar/PURPOSE deleted file mode 100644 index 5f4a9e8..0000000 --- a/selinux-policy/systemd-machined-and-similar/PURPOSE +++ /dev/null @@ -1,6 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/systemd-machined-and-similar -Author: Milos Malik - -SELinux interferes with systemd-machined and related programs. - -Related programs: machinectl. diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf deleted file mode 100644 index b6f7ebe..0000000 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ /dev/null @@ -1,55 +0,0 @@ -summary: SELinux interferes with systemd-machined and related programs -description: |+ - SELinux interferes with systemd-machined and related programs. - -contact: Milos Malik -component: - - selinux-policy - - systemd -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd-container - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - failinfedora - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1847545 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900869 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900888 - - verifies: https://issues.redhat.com/browse/RHEL-49567 - - verifies: https://issues.redhat.com/browse/RHEL-74280 - - verifies: https://issues.redhat.com/browse/RHEL-76352 - - verifies: https://issues.redhat.com/browse/RHEL-77087 - - verifies: https://issues.redhat.com/browse/RHEL-78088 - - verifies: https://issues.redhat.com/browse/RHEL-85379 - - verifies: https://issues.redhat.com/browse/RHEL-86528 - - verifies: https://issues.redhat.com/browse/RHEL-105966 - - verifies: https://issues.redhat.com/browse/RHEL-108849 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 - because: the systemd-machined program is not available there -extra-summary: /CoreOS/selinux-policy/Regression/systemd-machined-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-machined-and-similar -extra-nitrate: TC#0614355 -id: 3aff16de-7ca9-41eb-9676-9c2236fc92f1 diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh deleted file mode 100755 index 4fa2ecf..0000000 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ /dev/null @@ -1,193 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-machined-and-similar -# Description: SELinux interferes with systemd-machined and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/lib/systemd/systemd-machined" -FILE_CONTEXT="systemd_machined_exec_t" -SERVICE_PACKAGE="systemd-container" -SERVICE_NAME="systemd-machined" -PROCESS_NAME="systemd-machined" -PROCESS_CONTEXT="systemd_machined_t" -TEST_POLICY_NEEDED=${TEST_POLICY_NEEDED:-false} -INSTALL_OPTION="" -if yum --help | grep -q use-host-config ; then - INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" -fi -if yum install --help | grep -q skip-broken ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" -fi -if yum install --help | grep -q skip-unavailable ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" -fi - -rlJournalStart - if [ ! -f ${FILE_PATH} ] ; then - rlLog "The required program is not installed. Quitting..." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - - if rlIsFedora ; then - rlPhaseStartTest "bz#1847545" - rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1900869 + bz#1900888" - rlSESearchRule "allow system_dbusd_t devpts_t : chr_file { read write } [ ]" - rlSESearchRule "allow systemd_machined_t devpts_t : chr_file { open read write ioctl } [ ]" - rlSESearchRule "allow systemd_machined_t systemd_machined_t : cap_userns { sys_ptrace sys_admin setgid setuid } [ ]" - rlSESearchRule "allow systemd_machined_t tmpfs_t : lnk_file { getattr read } [ ]" - rlSESearchRule "allow systemd_machined_t tmpfs_t : sock_file { write } [ ]" - rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" - rlSESearchRule "allow systemd_machined_t unconfined_service_t : file { getattr open read ioctl } [ ]" - rlSESearchRule "allow systemd_machined_t unconfined_service_t : lnk_file { getattr read } [ ]" - rlSESearchRule "allow systemd_machined_t unconfined_service_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "RHEL-49567" - rlSEMatchPathCon "/usr/lib/systemd/systemd-machined" "systemd_machined_exec_t" - if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then - rlSEMatchPathCon "/run/systemd/machine" "systemd_machined_var_run_t" - rlSEMatchPathCon "/run/systemd/machine/io.systemd.Machine" "systemd_machined_var_run_t" - rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : dir { create } [ ]" - rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : sock_file { create unlink } [ ]" - fi - rlRun "machinectl" - rlPhaseEnd - - if rlIsRHEL 10 || rlIsCentOS 10 ; then - rlPhaseStartTest "RHEL-74280" - rlSEMatchPathCon "/dev/vsock" "vsock_device_t" - rlSESearchRule "allow systemd_machined_t vsock_device_t : chr_file { getattr open read ioctl } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL "<9.6" && ! rlIsCentOS 8 ; then - rlPhaseStartTest "RHEL-76352 + RHEL-77087 + RHEL-78088" - rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" - rlSESearchRule "allow systemd_machined_t unconfined_service_t : file { getattr open read ioctl } [ ]" - rlSESearchRule "allow systemd_machined_t systemd_machined_t : cap_userns { kill } [ ]" - rlPhaseEnd - fi - - if ! rlIsRHEL "<9.7" && ! rlIsCentOS 8 ; then - rlPhaseStartTest "RHEL-85379 + RHEL-86528" - rlSESearchRule "allow system_dbusd_t systemd_machined_var_lib_t : dir { read } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- bz#1900869 + bz#1900888" - rlRun "mkdir -pZ /var/lib/machines/test" - rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal ${INSTALL_OPTION}" - rlRun "restorecon -Rv /var/lib/machines" - if ${TEST_POLICY_NEEDED} ; then - rlRun "semodule -i testpolicy.cil" - rlRun "semodule -lfull | grep testpolicy" - fi - rlRun "systemctl start systemd-nspawn@test" - rlRun "systemctl status systemd-nspawn@test" - rlRun "ps -efZ | grep -e ${PROCESS_CONTEXT} -e unconfined_service_t" - rlRun "machinectl list" - rlRun "machinectl status test" - rlRun "journalctl -M test --system" - rlRun "journalctl -M test --user" - rlWatchdog "machinectl login test" 20 - rlRun "machinectl list-images" - rlRun "machinectl image-status test" - if rlIsFedora ; then - rlRun "rm -f /tmp/id" - rlRun "machinectl copy-to test /usr/bin/id /tmp/id" - rlRun "machinectl copy-from test /usr/bin/id /tmp/id" - fi - rlRun "machinectl reboot test" - sleep 15 - rlRun "machinectl status test" - rlRun "machinectl kill test" - rlRun "machinectl terminate test" - rlRun "systemctl stop systemd-nspawn@test" - if ${TEST_POLICY_NEEDED} ; then - rlRun "semodule -r testpolicy" - rlRun "semodule -lfull | grep testpolicy" 1 - fi - rlRun "rm -rf /var/lib/machines/test" - rlPhaseEnd - - rlPhaseStartTest "RHEL-105966 + RHEL-108849" - rlRun "mkdir -pZ /var/lib/machines/test" - rlRun "machinectl list-images" - rlRun "machinectl image-status test" - rlRun "rm -rf /var/lib/machines/test" - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-machined-and-similar/testpolicy.cil b/selinux-policy/systemd-machined-and-similar/testpolicy.cil deleted file mode 100644 index 72b42c7..0000000 --- a/selinux-policy/systemd-machined-and-similar/testpolicy.cil +++ /dev/null @@ -1,14 +0,0 @@ -( allow systemd_machined_t unconfined_service_t ( dir ( search ))) -( allow systemd_machined_t unconfined_service_t ( file ( getattr open read ioctl ))) -( allow systemd_machined_t unconfined_service_t ( lnk_file ( getattr read ))) -( allow systemd_machined_t systemd_machined_t ( cap_userns ( sys_ptrace sys_admin setgid setuid kill ))) -( allow systemd_machined_t tmpfs_t ( lnk_file ( getattr read ))) -( allow systemd_machined_t devpts_t ( chr_file ( open read write ioctl ))) -( allow systemd_machined_t tmpfs_t ( sock_file ( write ))) -( allow system_dbusd_t devpts_t ( chr_file ( read write ))) -( allow systemd_machined_t unconfined_service_t ( unix_stream_socket ( connectto ))) -( allow systemd_machined_t systemd_unit_file_t ( service ( stop ))) -( allow systemd_machined_t tmp_t ( file ( create getattr open write append ioctl setattr ))) -( allow systemd_machined_t tmpfs_t ( file ( create getattr open write append ioctl setattr ))) -( allow systemd_machined_t systemd_machined_t ( capability ( chown fowner fsetid ))) - diff --git a/selinux-policy/systemd-modules-load-and-similar/Makefile b/selinux-policy/systemd-modules-load-and-similar/Makefile index 610e027..aeca98e 100644 --- a/selinux-policy/systemd-modules-load-and-similar/Makefile +++ b/selinux-policy/systemd-modules-load-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit /usr/sbin/service libselinux libselinux-utils policycoreutils rdma-core selinux-policy selinux-policy-targeted setools-console openssh-clients systemd-udev" >> $(METADATA) + @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console openssh-clients systemd-udev" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -74,17 +74,7 @@ $(METADATA): Makefile @echo "Bug: 1697632" >> $(METADATA) # Fedora 30 @echo "Bug: 1698200" >> $(METADATA) # Fedora 30 @echo "Bug: 1699559" >> $(METADATA) # Fedora 30 - @echo "Bug: 1819161" >> $(METADATA) # Fedora 32 @echo "Bug: 1823246" >> $(METADATA) # RHEL-8 - @echo "Bug: 1824196" >> $(METADATA) # Fedora 32 - @echo "Bug: 1829700" >> $(METADATA) # Fedora 32 - @echo "Bug: 1833502" >> $(METADATA) # Fedora 32 - @echo "Bug: 1838933" >> $(METADATA) # Fedora 32 - @echo "Bug: 1942267" >> $(METADATA) # Fedora 32 - @echo "Bug: 1972372" >> $(METADATA) # RHEL 9 - @echo "Bug: 2088257" >> $(METADATA) # RHEL-9 - @echo "Bug: 2088258" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-54591" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index 47cfd95..4fdb6c5 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -1,67 +1,2 @@ -summary: SELinux interferes with the systemd-modules-load service and related programs -description: |+ - SELinux interferes with the systemd-modules-load service and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - /usr/sbin/service - - libselinux - - libselinux-utils - - policycoreutils - - rdma-core - - selinux-policy - - selinux-policy-targeted - - setools-console - - openssh-clients - - systemd-udev -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - f33friendly - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358526 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358960 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1360157 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1360488 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1437153 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1438253 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1490015 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1493293 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697632 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1698200 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699559 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1819161 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823246 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1824196 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829700 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1833502 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838933 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1942267 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1972372 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1850953 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088257 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088258 - - verifies: https://issues.redhat.com/browse/RHEL-54591 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 - continue: false -extra-nitrate: TC#0607299 -extra-summary: /CoreOS/selinux-policy/Regression/systemd-modules-load-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-modules-load-and-similar -id: d8407e18-66fb-417e-843e-72fb040fb03e +path: /selinux-policy/systemd-modules-load-and-similar +tier: 2 diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 455b6b1..b345047 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -41,7 +42,7 @@ KERNEL_MODULE="nf_conntrack_pptp" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -98,63 +99,17 @@ rlJournalStart rlSESearchRule "allow systemd_modules_load_t bin_t : file { execute execute_no_trans map } [ ]" rlPhaseEnd - rlPhaseStartTest "bz#1819161 + bz#1824196 + bz#1829700 + bz#1833502 + bz#1838933 + bz#1972372" - rlSEMatchPathCon "/sys/firmware/efi/efivars" "efivarfs_t" - rlSESearchRule "allow systemd_modules_load_t efivarfs_t : file { getattr open read } [ ]" - rlSESearchRule "allow systemd_resolved_t efivarfs_t : file { getattr open read } [ ]" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" - if ! rlIsRHEL "<9.6" ; then - rlRun "mkdir -p /run/modprobe.d" - rlRun "echo 'blacklist cipher_null' > /run/modprobe.d/test.conf" - rlRun "restorecon -Rv /run/modprobe.d" - fi rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "echo ${KERNEL_MODULE} > /etc/modules-load.d/${KERNEL_MODULE}.conf" rlRun "lsmod" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "lsmod | grep ${KERNEL_MODULE}" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 rlRun "lsmod" rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf" - rlRun "rm -f /run/modprobe.d/test.conf" rlPhaseEnd - fi - - if modinfo `grep ^ib /etc/rdma/modules/rdma.conf` >& /dev/null ; then - rlPhaseStartTest "bz#1942267" - tst_Time="$(date '+%T')" - # Install kernel-module matching the running kernel version - rlRun "dnf -y install kernel-modules-$(uname -r)" 0,1 - rlRun "systemctl start rdma-load-modules@rdma.service" - rlRun "systemctl status rdma-load-modules@rdma.service" - rlRun "lsmod | grep rdma" - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 - rlRun "systemctl stop rdma-load-modules@rdma.service" - rlPhaseEnd - fi - - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then - rlPhaseStartTest "bz#2088257 + bz#2088258" - rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t" - rlSEMatchPathCon "/dev/kmsg" "kmsg_device_t" - rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t" - rlSESearchRule "allow systemd_modules_load_t syslogd_t : unix_dgram_socket { sendto } [ ]" - rlSESearchRule "allow systemd_modules_load_t kmsg_device_t : chr_file { write } [ ]" - rlPhaseEnd - - if ! ( rlIsRHEL 9 && rlIsRHEL "<9.6" ) ; then - rlPhaseStartTest "RHEL-54591" - rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t" - rlSEMatchPathCon "/run/modprobe.d" "modules_conf_t" - rlSEMatchPathCon "/run/modprobe.d/fips.conf" "modules_conf_t" - rlSESearchRule "allow systemd_modules_load_t modules_conf_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-mountfsd-and-similar/Makefile b/selinux-policy/systemd-mountfsd-and-similar/Makefile deleted file mode 100644 index 5e6e54e..0000000 --- a/selinux-policy/systemd-mountfsd-and-similar/Makefile +++ /dev/null @@ -1,67 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar -# Description: SELinux interferes with systemd-mountfsd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with systemd-mountfsd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd systemd-container /usr/sbin/service nmap-ncat" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9 -RHEL10" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-mountfsd-and-similar/PURPOSE b/selinux-policy/systemd-mountfsd-and-similar/PURPOSE deleted file mode 100644 index 347a3c1..0000000 --- a/selinux-policy/systemd-mountfsd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar -Author: Milos Malik - -SELinux interferes with systemd-mountfsd and related programs - diff --git a/selinux-policy/systemd-mountfsd-and-similar/main.fmf b/selinux-policy/systemd-mountfsd-and-similar/main.fmf deleted file mode 100644 index 35fd694..0000000 --- a/selinux-policy/systemd-mountfsd-and-similar/main.fmf +++ /dev/null @@ -1,47 +0,0 @@ -summary: SELinux interferes with systemd-mountfsd and related programs -description: |+ - SELinux interferes with systemd-mountfsd and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd - - systemd-container - - /usr/sbin/service - - nmap-ncat -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - NoRHEL9 - - targeted - - NoRHIVOS -adjust+: - - enabled: false - when: distro <= fedora-40 - continue: false - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-9, centos-stream-9, rhel-10, centos-stream-10 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar -extra-nitrate: TC#0617898 -id: c1075a93-3218-475b-9aa2-ea0d1792d853 diff --git a/selinux-policy/systemd-mountfsd-and-similar/runtest.sh b/selinux-policy/systemd-mountfsd-and-similar/runtest.sh deleted file mode 100755 index 0388f63..0000000 --- a/selinux-policy/systemd-mountfsd-and-similar/runtest.sh +++ /dev/null @@ -1,97 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar -# Description: SELinux interferes with systemd-mountfsd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/lib/systemd/systemd-mountfsd" -SERVICE_PACKAGE="systemd" -SERVICE_NAME="systemd-mountfsd" -PROCESS_NAME="systemd-mountfsd" -PROCESS_CONTEXT="systemd_mountfsd_t" -FILE_CONTEXT="systemd_mountfsd_exec_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for OSes where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then - rlPhaseStartTest "real scenario -- socket activation" - rlRun "systemctl enable ${SERVICE_NAME}.socket" - rlRun "systemctl start ${SERVICE_NAME}.socket" - ( tail -f - | ncat -U /run/systemd/io.systemd.MountFileSystem ) & - PROVOCATEUR_PID=$! - sleep 1 - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" - rlRun "kill -9 ${PROVOCATEUR_PID}" - rlRun "killall ncat" 0,1 - if pgrep ncat >& /dev/null ; then - rlRun "killall ncat" 0-255 - fi - rlRun "systemctl stop ${SERVICE_NAME}.socket" - rlRun "systemctl disable ${SERVICE_NAME}.socket" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-notify-and-similar/Makefile b/selinux-policy/systemd-notify-and-similar/Makefile deleted file mode 100644 index b8c2da8..0000000 --- a/selinux-policy/systemd-notify-and-similar/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-notify-and-similar -# Description: SELinux interferes with systemd-notify and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-notify-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE local-notifier.service notifier.sh reproducer.service ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh notifier.sh - chcon -t bin_t runtest.sh notifier.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with systemd-notify and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit expect libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 1903305" >> $(METADATA) # Fedora 33 - @echo "Bug: RHEL-25514" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-25605" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-notify-and-similar/PURPOSE b/selinux-policy/systemd-notify-and-similar/PURPOSE deleted file mode 100644 index b236d83..0000000 --- a/selinux-policy/systemd-notify-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/systemd-notify-and-similar -Author: Milos Malik - -SELinux interferes with systemd-notify and related programs. - diff --git a/selinux-policy/systemd-notify-and-similar/local-notifier.service b/selinux-policy/systemd-notify-and-similar/local-notifier.service deleted file mode 100644 index db5a1b4..0000000 --- a/selinux-policy/systemd-notify-and-similar/local-notifier.service +++ /dev/null @@ -1,7 +0,0 @@ -[Unit] -Description=Local notifier service - -[Service] -Type=oneshot -ExecStart=/usr/local/bin/notifier.sh - diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf deleted file mode 100644 index 1e90e1c..0000000 --- a/selinux-policy/systemd-notify-and-similar/main.fmf +++ /dev/null @@ -1,49 +0,0 @@ -summary: SELinux interferes with systemd-notify and related programs -description: |+ - SELinux interferes with systemd-notify and related programs - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - expect - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS - - avoidImageMode -tier: 2 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1903305 - - verifies: https://issues.redhat.com/browse/RHEL-25514 - - verifies: https://issues.redhat.com/browse/RHEL-25605 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/systemd-notify-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-notify-and-similar -extra-nitrate: TC#0613581 -id: df53f93f-8f04-4575-940e-30c243d47d2d diff --git a/selinux-policy/systemd-notify-and-similar/notifier.sh b/selinux-policy/systemd-notify-and-similar/notifier.sh deleted file mode 100755 index e8d7554..0000000 --- a/selinux-policy/systemd-notify-and-similar/notifier.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash -id -Z -NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready -NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready - diff --git a/selinux-policy/systemd-notify-and-similar/reproducer.service b/selinux-policy/systemd-notify-and-similar/reproducer.service deleted file mode 100644 index 58ec78c..0000000 --- a/selinux-policy/systemd-notify-and-similar/reproducer.service +++ /dev/null @@ -1,5 +0,0 @@ -[Service] -Type=notify -NotifyAccess=all -ExecStart=/bin/sh -c "sleep 3; systemd-notify --ready; sleep 30" - diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh deleted file mode 100755 index 45a16b4..0000000 --- a/selinux-policy/systemd-notify-and-similar/runtest.sh +++ /dev/null @@ -1,130 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-notify-and-similar -# Description: SELinux interferes with systemd-notify and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SERVICE_PACKAGE="systemd" -#ALLOWED_USERS="guest_u xguest_u user_u staff_u sysadm_u unconfined_u" -ALLOWED_USERS="sysadm_u unconfined_u" -SYSTEMD_SYSTEM_SERVICE="/etc/systemd/system/local-notifier.service" -SYSTEMD_USER_SERVICE="/etc/systemd/user/local-notifier.service" -SYSTEMD_PAGER="" - -rlJournalStart - rlLog "If this test fails, please contact mmalik on IRC #selinux" - rlLog "This test should fail if tested bugs are NOT fixed yet" - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlSEConfigureSSH - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1903305" - if rlIsFedora "<35"; then - rlSEMatchPathCon "/usr/bin/systemd-notify" "bin_t" - else # Fedora up to 36 and RHEL - rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" - fi - rlSESearchRule "allow init_t unconfined_t : fifo_file { write } [ ]" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- bz#1903305" - rlRun "NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready" - sleep 1 - rlRun "NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- unconfined or user services use systemd-notify" - rlRun "cp -f notifier.sh /usr/local/bin/" - rlRun "cp -f local-notifier.service /etc/systemd/system/" - rlRun "cp -f local-notifier.service /etc/systemd/user/" - rlRun "restorecon -v /usr/local/bin/notifier.sh ${SYSTEMD_SYSTEM_SERVICE} ${SYSTEMD_USER_SERVICE}" - rlRun "systemctl daemon-reload" - # run the local-notifier service as a system service - rlRun "systemctl start local-notifier" - sleep 2 - rlRun "systemctl status local-notifier" 3 - # run the same service as a user service - rlRun "setsebool ssh_sysadm_login on" - CREATED_USERS="" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "restorecon -Rv /home/${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user start local-notifier" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user status local-notifier" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl --no-pager --user -u local-notifier" - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" - done - rlRun "setsebool ssh_sysadm_login off" - for USER_NAME in ${CREATED_USERS} ; do - rlRun "userdel -rfZ ${USER_NAME}" - done - # cleanup - rlRun "rm -f /usr/local/bin/notifier.sh ${SYSTEMD_SYSTEM_SERVICE} ${SYSTEMD_USER_SERVICE}" - rlRun "systemctl daemon-reload" - rlPhaseEnd - - if ! rlIsRHEL "<9.5" ; then - rlPhaseStartTest "RHEL-25514 + RHEL-25605" - rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" - rlSEMatchPathCon "/run/systemd/notify" "init_var_run_t" - rlSESearchRule "allow systemd_notify_t systemd_notify_t : capability { sys_admin } [ ]" - rlSESearchRule "allow systemd_notify_t kernel_t : unix_dgram_socket { sendto } [ ]" - - rlRun "cp -f ./reproducer.service /etc/systemd/system/" - rlRun "systemctl daemon-reload" - rlRun "service reproducer start" - rlRun -s "service reproducer status -l" - rlRun "grep -i 'failed.*notify.*permission.*denied' $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlRun "rm -f /etc/systemd/system/reproducer.service" - rlRun "systemctl daemon-reload" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-notify-and-similar/ssh.exp b/selinux-policy/systemd-notify-and-similar/ssh.exp deleted file mode 100755 index 58c9647..0000000 --- a/selinux-policy/systemd-notify-and-similar/ssh.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 15 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname $command -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/systemd-nspawn-coredump/main.fmf b/selinux-policy/systemd-nspawn-coredump/main.fmf deleted file mode 100644 index b183587..0000000 --- a/selinux-policy/systemd-nspawn-coredump/main.fmf +++ /dev/null @@ -1,26 +0,0 @@ -summary: SELinux interferes with coredump access in systemd-nspawn containers -description: |+ - Test for RHEL-139983 - coredump directory access in systemd-nspawn containers - -contact: Veronika Syncakova -component: - - selinux-policy -require: - - library(selinux-policy/common) - - systemd - - systemd-container -recommend: - - audit - - libselinux - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL8 -link: - - verifies: https://redhat.atlassian.net/browse/RHEL-139983 -adjust+: - - enabled: false - when: distro < rhel-9 diff --git a/selinux-policy/systemd-nspawn-coredump/runtest.sh b/selinux-policy/systemd-nspawn-coredump/runtest.sh deleted file mode 100755 index f59d945..0000000 --- a/selinux-policy/systemd-nspawn-coredump/runtest.sh +++ /dev/null @@ -1,59 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k - -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -INSTALL_OPTION="" -if dnf --help | grep -q use-host-config ; then - INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" -fi -if dnf install --help | grep -q skip-broken ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" -fi -if dnf install --help | grep -q skip-unavailable ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlAssertRpm ${PACKAGE} - rlAssertRpm systemd-container - rlSESetEnforce - rlSESetTimestamp - rlPhaseEnd - - rlPhaseStartTest "RHEL-139983" - rlRun "mkdir -p /var/lib/machines/foo" - rlRun "dnf install -y --installroot /var/lib/machines/foo --nogpgcheck systemd-udev ${INSTALL_OPTION}" - - rlRun "systemd-nspawn -bD /var/lib/machines/foo >/dev/null 2>&1 &" - sleep 2 - rlRun -s "systemd-run -q --wait --pipe -M foo ls -lZ /run/systemd/coredump 2>&1" - rlAssertNotGrep "user_tmp_t" "$rlRun_LOG" -i - # Crash should not cause coredump avc - rlRun "systemd-run -q --wait --pipe -M foo bash -xc 'kill -SEGV \$\$\$\$'" 1-255 - rlRun "machinectl terminate foo" - sleep 2 - rlRun "rm -f /run/systemd/machines/foo" - sleep 2 - - # Same scenario but container started with machinectl - rlRun "machinectl start foo" - sleep 2 - rlRun -s "systemd-run -q --wait --pipe -M foo ls -lZ /run/systemd/coredump 2>&1" - rlAssertNotGrep "tmpfs_t" "$rlRun_LOG" -i - rlRun "systemd-run -q --wait --pipe -M foo bash -xc 'kill -SEGV \$\$\$\$'" 1-255 - rlRun "machinectl terminate foo" - sleep 2 - rlRun "rm -f /run/systemd/machines/foo" - rlRun "rm -rf /var/lib/machines/foo" - rm -f $rlRun_LOG - rlPhaseEnd - - rlPhaseStartCleanup - rlSECheckAVC - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/selinux-policy/systemd-nsresourced-and-similar/Makefile b/selinux-policy/systemd-nsresourced-and-similar/Makefile deleted file mode 100644 index b87f21b..0000000 --- a/selinux-policy/systemd-nsresourced-and-similar/Makefile +++ /dev/null @@ -1,68 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar -# Description: SELinux interferes with systemd-nsresourced and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with systemd-nsresourced and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service nmap-ncat" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9 -RHEL10" >> $(METADATA) - @echo "Bug: 2290477" >> $(METADATA) # Fedora 41 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-nsresourced-and-similar/PURPOSE b/selinux-policy/systemd-nsresourced-and-similar/PURPOSE deleted file mode 100644 index 7b0591c..0000000 --- a/selinux-policy/systemd-nsresourced-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar -Author: Milos Malik - -SELinux interferes with systemd-nsresourced and related programs - diff --git a/selinux-policy/systemd-nsresourced-and-similar/main.fmf b/selinux-policy/systemd-nsresourced-and-similar/main.fmf deleted file mode 100644 index 62b0f5e..0000000 --- a/selinux-policy/systemd-nsresourced-and-similar/main.fmf +++ /dev/null @@ -1,48 +0,0 @@ -summary: SELinux interferes with systemd-nsresourced and related programs -description: |+ - SELinux interferes with systemd-nsresourced and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd - - /usr/sbin/service - - nmap-ncat -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - NoRHEL9 - - targeted - - NoRHIVOS -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2290477 -adjust+: - - enabled: false - when: distro <= fedora-40 - continue: false - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-9, centos-stream-9, rhel-10, centos-stream-10 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar -extra-nitrate: TC#0617562 -id: fec4eaaf-8812-4d12-b915-e8dd2228d895 diff --git a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh deleted file mode 100755 index 9fb618c..0000000 --- a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh +++ /dev/null @@ -1,117 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar -# Description: SELinux interferes with systemd-nsresourced and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/lib/systemd/systemd-nsresourced" -SERVICE_PACKAGE="systemd" -SERVICE_NAME="systemd-nsresourced" -PROCESS_NAME="systemd-nsresourced" -PROCESS_CONTEXT="systemd_nsresourced_t" -FILE_CONTEXT="systemd_nsresourced_exec_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if seinfo -t | grep -q systemd_nsresourced ; then - rlPhaseStartTest "bz#2290477" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - SOURCE_TYPE="init_t" # systemd runs the process - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow abrt_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow accountsd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow auditd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow cupsd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow init_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow local_login_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow policykit_auth_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow setroubleshootd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow staff_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "allow xdm_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for OSes where the SELinux domain does not exist yet - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then - rlPhaseStartTest "real scenario -- socket activation" - rlRun "systemctl enable ${SERVICE_NAME}.socket" - rlRun "systemctl start ${SERVICE_NAME}.socket" - ( tail -f - | ncat -U /run/systemd/io.systemd.NamespaceResource ) & - PROVOCATEUR_PID=$! - sleep 1 - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" - rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" - rlRun "kill -9 ${PROVOCATEUR_PID}" - rlRun "killall ncat" 0,1 - if pgrep ncat >& /dev/null ; then - rlRun "killall ncat" 0-255 - fi - rlRun "systemctl stop ${SERVICE_NAME}.socket" - rlRun "systemctl disable ${SERVICE_NAME}.socket" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-oomd/Makefile b/selinux-policy/systemd-oomd/Makefile deleted file mode 100644 index f1cb2e5..0000000 --- a/selinux-policy/systemd-oomd/Makefile +++ /dev/null @@ -1,80 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Sanity/systemd-oomd -# Description: Testing systemd-oomd service -# Author: Zdenek Pytela -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Sanity/systemd-oomd -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh-sleep40.exp ssh-nosleep.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Zdenek Pytela " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Testing systemd-oomd" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit" >> $(METADATA) - @echo "Requires: expect" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Requires: systemd-oomd" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Environment: SYSTEMD_PAGER=\"\"" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Releases: -RHEL5" >> $(METADATA) - @echo "Releases: -RHEL6" >> $(METADATA) - @echo "Releases: -RHEL7" >> $(METADATA) - @echo "Releases: -RHEL8" >> $(METADATA) - @echo "Releases: -RHEL9" >> $(METADATA) - @echo "Bug: RHEL-106998" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-oomd/PURPOSE b/selinux-policy/systemd-oomd/PURPOSE deleted file mode 100644 index 90bc7a4..0000000 --- a/selinux-policy/systemd-oomd/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Sanity/systemd-oomd -Author: Zdenek Pytela - -Test systemd-oomd service - diff --git a/selinux-policy/systemd-oomd/main.fmf b/selinux-policy/systemd-oomd/main.fmf deleted file mode 100644 index 239bb8e..0000000 --- a/selinux-policy/systemd-oomd/main.fmf +++ /dev/null @@ -1,43 +0,0 @@ -summary: systemd-oomd - userspace out-of-memory (OOM) killer -description: |+ - Testing systemd-oomd service - -contact: Zdenek Pytela -component: - - selinux-policy - - systemd -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - expect - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd-oomd -environment: - AVC_ERROR: +no_avc_check -duration: 5m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - NoRHEL9 - - TierCandidatesPASS - - targeted - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-106998 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 - continue: false diff --git a/selinux-policy/systemd-oomd/runtest.sh b/selinux-policy/systemd-oomd/runtest.sh deleted file mode 100755 index e7f74e9..0000000 --- a/selinux-policy/systemd-oomd/runtest.sh +++ /dev/null @@ -1,156 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Sanity/systemd-oomd -# Description: Testing systemd-oomd service -# Author: Zdenek Pytela -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -if ! grep psi=1 /proc/cmdline ; then - grubby --update-kernel ALL --args psi=1 - sync - tmt-reboot -fi - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SERVICE_PACKAGE="systemd-oomd" -SERVICE_NAME="systemd-oomd" -FILE_PATH="/usr/lib/systemd/systemd-oomd" -FILE_CONTEXT="systemd_oomd_exec_t" -PROCESS_NAME="systemd-oomd" -PROCESS_CONTEXT="systemd_oomd_t" - -### systemd-oomd is a system service that uses cgroups-v2 and pressure stall -### information (PSI) to monitor and take a corrective action before an OOM occurs -### in the kernel space. -### Monitoring and actions on units can be enabled by setting ManagedOOMSwap= -### and ManagedOOMMemoryPressure=. Cgroups of units with ManagedOOMSwap= or -### ManagedOOMMemoryPressure= set to kill will be monitored. - -rlJournalStart - if [ ! -x ${FILE_PATH} ]; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlSEConfigureSSH - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - rlRun "cat /etc/system-release" - rlRun "uname -a" - rlRun "rpm -qa | grep -e selinux-policy -e systemd | sort" - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - # Is the service SELinux confined? - CONTEXT=$(stat -c"%C" "${FILE_PATH}") - if [[ ${CONTEXT} =~ ":init_exec_t:" ]] ; then - rlLog "The ${SERVICE_NAME} service is not SELinux confined." - else - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSESearchRule "allow systemd_oomd_t proc_psi_t : file { getattr ioctl lock open read } [ ]" - rlSESearchRule "allow systemd_oomd_t domain : dir { getattr ioctl lock open read search } [ ]" - rlSESearchRule "allow systemd_oomd_t domain : file { getattr ioctl lock open read } [ ]" - rlSESearchRule "allow systemd_oomd_t cgroup_t : dir { getattr ioctl lock open read search setattr write } [ ]" - rlSESearchRule "allow systemd_oomd_t domain : process { sigkill } [ ]" - rlSESearchRule "allow systemd_oomd_t self : capability { kill } [ ]" - fi - rlPhaseEnd - - ### Basic systemd-oomd setup - ### https://fedoraproject.org/wiki/Changes/EnableSystemdOomd#How_to_test - rlPhaseStartTest "Real scenario" - - # sd-oomd conflicts earlyoom - if systemctl list-unit-files earlyoom.service &>/dev/null; then - rlRun "systemctl disable --now --quiet earlyoom.service" - fi - rlRun "systemctl enable --now ${SERVICE_NAME}" - rlRun "systemctl status ${SERVICE_NAME}" - - # enable swap-based killing on all units in the root slice - mkdir -p /etc/systemd/system/-.slice.d - cat >> /etc/systemd/system/-.slice.d/override.conf << EOF -[Slice] -ManagedOOMSwap=kill -EOF - - # memory pressure example settings - mkdir -p /etc/systemd/system/user@.service.d - cat >> /etc/systemd/system/user@.service.d/override.conf << EOF -[Service] -ManagedOOMMemoryPressure=kill -ManagedOOMMemoryPressureLimit=10% -EOF - - rlRun "systemctl daemon-reload" - rlRun "systemctl restart ${SERVICE_NAME}" - rlRun "systemctl status ${SERVICE_NAME}" - - # create a user and run a stress test - it can hang the system for a while - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3T${RANDOM}" - rlRun "useradd -G systemd-journal ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - - USER_ID=$(id -u ${USER_NAME}) - SYSTEM_SERVICE_NAME="user@${USER_ID}.service" - USER_SERVICE_NAME="useroomcheck-${RANDOM}.service" - rlRun "./ssh-sleep40.exp ${USER_NAME} ${USER_SECRET} localhost systemd-run --user -u ${USER_SERVICE_NAME} tail /dev/zero" - - rlLog "Checking journal for the oom killer string" - rlRun "./ssh-nosleep.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -u ${USER_SERVICE_NAME} -g \"A process of this unit has been killed by the OOM killer\"" - rlRun "./ssh-nosleep.exp ${USER_NAME} ${USER_SECRET} localhost journalctl --user -u ${USER_SERVICE_NAME} -g \"A process of this unit has been killed by the OOM killer\"" - - rlRun "systemctl status ${SERVICE_NAME}" - if [ "${DEBUG}" = "yes" ]; then - rlLog "Displaying list of monitored cgroups and pressure information" - rlRun "oomctl dump" - rlLog "Displaying journal content for the system ${SYSTEM_SERVICE_NAME} service" - rlRun "journalctl -u ${SYSTEM_SERVICE_NAME}" - rlLog "Displaying journal content for the user ${USER_SERVICE_NAME} service" - rlRun "./ssh-nosleep.exp ${USER_NAME} ${USER_SECRET} localhost journalctl --user -u ${USER_SERVICE_NAME}" - fi - rlPhaseEnd - - ### cleanup, restoring the previous content - rlPhaseStartCleanup - rlRun "userdel -rf ${USER_NAME}" - rm -f /etc/systemd/system/-.slice.d/override.conf - rm -f /etc/systemd/system/user@.service.d/override.conf - rlRun "systemctl daemon-reload" - rlSECheckAVC - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-oomd/ssh-nosleep.exp b/selinux-policy/systemd-oomd/ssh-nosleep.exp deleted file mode 100755 index 33e5d4f..0000000 --- a/selinux-policy/systemd-oomd/ssh-nosleep.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 30 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname "$command" -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/systemd-oomd/ssh-sleep40.exp b/selinux-policy/systemd-oomd/ssh-sleep40.exp deleted file mode 100755 index 69563d6..0000000 --- a/selinux-policy/systemd-oomd/ssh-sleep40.exp +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/expect -f -# Expect script for SSH logging as $username to $hostname using $password and executing $command. -# Usage: -# ./ssh.exp username password hostname command -set username [lrange $argv 0 0] -set password [lrange $argv 1 1] -set hostname [lrange $argv 2 2] -set command [lrange $argv 3 10] -set timeout 30 -# connect to remote host and execute given command -log_user 1 -spawn ssh -t $username@$hostname "$command ; sleep 40" -expect { - -nocase "yes/no" { send -- "yes\r" ; exp_continue } - -nocase "password" { send -- "$password\r" } -} -log_user 1 -# send -- "\r" -expect eof - diff --git a/selinux-policy/systemd-rfkill-and-similar/Makefile b/selinux-policy/systemd-rfkill-and-similar/Makefile index 05acb33..1c92453 100644 --- a/selinux-policy/systemd-rfkill-and-similar/Makefile +++ b/selinux-policy/systemd-rfkill-and-similar/Makefile @@ -72,7 +72,6 @@ $(METADATA): Makefile @echo "Bug: 1557595" >> $(METADATA) # Fedora 27 @echo "Bug: 1638981" >> $(METADATA) # Fedora 29 @echo "Bug: 1661724" >> $(METADATA) # Fedora 30 - @echo "Bug: 2149390" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf index 31eac8d..ecc2671 100644 --- a/selinux-policy/systemd-rfkill-and-similar/main.fmf +++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf @@ -1,57 +1,5 @@ -summary: SELinux interferes with systemd-rfkill and related programs -description: |+ - SELinux interferes with systemd-rfkill service and related programs. - -contact: Milos Malik -component: - - selinux-policy - - systemd -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd-udev - - initscripts - - procps-ng - - kernel-modules -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass - - f32friendly - - f33friendly - - targeted - - fusa +path: /selinux-policy/systemd-rfkill-and-similar tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1290255 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309839 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1319499 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1388669 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1543650 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1554838 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1557595 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1638981 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1661724 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149390 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 - continue: false -extra-nitrate: TC#0606118 -extra-summary: /CoreOS/selinux-policy/Regression/systemd-rfkill-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-rfkill-and-similar -id: e01aaa07-2437-45d9-b224-5c1d162caec3 +adjust: +- enabled: false + when: distro ~>= fedora-32 diff --git a/selinux-policy/systemd-rfkill-and-similar/runtest.sh b/selinux-policy/systemd-rfkill-and-similar/runtest.sh index bfdc75c..2d027fb 100755 --- a/selinux-policy/systemd-rfkill-and-similar/runtest.sh +++ b/selinux-policy/systemd-rfkill-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -40,18 +41,13 @@ PROCESS_CONTEXT="systemd_rfkill_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} rlRun "rpm -qa kernel\*" rlRun "uname -r" - if ! rlCheckRpm kernel-automotive ; then - rlRun "yum -y install kernel-modules-`uname -r`" 0,1 - else - rlRun "dnf -y install kernel-automotive-modules-`uname -r`" 0,1 - fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -106,13 +102,6 @@ rlJournalStart rlSESearchRule "allow systemd_rfkill_t syslogd_t : unix_dgram_socket { sendto } [ ]" rlPhaseEnd - if [ -f /sys/fs/selinux/class/capability2/perms/bpf ] ; then - rlPhaseStartTest "bz#2149390" - rlSESearchRule "allow systemd_rfkill_t systemd_rfkill_t : capability2 { bpf } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -123,10 +112,9 @@ rlJournalStart fi rlRun "modprobe rfkill" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-run-and-similar/Makefile b/selinux-policy/systemd-run-and-similar/Makefile deleted file mode 100644 index 9fe1e29..0000000 --- a/selinux-policy/systemd-run-and-similar/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-run-and-similar -# Description: SELinux interferes with systemd-run and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-run-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with systemd-run and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 1559409" >> $(METADATA) # Fedora 27 - @echo "Bug: 1647162" >> $(METADATA) # Fedora 29 - @echo "Bug: 1980241" >> $(METADATA) # Fedora 34 - @echo "Bug: 2118784" >> $(METADATA) # RHEL-8 - @echo "Bug: RHEL-61928" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-62185" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-run-and-similar/PURPOSE b/selinux-policy/systemd-run-and-similar/PURPOSE deleted file mode 100644 index 8aee928..0000000 --- a/selinux-policy/systemd-run-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/systemd-run-and-similar -Author: Milos Malik - -SELinux interferes with systemd-run and related programs - diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf deleted file mode 100644 index 5d8cff0..0000000 --- a/selinux-policy/systemd-run-and-similar/main.fmf +++ /dev/null @@ -1,49 +0,0 @@ -summary: SELinux interferes with systemd-run and related programs -description: |+ - SELinux interferes with systemd-run and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1559409 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1647162 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1980241 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118784 - - verifies: https://issues.redhat.com/browse/RHEL-61928 - - verifies: https://issues.redhat.com/browse/RHEL-62185 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-summary: /CoreOS/selinux-policy/Regression/systemd-run-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-run-and-similar -extra-nitrate: TC#0613618 -id: db391b34-07e9-4514-8b8d-aa8ada185e26 diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh deleted file mode 100755 index e4a4fee..0000000 --- a/selinux-policy/systemd-run-and-similar/runtest.sh +++ /dev/null @@ -1,95 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-run-and-similar -# Description: SELinux interferes with systemd-run and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm systemd - rlRun "setsebool daemons_use_tty on" - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1559409 + bz#1647162" - rlSEMatchPathCon "/usr/bin/systemd-run" "bin_t" - rlSESearchRule "allow init_t user_devpts_t : chr_file { setattr open } [ ]" - rlPhaseEnd - - if seinfo --common file -x | grep -q watch ; then - rlPhaseStartTest "bz#1980241" - rlSESearchRule "allow init_t user_devpts_t : chr_file { watch watch_reads } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario" - rlWatchdog "systemd-run -p IPAddressDeny=127.0.0.1 -t /bin/sh" 10 - rlWatchdog "systemd-run --user --pty bash -i" 10 - rlWatchdog "systemd-run --system --pty bash -i" 10 - if systemd-run --help | grep -q -- --shell ; then - rlWatchdog "systemd-run --shell" 10 - fi - rlPhaseEnd - - rlPhaseStartTest "bz#2118784" - rlSEMatchPathCon "/var/lib" "var_lib_t" - rlSEMatchPathCon "/var/lib/myservice0" "var_lib_t" - rlSESearchRule "allow init_t var_lib_t : lnk_file { getattr read } [ ]" - rlRun "setsebool daemons_use_tty on" - rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 touch /var/lib/myservice0/foo" - rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 --pipe wc -c /var/lib/myservice0/foo" - rlRun "ls -alZ /var/lib/myservice0 /var/lib/private/myservice0" - rlRun "setsebool daemons_use_tty off" - rlPhaseEnd - - if ! rlIsRHEL "<9.7" ; then - rlPhaseStartTest "RHEL-61928 + RHEL-62185" - rlSESearchRule "allow system_dbusd_t unconfined_service_t : unix_stream_socket { read write } [ ]" - rlRun -s "systemd-run --wait -- systemd-run --user --machine=adm@ --wait true" - rlRun "grep -i success $rlRun_LOG" - rm -f $rlRun_LOG - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlRun "setsebool daemons_use_tty off" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-sysctl-and-similar/Makefile b/selinux-policy/systemd-sysctl-and-similar/Makefile deleted file mode 100644 index fbb3c30..0000000 --- a/selinux-policy/systemd-sysctl-and-similar/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar -# Description: Does the systemd-sysctl work correctly under SELinux confinement? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - test -x runtest.sh || chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does the systemd-sysctl work correctly under SELinux confinement?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit libselinux-utils policycoreutils selinux-policy setools-console systemd /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA) - @echo "Bug: 2056207" >> $(METADATA) # Fedora 36 - @echo "Bug: 2056999" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-56988" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-58380" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-sysctl-and-similar/PURPOSE b/selinux-policy/systemd-sysctl-and-similar/PURPOSE deleted file mode 100644 index b98a257..0000000 --- a/selinux-policy/systemd-sysctl-and-similar/PURPOSE +++ /dev/null @@ -1,33 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar -Author: Milos Malik - -Does the systemd-sysctl work correctly under SELinux confinement? - -Inputs - -new system service file definition -selinux labels for various files -selinux rules present at the system - -Outputs - -Test passes or fail based on presence of specific selinux labels or rules -or failures related to starting and stopping systemd-sysctl service - -Expected log output example - -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: real scenario -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: - -:: [ 15:14:27 ] :: [ PASS ] :: Command 'service systemd-sysctl start' (Expected 0, got 0) -:: [ 15:14:46 ] :: [ PASS ] :: Command 'service systemd-sysctl status' (Expected 0,1,3, got 0) -:: [ 15:15:15 ] :: [ PASS ] :: Command 'restorecon -Rv /etc /run /var -e /var/ARTIFACTS' (Expected 0-255, got 0) -:: [ 15:15:19 ] :: [ PASS ] :: Command 'service systemd-sysctl restart' (Expected 0, got 0) -:: [ 15:15:38 ] :: [ PASS ] :: Command 'service systemd-sysctl status' (Expected 0,1,3, got 0) -:: [ 15:15:57 ] :: [ PASS ] :: Command 'service systemd-sysctl stop' (Expected 0, got 0) -:: [ 15:16:15 ] :: [ PASS ] :: Command 'service systemd-sysctl status' (Expected 0,1,3, got 3) -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -:: Duration: 127s -:: Assertions: 7 good, 0 bad -:: RESULT: PASS (real scenario) diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf deleted file mode 100644 index 96aa578..0000000 --- a/selinux-policy/systemd-sysctl-and-similar/main.fmf +++ /dev/null @@ -1,44 +0,0 @@ -summary: Does the systemd-sysctl work correctly under SELinux confinement? -description: |+ - Does the systemd-sysctl work correctly under SELinux confinement? - -contact: Milos Malik -component: - - selinux-policy - - systemd -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux-utils - - policycoreutils - - selinux-policy - - setools-console - - systemd - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - fusa -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056207 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056999 - - verifies: https://issues.redhat.com/browse/RHEL-56988 - - verifies: https://issues.redhat.com/browse/RHEL-58380 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0613033 -extra-summary: /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar -id: 11114547-d1b5-47c1-a3ac-2a3729a87b1c diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh deleted file mode 100755 index 5fd8104..0000000 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ /dev/null @@ -1,93 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar -# Description: Does the systemd-sysctl work correctly under SELinux confinement? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -PROCESS_CONTEXT="systemd_sysctl_t" -PROCESS_NAME="systemd-sysctl" -SERVICE_NAME="systemd-sysctl" -SERVICE_PACKAGE="systemd" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then - rlPhaseStartTest "bz#2056207 + bz#2056999" - rlSEMatchPathCon "/usr/lib/systemd/systemd-sysctl" "systemd_sysctl_exec_t" - rlRun "ls -Z /proc/sys/fs/suid_dumpable | grep :proc_security_t" - rlRun "ls -Z /proc/sys/fs/protected_hardlinks | grep :proc_security_t" - rlRun "ls -Z /proc/sys/fs/protected_symlinks | grep :proc_security_t" - rlRun "ls -Z /proc/sys/kernel/kptr_restrict | grep :proc_security_t" - rlSESearchRule "allow systemd_sysctl_t proc_security_t : file { read } [ ]" - rlPhaseEnd - - if ! rlIsRHEL "<9.6" ; then - rlPhaseStartTest "RHEL-56988 + RHEL-58380" - if [ -e "/usr/share/man/man5/sysctl.d.5.gz" ]; then - rlRun "man sysctl.d | grep /run/sysctl" - fi - rlRun "mkdir -pZ /run/sysctl.d" - rlRun "echo 'net.ipv4.conf.eno1.rp_filter=0' > /run/sysctl.d/51-rp_filter.conf" - rlRun "restorecon -Rv /run/sysctl.d" - rlRun "service systemd-sysctl stop" - rlRun "service systemd-sysctl start" - rlRun "service systemd-sysctl status" 0,3 - rlPhaseEnd - fi - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/systemd-timesyncd-and-similar/Makefile b/selinux-policy/systemd-timesyncd-and-similar/Makefile index a5fdcf0..25410b7 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/Makefile +++ b/selinux-policy/systemd-timesyncd-and-similar/Makefile @@ -55,7 +55,8 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service /usr/lib/systemd/systemd-timesyncd" >> $(METADATA) # EPEL + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd-udev initscripts" >> $(METADATA) + @echo "Requires: systemd-timesyncd" >> $(METADATA) # EPEL @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -72,8 +73,6 @@ $(METADATA): Makefile @echo "Bug: 1694272" >> $(METADATA) # Fedora 29 @echo "Bug: 1822131" >> $(METADATA) # Fedora 32 @echo "Bug: 1869979" >> $(METADATA) # RHEL-8 - @echo "Bug: 1949315" >> $(METADATA) # Fedora 34 - @echo "Bug: 2175137" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf index 29a8118..16bf981 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf +++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf @@ -1,63 +1,2 @@ -summary: SELinux interferes with systemd-timesyncd and related programs -description: |+ - SELinux interferes with systemd-timesyncd and related programs. - -contact: Milos Malik -component: - - selinux-policy - - systemd -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - /usr/lib/systemd/systemd-timesyncd -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - TIPpass - - TIPpass_Security - - epel - - rhel8-epel - - rhel9-epel - - targeted - - NoRHIVOS +path: /selinux-policy/systemd-timesyncd-and-similar tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1640801 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649257 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649668 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649671 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1653050 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1666222 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1694272 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1822131 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1869979 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949315 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1970865 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2175137 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 - because: the systemd-timesyncd service is not available there - - enabled: false - when: arch == i386, ppc64, s390 - continue: false -extra-nitrate: TC#0606395 -extra-summary: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar -id: 2cca4aec-eac2-4547-91d0-979541b04f5b diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index bded838..18950fe 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -27,28 +27,25 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" ROOT_PASSWORD="redhat" FILE_PATH="/usr/lib/systemd/systemd-timesyncd" FILE_CONTEXT="systemd_timedated_exec_t" +SERVICE_PACKAGE="systemd-udev" SERVICE_NAME="systemd-timesyncd" PROCESS_NAME="systemd-timesyncd" PROCESS_CONTEXT="systemd_timedated_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - if [ -f ${FILE_PATH} ] ; then - SERVICE_PACKAGE=`rpm -qf ${FILE_PATH} | head -n 1` - rlAssertRpm ${SERVICE_PACKAGE} - else - rlRun "yum -y install ${FILE_PATH}" 0-255 - fi + rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -75,11 +72,10 @@ rlJournalStart if rlIsFedora ; then rlPhaseStartTest "bz#1649671" - rlSEMatchPathCon "/run/systemd/timesync" "systemd_timedated_var_run_t" - rlSEMatchPathCon "/run/systemd/timesync/synchronized" "systemd_timedated_var_run_t" + rlSEMatchPathCon "/run/systemd/timesync" "init_var_run_t" + rlSEMatchPathCon "/run/systemd/timesync/synchronized" "init_var_run_t" rlSESearchRule "allow systemd_timedated_t init_var_run_t : dir { write add_name } [ ]" - rlSESearchRule "allow systemd_timedated_t systemd_timedated_var_run_t : dir { write add_name } [ ]" - rlSESearchRule "allow systemd_timedated_t systemd_timedated_var_run_t : file { create write open } [ ]" + rlSESearchRule "allow systemd_timedated_t init_var_run_t : file { create write open } [ ]" rlPhaseEnd rlPhaseStartTest "bz#1694272" @@ -106,32 +102,15 @@ rlJournalStart rlSESearchRule "allow systemd_timedated_t efivarfs_t : file { getattr open read } [ ]" rlPhaseEnd - if ! rlIsRHEL '<9' && ! rlIsCentOS '<9' ; then - rlPhaseStartTest "bz#1949315" - rlSEMatchPathCon "/" "root_t" - rlSEMatchPathCon "/run" "var_run_t" - rlSESearchRule "allow systemd_timedated_t root_t : dir { watch } [ ]" - rlSESearchRule "allow systemd_timedated_t var_run_t : dir { watch } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2175137" - rlSEMatchPathCon "/usr/lib/systemd/systemd-timesyncd" "systemd_timedated_exec_t" - rlSEMatchPathCon "/run/systemd/" "init_var_run_t" - rlSESearchRule "allow systemd_timedated_t init_var_run_t : dir { watch } [ ]" - rlPhaseEnd - fi - - if systemctl list-unit-files | grep -q ${SERVICE_NAME} ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-tmpfiles-and-similar/Makefile b/selinux-policy/systemd-tmpfiles-and-similar/Makefile deleted file mode 100644 index e30c908..0000000 --- a/selinux-policy/systemd-tmpfiles-and-similar/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar -# Description: SELinux interferes with systemd-tmpfiles and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh ssh.exp - chcon -t bin_t runtest.sh ssh.exp - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with systemd-tmpfiles and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit expect libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service shadow-utils" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: RHEL-40374" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-44191" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-139855" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/systemd-tmpfiles-and-similar/PURPOSE b/selinux-policy/systemd-tmpfiles-and-similar/PURPOSE deleted file mode 100644 index 6f0cf3c..0000000 --- a/selinux-policy/systemd-tmpfiles-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar -Author: Milos Malik - -SELinux interferes with systemd-tmpfiles and related programs. - diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf deleted file mode 100644 index 21cebdf..0000000 --- a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf +++ /dev/null @@ -1,50 +0,0 @@ -summary: SELinux interferes with systemd-tmpfiles and related programs -description: |+ - SELinux interferes with systemd-tmpfiles and related programs - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - expect - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - systemd - - /usr/sbin/service - - shadow-utils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - NoRHIVOS -tier: 2 -link: - - verifies: https://issues.redhat.com/browse/RHEL-40374 - - verifies: https://issues.redhat.com/browse/RHEL-44191 - - verifies: https://issues.redhat.com/browse/RHEL-139855 -adjust+: - - enabled: false - when: distro < rhel-9.5 - continue: false - because: RHEL-40374 is fixed in RHEL-9.5 and RHEL-44191 in RHEL-10 -extra-summary: /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar -extra-nitrate: TC#0617577 -id: 03d8e784-9026-46ef-a48b-0bbed63f7f95 diff --git a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh deleted file mode 100755 index a4fd928..0000000 --- a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh +++ /dev/null @@ -1,106 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar -# Description: SELinux interferes with systemd-tmpfiles and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -SERVICE_PACKAGE="systemd" -ALLOWED_USERS="staff_u sysadm_u unconfined_u" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlSEConfigureSSH - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "RHEL-40374 + RHEL-44191" - rlSEMatchPathCon "/usr/bin/systemd-tmpfiles" "systemd_tmpfiles_exec_t" - if rlSEDefined "staff_t" ; then - rlSESearchRule "allow staff_t systemd_tmpfiles_exec_t : file { getattr open read map execute execute_no_trans } [ ]" - fi - rlRun "setsebool ssh_sysadm_login on" - CREATED_USERS="" - for SELINUX_USER in ${ALLOWED_USERS} ; do - USER_NAME="user${RANDOM}" - USER_SECRET="S3kr3t${RANDOM}" - rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "restorecon -Rv /home/${USER_NAME}" - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user status systemd-tmpfiles-setup.service" - rlRun "grep -i failed $rlRun_LOG" 1 - rm -f $rlRun_LOG - rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user --failed" - rlRun "grep '0 loaded units listed' $rlRun_LOG" - rm -f $rlRun_LOG - CREATED_USERS="${USER_NAME} ${CREATED_USERS}" - done - rlRun "setsebool ssh_sysadm_login off" - for USER_NAME in ${CREATED_USERS} ; do - rlRun "userdel -rfZ ${USER_NAME}" - done - rlPhaseEnd - - rlPhaseStartTest "RHEL-139855" - SOFT_LIMIT=1000 - HARD_LIMIT=1500 - LIMIT_NOFILE="$(systemctl show --value --property DefaultLimitNOFILE)" - LIMIT_NOFILE_SOFT="$(systemctl show --value --property DefaultLimitNOFILESoft)" - rlAssertNotEquals "DefaultLimitNOFILE is set to: ${LIMIT_NOFILE}" $HARD_LIMIT $LIMIT_NOFILE - rlAssertNotEquals "DefaultLimitNOFILESoft is set to: ${LIMIT_NOFILE_SOFT}" $SOFT_LIMIT $LIMIT_NOFILE_SOFT - rlRun "mkdir /run/systemd/system.conf.d/" - rlRun "cat >/run/systemd/system.conf.d/99-NOFILE.conf < -component: - - selinux-policy - - systemd -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - expect - - openssh-clients - - systemd - - /usr/sbin/service - - shadow-utils -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - NoRHEL9 - - targeted - - failinfedora - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1835630 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 - because: the systemd-userdbd program is not available there - - enabled: false - when: distro == fedora-30, fedora-31 - continue: false -extra-nitrate: TC#0606124 -extra-summary: /CoreOS/selinux-policy/Regression/systemd-userdbd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/systemd-userdbd-and-similar -id: 0e50b61f-a399-47d9-b9f3-dd602e8cd88a +path: /selinux-policy/systemd-userdbd-and-similar +tier: 2 +adjust: +- enabled: false + when: distro <= rhel-8 diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index 764eb6b..9fba8c9 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -41,14 +42,15 @@ ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u guest_u xguest_u sysadm_u unconfi DENIED_USERS=${DENIED_USERS:-""} rlJournalStart - if [ ! -f /usr/lib/systemd/systemd-userdbd ] ; then + # the systemd-userdbd service is not available on RHEL-8 + if rlIsRHEL 8 ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -56,7 +58,6 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow - rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -100,19 +101,16 @@ rlJournalStart rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - fi - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then rlPhaseStartTest "real scenario -- ${SERVICE_NAME}.socket" rlRun "systemctl stop systemd-userdbd.socket" rlRun "systemctl status systemd-userdbd.socket" 3 @@ -121,15 +119,13 @@ rlJournalStart rlRun "ls -dZ /run/systemd/userdb | grep :systemd_userdbd_runtime_t" rlRun "ls -Z /run/systemd/userdb/io.systemd.Multiplexer | grep :systemd_userdbd_runtime_t" rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 - rlSECheckAVC --ignore 'type=AVC.*connectto.*userdbctl.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*userdbctl.*:xguest_t:.*:systemd_machined_t:' + rlSECheckAVC rlFileRestore rlServiceRestore ${SERVICE_NAME} - rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/targetd-and-similar/Makefile b/selinux-policy/targetd-and-similar/Makefile deleted file mode 100644 index 85311e7..0000000 --- a/selinux-policy/targetd-and-similar/Makefile +++ /dev/null @@ -1,78 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/targetd-and-similar -# Description: SELinux interferes with targetd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/targetd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with targetd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: targetd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console targetd targetcli lvm2 /usr/sbin/service httpd" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 1063714" >> $(METADATA) # RHEL-7 - @echo "Bug: 1373860" >> $(METADATA) # RHEL-7 - @echo "Bug: 1424621" >> $(METADATA) # RHEL-7 - @echo "Bug: 1486252" >> $(METADATA) # RHEL-7 - @echo "Bug: 1486259" >> $(METADATA) # RHEL-7 - @echo "Bug: 1546671" >> $(METADATA) # RHEL-7 - @echo "Bug: 1569663" >> $(METADATA) # RHEL-8 - @echo "Bug: 2062183" >> $(METADATA) # RHEL-8 - @echo "Bug: 2203720" >> $(METADATA) # RHEL-8 - @echo "Bug: 2222199" >> $(METADATA) # Fedora rawhide - - rhts-lint $(METADATA) - diff --git a/selinux-policy/targetd-and-similar/PURPOSE b/selinux-policy/targetd-and-similar/PURPOSE deleted file mode 100644 index f057996..0000000 --- a/selinux-policy/targetd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/targetd-and-similar -Author: Milos Malik - -SELinux interferes with targetd and related programs. Possible interactions: targetd + btrfs. - diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf deleted file mode 100644 index 4e536e1..0000000 --- a/selinux-policy/targetd-and-similar/main.fmf +++ /dev/null @@ -1,59 +0,0 @@ -summary: SELinux interferes with targetd and related programs -description: |+ - SELinux interferes with targetd and related programs. Possible interactions: targetd + btrfs. - -contact: Milos Malik -component: - - selinux-policy - - targetd -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - targetd - - targetcli - - lvm2 - - /usr/sbin/service - - httpd -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: false -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TierCandidatesPASS - - epel - - rhel8-epel - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1063714 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373860 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1424621 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1486252 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1486259 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1546671 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1569663 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2062183 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2203720 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2222199 -adjust+: - - enabled: true - when: distro == rhel-7, rhel-8, centos-stream-8, fedora - because: the targetd package is not available elsewhere -extra-nitrate: TC#0337221 -extra-summary: /CoreOS/selinux-policy/Regression/targetd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/targetd-and-similar -id: 5fcb6b1a-15d3-4627-95a5-62a49ba2d7e5 diff --git a/selinux-policy/targetd-and-similar/runtest.sh b/selinux-policy/targetd-and-similar/runtest.sh deleted file mode 100755 index ff7dc99..0000000 --- a/selinux-policy/targetd-and-similar/runtest.sh +++ /dev/null @@ -1,209 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/targetd-and-similar -# Description: SELinux interferes with targetd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/bin/targetd" -FILE_CONTEXT="targetd_exec_t" -SERVICE_PACKAGE="targetd" -SERVICE_NAME="targetd" -PROCESS_NAME="targetd" -PROCESS_CONTEXT="targetd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup --clean /etc/target/saveconfig.json - rlFileBackup --clean /etc/target/targetd.yaml - rlFileBackup /etc/lvm/lvm.conf - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1063714" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlSESearchRule "allow targetd_t lvm_control_t : chr_file { getattr open read write ioctl } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1373860 + bz#1486252" - rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" - rlSESearchRule "allow targetd_t targetd_t : unix_dgram_socket { create getopt setopt ioctl }" - rlSESearchRule "allow targetd_t proc_net_t : file { getattr open read }" - rlSESearchRule "dontaudit targetd_t targetd_t : capability { net_admin }" - rlSESearchRule "allow targetd_t kernel_t : unix_dgram_socket { sendto }" - rlSESearchRule "dontaudit targetd_t rpm_exec_t : file { getattr }" - rlSESearchRule "allow targetd_t tmp_t : dir { getattr open read }" - rlSESearchRule "dontaudit targetd_t rpm_var_lib_t : file { getattr open }" - rlSESearchRule "dontaudit targetd_t semanage_store_t : dir { getattr }" - rlSESearchRule "allow targetd_t bin_t : file { getattr open read execute_no_trans }" - rlPhaseEnd - - rlPhaseStartTest "bz#1424621 + bz#1486259" - rlSEMatchPathCon "/var/run/dmeventd-client" "lvm_var_run_t" - rlSESearchRule "allow targetd_t bin_t : file { getattr open read execute_no_trans }" - rlSESearchRule "allow targetd_t targetd_t : tcp_socket { accept }" - if rlIsRHEL 5 6 7 ; then - rlSESearchRule "dontaudit targetd_t insmod_exec_t : file { getattr }" - fi - rlSESearchRule "allow targetd_t configfs_t : dir { add_name create getattr open read remove_name rmdir search write }" - rlSESearchRule "allow targetd_t configfs_t : file { getattr open read write }" - rlSESearchRule "allow targetd_t configfs_t : lnk_file { create getattr read unlink }" - # following 2 rules seem to needed by btrfs tool - # rlSESearchRule "allow targetd_t default_t : dir { ioctl read write }" - # rlSESearchRule "allow targetd_t unlabeled_t : dir { ioctl read write }" - # rlSESearchRule "allow targetd_t mnt_t : dir { ioctl read write }" - rlSESearchRule "allow targetd_t exports_t : file { getattr open read }" - rlSESearchRule "allow targetd_t fixed_disk_device_t : blk_file { write }" - rlSESearchRule "allow targetd_t fs_t : filesystem { getattr }" - rlSESearchRule "allow targetd_t kernel_t : system { ipc_info module_request }" - if rlIsRHEL 7 ; then - rlSESearchRule "allow targetd_t lvm_metadata_t : dir { add_name read remove_name write }" - rlSESearchRule "allow targetd_t lvm_metadata_t : file { create link rename unlink append }" - rlSESearchRule "allow targetd_t lvm_var_run_t : fifo_file { getattr open lock read write }" - fi - rlSESearchRule "allow targetd_t modules_conf_t : dir { getattr open read }" - rlSESearchRule "allow targetd_t modules_conf_t : file { getattr open read }" - rlSESearchRule "allow targetd_t modules_object_t : dir { search }" - rlSESearchRule "allow targetd_t modules_object_t : file { getattr open read }" - rlSESearchRule "allow targetd_t nfsd_fs_t : file { getattr open read }" - rlSESearchRule "allow targetd_t targetd_t : capability { ipc_lock sys_admin sys_nice }" - rlSESearchRule "allow targetd_t targetd_t : process { setsched }" - rlSESearchRule "allow targetd_t sysctl_rpc_t : dir { search }" - rlSESearchRule "allow targetd_t sysctl_rpc_t : file { getattr open read write }" - rlSESearchRule "allow targetd_t sysfs_t : file { write }" - rlSESearchRule "allow targetd_t var_lib_nfs_t : dir { add_name remove_name write }" - rlSESearchRule "allow targetd_t var_lib_nfs_t : file { create getattr lock open read rename unlink write }" - rlPhaseEnd - - if ! rlIsRHEL 5 6 7 ; then - rlPhaseStartTest "bz#1569663" - rlSEMatchPathCon "/etc/lvm/lvm.conf" "lvm_etc_t" - rlSESearchRule "allow targetd_t lvm_etc_t : file { map }" - rlPhaseEnd - - rlPhaseStartTest "bz#2062183" - rlSEMatchPathCon "/usr/sbin/lvm" "lvm_exec_t" - rlSESearchRule "allow targetd_t lvm_exec_t : file { getattr open read execute map } [ ]" - rlSESearchRule "type_transition targetd_t lvm_exec_t : process lvm_t" - rlSESearchRule "allow targetd_t lvm_t : process { transition } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "bz#1546671" - rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" - rlSEMatchPathCon "/root/.local" "gconf_home_t" - rlSEMatchPathCon "/home/user/.local" "gconf_home_t" - rlSEMatchPathCon "/etc/lvm/lvm.conf" "lvm_etc_t" - rlSESearchRule "allow targetd_t gconf_home_t : dir { search }" - rlSESearchRule "allow targetd_t lvm_etc_t : file { map }" - rlPhaseEnd - - rlPhaseStartTest "bz#2203720" - rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" - rlSEMatchPathCon "/etc/httpd" "httpd_config_t" - rlSEMatchPathCon "/etc/httpd/conf" "httpd_config_t" - rlSESearchRule "dontaudit targetd_t httpd_config_t : dir { search } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2222199" - rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" - if [ -f /proc/sys/net/ipv6/conf/all/disable_ipv6 ] ; then - rlRun "ls -dZ /proc/sys/net | grep :sysctl_net_t" - rlRun "ls -dZ /proc/sys/net/ipv6 | grep :sysctl_net_t" - rlRun "ls -dZ /proc/sys/net/ipv6/conf | grep :sysctl_net_t" - rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t" - rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" - fi - rlSESearchRule "allow targetd_t sysctl_net_t : dir { search } [ ]" - rlSESearchRule "allow targetd_t sysctl_net_t : file { getattr open read } [ ]" - rlPhaseEnd - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlRun "rm -f /etc/target/saveconfig.json" - rlRun "rm -f /etc/target/targetd.yaml" - rlRun "targetctl clear" 0-255 - rlRun "targetctl save" - rlRun "echo \"password: Str0nGp4ssw0rD\" > /etc/target/targetd.yaml" - rlRun "sed -i \"s/use_lvmetad = 1/use_lvmetad = 0/\" /etc/lvm/lvm.conf" - rlRun "ls -Z /etc/target" - LOOP_FILE="vg-targetd.img" - LOOP_DEVICE=`losetup -f` - rlRun "dd if=/dev/zero of=${LOOP_FILE} bs=1MB count=128" - rlRun "losetup ${LOOP_DEVICE} ${LOOP_FILE}" - rlRun "vgcreate vg-targetd ${LOOP_DEVICE}" - rlRun "vgdisplay" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="initrc_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "targetcli ls" - rlRun "targetcli version" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 - rlRun "vgremove vg-targetd" - rlRun "losetup -d ${LOOP_DEVICE}" - rlRun "rm -f ${LOOP_FILE}" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/thttpd-and-similar/Makefile b/selinux-policy/thttpd-and-similar/Makefile deleted file mode 100644 index 550c373..0000000 --- a/selinux-policy/thttpd-and-similar/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/thttpd-and-similar -# Description: SELinux interferes with thhtpd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/thttpd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with thttpd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console thttpd" >> $(METADATA) # EPEL - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Architectures: i386 x86_64" >> $(METADATA) - @echo "Bug: 1069843" >> $(METADATA) # RHEL-6 - @echo "Bug: 1087384" >> $(METADATA) # RHEL-7 - @echo "Bug: 1111581" >> $(METADATA) # RHEL-6 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/thttpd-and-similar/PURPOSE b/selinux-policy/thttpd-and-similar/PURPOSE deleted file mode 100644 index 4d669c4..0000000 --- a/selinux-policy/thttpd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/thttpd-and-similar -Author: Milos Malik - -SELinux interferes with thttpd and related programs. - diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf deleted file mode 100644 index d90db9b..0000000 --- a/selinux-policy/thttpd-and-similar/main.fmf +++ /dev/null @@ -1,55 +0,0 @@ -summary: SELinux interferes with the thttpd and related programs -description: |+ - SELinux interferes with thttpd and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - /usr/sbin/service - - setools-console - - thttpd -environment: - AVC_ERROR: +no_avc_check -duration: 5m -enabled: true -tag: - - NoRHEL4 - - TierCandidatesPASS - - f31friendly - - f32friendly - - targeted - - epel - - rhel8-epel - - NoRHIVOS -tier: 2 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1069843 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1087384 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1111581 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-alt-7, rhel-9, rhel-10 - because: the thttpd package is not available there - - enabled: false - when: distro >= centos-stream-9 - because: the thttpd package is not available there - - enabled: false - when: arch == i386, ppc64, s390 - continue: false -extra-nitrate: TC#0340646 -extra-summary: /CoreOS/selinux-policy/Regression/thttpd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/thttpd-and-similar -id: dc6bfb6d-cfe5-4f75-87a4-984aa6c8591b diff --git a/selinux-policy/thttpd-and-similar/runtest.sh b/selinux-policy/thttpd-and-similar/runtest.sh deleted file mode 100755 index dcd0776..0000000 --- a/selinux-policy/thttpd-and-similar/runtest.sh +++ /dev/null @@ -1,112 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/thttpd-and-similar -# Description: SELinux interferes with thttpd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/thttpd" -FILE_CONTEXT="httpd_exec_t" -SERVICE_PACKAGE="thttpd" -SERVICE_NAME="thttpd" -PROCESS_NAME="thttpd" -PROCESS_CONTEXT="httpd_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop `rlSEListServices 80` - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest "bz#1069843" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - if rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSEMatchPathCon "/etc/thttpd.conf" "httpd_config_t" - rlSEMatchPathCon "/var/log/thttpd.log" "httpd_log_t" - rlSEMatchPathCon "/var/run/thttpd.pid" "httpd_var_run_t" - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" - rlPhaseEnd - - rlPhaseStartTest "bz#1087384 + bz#1111581" - if rlIsRHEL 6 ; then - rlSEMatchPathCon "/etc/rc.d/init.d/thttpd" "httpd_initrc_exec_t" - else # RHEL-7 etc. - rlSEMatchPathCon "/lib/systemd/system/thttpd.service" "httpd_unit_file_t" - fi - rlSEMatchPathCon "/usr/sbin/thttpd" "httpd_exec_t" - rlSEMatchPathCon "/var/log/thttpd.log" "httpd_log_t" - rlSESearchRule "allow httpd_t httpd_t : capability { sys_chroot }" - rlSESearchRule "allow httpd_t httpd_log_t : file { setattr }" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - # because of the fowner capability - rlRun "setsebool httpd_run_stickshift on" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if rlIsRHEL 5 ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="initrc_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlRun "setsebool httpd_run_stickshift off" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore `rlSEListServices 80` - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/tlp-and-similar/Makefile b/selinux-policy/tlp-and-similar/Makefile index ed881d4..386b5bd 100644 --- a/selinux-policy/tlp-and-similar/Makefile +++ b/selinux-policy/tlp-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: tlp" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients tlp rfkill snapd /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients tlp rfkill" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,7 +64,6 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) @echo "Bug: 1460481" >> $(METADATA) # RHEL-7 - @echo "Bug: 2221019" >> $(METADATA) # Fedora 38 rhts-lint $(METADATA) diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index 182f8b6..3e91f57 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -1,57 +1,8 @@ -summary: the service was running as initrc_t or init_t, now it is confined by SELinux -description: |+ - SELinux interferes with tlp and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - expect - - openssh-clients - - tlp - - rfkill - - snapd - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - TIPpass_Security - - failinfedora - - f33friendly - - targeted - - epel - - rhel8-epel - - rhel9-epel - - rhel10-epel - - rhel9_broken - - rhel10_broken - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460481 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2221019 -adjust+: - - enabled: false - when: arch == s390x - continue: false - - enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0569976 -extra-summary: /CoreOS/selinux-policy/Regression/tlp-and-similar -extra-task: /CoreOS/selinux-policy/Regression/tlp-and-similar -id: a467ae20-527e-49c7-a726-fa3a32887a54 +path: /selinux-policy/tlp-and-similar +summary: SELinux interferes with tlp and related programs +description: | + Test coverage for SELinux AVC issues against tlp and related + programs. +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/selinux-policy/tlp-and-similar/runtest.sh b/selinux-policy/tlp-and-similar/runtest.sh index 0c67f65..55a0f5f 100755 --- a/selinux-policy/tlp-and-similar/runtest.sh +++ b/selinux-policy/tlp-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -40,15 +41,11 @@ PROCESS_CONTEXT="tlp_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 - else - rlAssertRpm ${SERVICE_PACKAGE} - fi + rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -85,17 +82,7 @@ rlJournalStart rlPhaseEnd fi - if rlSEDefined "snappy_var_lib_t" ; then - rlPhaseStartTest "bz#2221019" - rlSESearchRule "dontaudit tlp_t snappy_var_lib_t : dir { search } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" - if rpm -q snapd >& /dev/null ; then - rlRun "ls -alRZ /var/lib/snapd" - fi rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then if rlIsRHEL 5 6 ; then @@ -106,10 +93,8 @@ rlJournalStart fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "tlp-stat -v" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/tlshd-and-similar/Makefile b/selinux-policy/tlshd-and-similar/Makefile deleted file mode 100644 index 236ebdf..0000000 --- a/selinux-policy/tlshd-and-similar/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/tlshd-and-similar -# Description: SELinux interferes with tlshd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/tlshd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with tlshd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console ktls-utils /usr/sbin/service" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: RHEL-29439" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-42672" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-74424" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/tlshd-and-similar/PURPOSE b/selinux-policy/tlshd-and-similar/PURPOSE deleted file mode 100644 index 828f1b5..0000000 --- a/selinux-policy/tlshd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/tlshd-and-similar -Author: Milos Malik - -SELinux interferes with tlshd and related programs. - diff --git a/selinux-policy/tlshd-and-similar/main.fmf b/selinux-policy/tlshd-and-similar/main.fmf deleted file mode 100644 index 79d03bc..0000000 --- a/selinux-policy/tlshd-and-similar/main.fmf +++ /dev/null @@ -1,45 +0,0 @@ -summary: SELinux interferes with tlshd and related programs -description: |+ - SELinux interferes with tlshd and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - ktls-utils - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - failinfedora - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-29439 - - verifies: https://issues.redhat.com/browse/RHEL-42672 - - verifies: https://issues.redhat.com/browse/RHEL-74424 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - because: the ktls-utils package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/tlshd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/tlshd-and-similar -extra-nitrate: TC#0617913 -id: 63121e2f-20f3-4ded-80fe-ab98fecd79af diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh deleted file mode 100755 index 0e13e00..0000000 --- a/selinux-policy/tlshd-and-similar/runtest.sh +++ /dev/null @@ -1,107 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/tlshd-and-similar -# Description: SELinux interferes with tlshd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/sbin/tlshd" -SERVICE_PACKAGE="ktls-utils" -SERVICE_NAME="tlshd" -PROCESS_NAME="tlshd" -if seinfo -t | grep -q tlshd ; then - PROCESS_CONTEXT="ktlshd_t" - FILE_CONTEXT="ktlshd_exec_t" -else - PROCESS_CONTEXT="unconfined_service_t" - FILE_CONTEXT="bin_t" -fi - -rlJournalStart - if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "RHEL-29439 + RHEL-42672" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]" - rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" - rlPhaseEnd - - if rlSEDefined "ktlshd_t" ; then - rlPhaseStartTest "RHEL-74424" - rlSEMatchPathCon "/etc/resolv.conf" "net_conf_t" - rlSEMatchPathCon "/etc/pki/tls/certs/ca-cert.pem" "cert_t" - rlRun "ls -Z /proc/net/if_inet6 | grep :proc_net_t" - rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" - rlSESearchRule "allow ktlshd_t ktlshd_t : key { write } [ ]" - rlSESearchRule "allow ktlshd_t cert_t : dir { search } [ ]" - rlSESearchRule "allow ktlshd_t cert_t : file { getattr open read } [ ]" - rlSESearchRule "allow ktlshd_t net_conf_t : file { getattr open read } [ ]" - # rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]" - rlSESearchRule "allow ktlshd_t ktlshd_t : netlink_route_socket { bind create getattr getopt nlmsg_read setopt } [ ]" - rlSESearchRule "allow ktlshd_t ktlshd_t : udp_socket { connect create getattr setopt } [ ]" - rlSESearchRule "allow ktlshd_t sysctl_net_t : dir { search } [ ]" - rlSESearchRule "allow ktlshd_t sysctl_net_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile deleted file mode 100644 index 3fabb16..0000000 --- a/selinux-policy/tuned-ppd-and-similar/Makefile +++ /dev/null @@ -1,80 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar -# Description: SELinux interferes with tuned-ppd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2025 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/tuned-ppd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with tuned-ppd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tuned-ppd /usr/sbin/service gdm" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: RHEL-69450" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-69526" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-85849" >> $(METADATA) # RHEL-10 - @echo "Bug: 2358952" >> $(METADATA) # Fedora 42 - @echo "Bug: 2359047" >> $(METADATA) # Fedora 42 - @echo "Bug: 2359851" >> $(METADATA) # Fedora 42 - @echo "Bug: 2360026" >> $(METADATA) # Fedora 42 - @echo "Bug: 2360121" >> $(METADATA) # Fedora 41 - @echo "Bug: 2361423" >> $(METADATA) # Fedora 42 - @echo "Bug: 2367076" >> $(METADATA) # Fedora 41 - @echo "Bug: 2367711" >> $(METADATA) # Fedora 42 - @echo "Bug: RHEL-101686" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-101687" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/tuned-ppd-and-similar/PURPOSE b/selinux-policy/tuned-ppd-and-similar/PURPOSE deleted file mode 100644 index dc2bac6..0000000 --- a/selinux-policy/tuned-ppd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar -Author: Milos Malik - -SELinux interferes with tuned-ppd and related programs. - diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf deleted file mode 100644 index e0593a8..0000000 --- a/selinux-policy/tuned-ppd-and-similar/main.fmf +++ /dev/null @@ -1,54 +0,0 @@ -summary: SELinux interferes with tuned-ppd and related programs -description: |+ - SELinux interferes with tuned-ppd and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - gdm -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - NoRHIVOS -link: - - verifies: https://issues.redhat.com/browse/RHEL-69450 - - verifies: https://issues.redhat.com/browse/RHEL-69526 - - verifies: https://issues.redhat.com/browse/RHEL-85849 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2358952 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359047 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359851 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360026 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360121 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2361423 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367076 - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367711 - - verifies: https://issues.redhat.com/browse/RHEL-101686 - - verifies: https://issues.redhat.com/browse/RHEL-101687 -adjust+: - - enabled: false - when: distro < rhel-9.5 - because: the tuned-ppd package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar -extra-nitrate: TC#0618543 -id: 58ffbde5-91ba-44e8-8faf-039f1043a503 diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh deleted file mode 100755 index 1efe029..0000000 --- a/selinux-policy/tuned-ppd-and-similar/runtest.sh +++ /dev/null @@ -1,157 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar -# Description: SELinux interferes with tuned-ppd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2025 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_PATH="/usr/sbin/tuned-ppd" -SERVICE_PACKAGE="tuned-ppd" -SERVICE_NAME="tuned-ppd" -PROCESS_NAME="tuned-ppd" -if seinfo -t | grep -q tuned_ppd ; then - PROCESS_CONTEXT="tuned_ppd_t" - FILE_CONTEXT="tuned_ppd_exec_t" -else - PROCESS_CONTEXT="unconfined_service_t" - FILE_CONTEXT="bin_t" -fi - -rlJournalStart - if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - if rpm -q power-profiles-daemon ; then - rlRun "yum -y remove power-profiles-daemon" - fi - rlRun "yum -y install ${SERVICE_PACKAGE}" - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/tuned/ppd_base_profile - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "RHEL-69450 + RHEL-69526" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]" - rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" - rlSESearchRule "allow init_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" - rlPhaseEnd - - if rlSEDefined "xdm_t tuned_ppd_t" ; then - rlPhaseStartTest "RHEL-85849" - rlSESearchRule "allow xdm_t tuned_ppd_t : dbus { send_msg } [ ]" - rlSESearchRule "allow tuned_ppd_t xdm_t : dbus { send_msg } [ ]" - rlPhaseEnd - fi - - if rlSEDefined "tuned_ppd_t sssd_t" ; then - rlPhaseStartTest "bz#2367076" - rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" - rlSESearchRule "allow tuned_ppd_t sssd_var_lib_t : sock_file { write } [ ]" - rlSESearchRule "allow tuned_ppd_t sssd_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd - fi - - if rlSEDefined "tuned_rw_etc_t tuned_ppd_t" ; then - rlPhaseStartTest "bz#2359851 + bz#2360026 + bz#2361423 + bz#2367711" - rlSEMatchPathCon "/etc/tuned" "tuned_etc_t" - rlSEMatchPathCon "/etc/tuned/ppd_base_profile" "tuned_rw_etc_t" - rlSESearchRule "type_transition tuned_ppd_t tuned_etc_t : file tuned_rw_etc_t ppd_base_profile" - rlSESearchRule "allow tuned_ppd_t tuned_etc_t : dir { write add_name } [ ]" - rlSESearchRule "allow tuned_ppd_t tuned_rw_etc_t : file { create write } [ ]" - rlPhaseEnd - fi - - if rlSEDefined "tuned_ppd_t" ; then - rlPhaseStartTest "RHEL-101686 + RHEL-101687" - rlSEMatchPathCon "/sys/devices/system/cpu/intel_pstate" "sysfs_t" - rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#2358952 + bz#2359047 + bz#2360121" - rlSEMatchPathCon "/sys/firmware/acpi" "sysfs_t" - rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch_reads } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- standalone service" - if [ -f /usr/lib/systemd/system/gdm.service ] ; then - rlRun "service gdm start" - rlRun "service gdm status" - sleep 2 - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "busctl introspect net.hadess.PowerProfiles /org/freedesktop/UPower/PowerProfiles" - rlRun "busctl introspect net.hadess.PowerProfiles /net/hadess/PowerProfiles" - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "ls -Z /etc/tuned/ppd_base_profile" - rlRun "tuned-adm active" - rlRun "rm -f /etc/tuned/ppd_base_profile" - if tuned-adm active | grep -q powersave ; then - rlRun "tuned-adm profile balanced" - else - rlRun "tuned-adm profile powersave" - fi - sleep 2 - rlRun "ls -lZ /etc/tuned/ppd_base_profile" - rlRun "tuned-adm auto_profile" - rlRun "ls -lZ /etc/tuned/ppd_base_profile" - rlRun "tuned-adm verify -i" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 - if [ -f /usr/lib/systemd/system/gdm.service ] ; then - sleep 2 - rlRun "service gdm stop" - fi - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/unknown-permissions-cil/main.fmf b/selinux-policy/unknown-permissions-cil/main.fmf deleted file mode 100644 index 3f49b3f..0000000 --- a/selinux-policy/unknown-permissions-cil/main.fmf +++ /dev/null @@ -1,20 +0,0 @@ -summary: test coverage for Unknown permissions are now handled as errors in CIL -description: |+ - Unknown permissions are now handled as errors in CIL -contact: Jan Janasek -component: - - selinux-policy -require: - - libselinux - - libselinux-utils - - policycoreutils-devel - - selinux-policy - - selinux-policy-targeted -environment: - AVC_ERROR: +no_avc_check -duration: 20m -enabled: true -tier: 2 -link: - - verifies: https://issues.redhat.com/browse/SELINUX-2380 -id: 707a837f-391b-4182-a150-e0f411afffd5 diff --git a/selinux-policy/unknown-permissions-cil/runtest.sh b/selinux-policy/unknown-permissions-cil/runtest.sh deleted file mode 100755 index 8bf258f..0000000 --- a/selinux-policy/unknown-permissions-cil/runtest.sh +++ /dev/null @@ -1,152 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Description: Unknown permissions are now handled as errors in CIL -# Author: Jan Janasek -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2021 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE="my_policy.cil" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "sestatus" - echo "(type my_test_domain_t)" > $FILE - echo "(type my_test_file_t)" >> $FILE - sleep 2 - rlPhaseEnd - - - rlPhaseStartTest "permission watch" - echo "(allow my_test_domain_t my_test_file_t (dir (watch)))" >> $FILE - rlRun "semodule -i $FILE" - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (dir (watching)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - rlPhaseEnd - - rlPhaseStartTest "permission that is not defined in a class" - echo "(allow my_test_domain_t my_test_file_t (dir (add_name)))" >> $FILE - rlRun "semodule -i $FILE" - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (file (add_name)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - rlPhaseEnd - - rlPhaseStartTest "permission sendto" - echo "(allow my_test_domain_t my_test_file_t (node (sendto)))" >> $FILE - rlRun "semodule -i $FILE" - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (node (sendsto)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (dir (sendto)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - rlPhaseEnd - - rlPhaseStartTest "permission stop" - echo "(allow my_test_domain_t my_test_file_t (system (stop)))" >> $FILE - rlRun "semodule -i $FILE" - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (system (stops)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (dir (stop)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - rlPhaseEnd - - rlPhaseStartTest "permission reload" - echo "(allow my_test_domain_t my_test_file_t (service (reload)))" >> $FILE - rlRun "semodule -i $FILE" - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (service (reloads)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (dir (reload)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - rlPhaseEnd - - rlPhaseStartTest "permission use" - echo "(allow my_test_domain_t my_test_file_t (fd (use)))" >> $FILE - rlRun "semodule -i $FILE" - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (fd (using)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (dir (use)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - rlPhaseEnd - - rlPhaseStartTest "permission flow_in" - echo "(allow my_test_domain_t my_test_file_t (packet (flow_in)))" >> $FILE - rlRun "semodule -i $FILE" - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (packet (flows_in)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (system (flow_in)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - rlPhaseEnd - - rlPhaseStartTest "permission contains" - echo "(allow my_test_domain_t my_test_file_t (context (contains)))" >> $FILE - rlRun "semodule -i $FILE" - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (context (contain)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (fd (contains)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - rlPhaseEnd - - rlPhaseStartTest "permission lock" - echo "(allow my_test_domain_t my_test_file_t (shm (lock)))" >> $FILE - rlRun "semodule -i $FILE" - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (shm (locked)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow my_test_domain_t my_test_file_t (system (lock)))" >> $FILE - rlRun "semodule -i $FILE" 1 - head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - rlPhaseEnd - - rlPhaseStartCleanup - rm $FILE - rlRun "semodule -r my_policy" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/selinux-policy/usbguard-daemon-and-similar/main.fmf b/selinux-policy/usbguard-daemon-and-similar/main.fmf index 0b882ca..1b207f2 100644 --- a/selinux-policy/usbguard-daemon-and-similar/main.fmf +++ b/selinux-policy/usbguard-daemon-and-similar/main.fmf @@ -1,51 +1,5 @@ -summary: SELinux interferes with usbguard and related programs -description: |+ - SELinux interferes with usbguard and related programs. - -contact: Milos Malik -component: - - usbguard - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - initscripts - - usbguard - - usbguard-selinux -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - TIPpass - - f33friendly - - fedora-wanted - - targeted - - NoRHIVOS -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1808527 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1840265 -adjust+: - - enabled: false - when: arch == s390x - continue: false - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 - continue: false -extra-nitrate: TC#0606079 -extra-summary: /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar -extra-task: /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar -id: a551a723-5ba8-43c9-939b-1d18d4cc2153 +path: /selinux-policy/usbguard-daemon-and-similar +tier: 2 +adjust: +- enabled: false + when: distro < rhel-7 diff --git a/selinux-policy/usbguard-daemon-and-similar/runtest.sh b/selinux-policy/usbguard-daemon-and-similar/runtest.sh index 94fc163..ea2c953 100755 --- a/selinux-policy/usbguard-daemon-and-similar/runtest.sh +++ b/selinux-policy/usbguard-daemon-and-similar/runtest.sh @@ -27,6 +27,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -40,7 +41,7 @@ PROCESS_CONTEXT="usbguard_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted @@ -77,7 +78,6 @@ rlJournalStart rlPhaseEnd fi - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "semodule -lfull | grep usbguard" @@ -86,10 +86,9 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /run /var" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/usbmuxd-and-similar/Makefile b/selinux-policy/usbmuxd-and-similar/Makefile deleted file mode 100644 index d397168..0000000 --- a/selinux-policy/usbmuxd-and-similar/Makefile +++ /dev/null @@ -1,73 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/usbmuxd-and-similar -# Description: SELinux interferes with usbmuxd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/usbmuxd-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with usbmuxd and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: usbmuxd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console usbmuxd initscripts" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - @echo "Bug: 1521054" >> $(METADATA) # RHEL-7 - @echo "Bug: 1582205" >> $(METADATA) # RHEL-7 - @echo "Bug: 1930992" >> $(METADATA) # Fedora 33 - @echo "Bug: 1936705" >> $(METADATA) # Fedora 34 - @echo "Bug: 1959747" >> $(METADATA) # Fedora 35 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/usbmuxd-and-similar/PURPOSE b/selinux-policy/usbmuxd-and-similar/PURPOSE deleted file mode 100644 index b81475e..0000000 --- a/selinux-policy/usbmuxd-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/usbmuxd-and-similar -Author: Milos Malik - -SELinux interferes with usbmuxd and related programs. - diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf deleted file mode 100644 index c3e9fe8..0000000 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ /dev/null @@ -1,58 +0,0 @@ -summary: SELinux interferes with usbmuxd and related programs -description: |+ - SELinux interferes with usbmuxd and related programs. - -contact: Milos Malik -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - usbmuxd - - initscripts -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - TIPpass_Security - - TipWaived7 - - f31friendly - - f32friendly - - targeted - - NoRHIVOS -tier: 3 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1521054 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1582205 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1930992 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1936705 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1959747 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965411 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1973886 -adjust+: - - enabled: false - when: distro >= rhel-9 - because: the usbmuxd package is not available there - - enabled: false - when: distro >= centos-stream-9 - because: the usbmuxd package is not available there - - enabled: false - when: arch == aarch64, s390x - continue: false -extra-nitrate: TC#0300434 -extra-summary: /CoreOS/selinux-policy/Regression/usbmuxd-and-similar -extra-task: /CoreOS/selinux-policy/Regression/usbmuxd-and-similar -id: 2e39eebe-4456-4b06-90c0-1d2fd4e931a7 diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh deleted file mode 100755 index 76928a7..0000000 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ /dev/null @@ -1,123 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/usbmuxd-and-similar -# Description: SELinux interferes with usbmuxd and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -FILE_PATH="/usr/sbin/usbmuxd" -FILE_CONTEXT="usbmuxd_exec_t" -SERVICE_PACKAGE="usbmuxd" -SERVICE_NAME="usbmuxd" -PROCESS_NAME="usbmuxd" -PROCESS_CONTEXT="usbmuxd_t" - -rlJournalStart - if rlIsRHEL && ! rlIsRHEL 7 8 ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} - - rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1521054 + bz#1582205" - if rlIsRHEL 5 ; then - SOURCE_TYPE="initrc_t" - BOOLEANS="[ ]" - elif rlIsRHEL 6 ; then - SOURCE_TYPE="initrc_t" - else # RHEL-7 etc. - SOURCE_TYPE="init_t" # systemd runs the process - fi - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/run/udev/data" "udev_var_run_t" - rlSEMatchPathCon "/run/udev/data/c189:0" "udev_var_run_t" - rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" - rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" - rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" - rlSESearchRule "allow usbmuxd_t udev_var_run_t : dir { getattr open search } [ ]" - rlSESearchRule "allow usbmuxd_t udev_var_run_t : file { getattr open read } [ ]" - rlPhaseEnd - - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then - rlPhaseStartTest "bz#1930992" - rlSEMatchPathCon "/sys" "sysfs_t" - rlSESearchRule "allow usbmuxd_t sysfs_t : filesystem { getattr } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1936705" - rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t" - rlSESearchRule "allow usbmuxd_t cgroup_t : filesystem { getattr } [ ]" - rlPhaseEnd - - rlPhaseStartTest "bz#1959747" - rlRun "ls -dZ /proc/1 | grep :init_t" - rlRun "ls -Z /proc/1/environ | grep :init_t" - rlSESearchRule "dontaudit usbmuxd_t init_t : dir { search } [ ]" - rlSESearchRule "dontaudit usbmuxd_t init_t : file { getattr open read ioctl } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAME} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/valkey-and-similar/Makefile b/selinux-policy/valkey-and-similar/Makefile deleted file mode 100644 index e194474..0000000 --- a/selinux-policy/valkey-and-similar/Makefile +++ /dev/null @@ -1,72 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/valkey-and-similar -# Description: SELinux interferes with valkey and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2025 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/valkey-and-similar -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with valkey and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "RunFor: valkey" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console valkey /usr/sbin/service valkey-rdma" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: RHEL-102631" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-108982" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-154814" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-161115" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/valkey-and-similar/PURPOSE b/selinux-policy/valkey-and-similar/PURPOSE deleted file mode 100644 index e131f98..0000000 --- a/selinux-policy/valkey-and-similar/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/valkey-and-similar -Author: Milos Malik - -SELinux interferes with valkey-server, valkey-sentinel and related programs. - diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf deleted file mode 100644 index 6a1b18b..0000000 --- a/selinux-policy/valkey-and-similar/main.fmf +++ /dev/null @@ -1,51 +0,0 @@ -summary: SELinux interferes with valkey and related programs -description: |+ - SELinux interferes with valkey-server, valkey-sentinel and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - valkey - - valkey-rdma - - /usr/sbin/service -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tier: '3' -link: - - verifies: https://issues.redhat.com/browse/RHEL-102631 - - verifies: https://issues.redhat.com/browse/RHEL-108982 - - verifies: https://issues.redhat.com/browse/RHEL-154814 - - verifies: https://issues.redhat.com/browse/RHEL-161115 -tag: - - Tier3 - - Tier3se - - NoRHIVOS - - avoidImageMode -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 - because: the package is not available there - - enabled: false - when: distro ~< rhel-9.8 - because: RHEL-108982 was fixed only here in rhel-9 - - enabled: false - when: distro ~< rhel-10.1 - because: RHEL-102631 was fixed only here in rhel-10 -extra-nitrate: TC#0619564 -id: 337de041-c42f-4292-99d4-f687ec629fc9 diff --git a/selinux-policy/valkey-and-similar/runtest.sh b/selinux-policy/valkey-and-similar/runtest.sh deleted file mode 100755 index 8b2830d..0000000 --- a/selinux-policy/valkey-and-similar/runtest.sh +++ /dev/null @@ -1,109 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/valkey-and-similar -# Description: SELinux interferes with valkey and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2025 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -FILE_CONTEXT="redis_exec_t" -SERVICE_PACKAGE="valkey" -SERVICE_NAME="valkey" -PROCESS_NAME="valkey-server" -PROCESS_CONTEXT="redis_t" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - if rpm -qa | grep -q valkey ; then - rlAssertRpm ${SERVICE_PACKAGE} - rlServiceStop valkey valkey-sentinel - fi - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "RHEL-102631" - rlSEMatchPathCon `which valkey-server` ${FILE_CONTEXT} - rlSEMatchPathCon `which valkey-sentinel` ${FILE_CONTEXT} - rlSEMatchPathCon "/etc/valkey" "redis_conf_t" - rlSEMatchPathCon "/etc/valkey/sentinel.conf" "redis_conf_t" - rlSEMatchPathCon "/etc/valkey/valkey.conf" "redis_conf_t" - rlSEMatchPathCon "/var/log/valkey" "redis_log_t" - rlSEMatchPathCon "/var/lib/valkey" "redis_var_lib_t" - rlSEMatchPathCon "/var/run/valkey" "redis_var_run_t" - rlSEMatchPathCon "/usr/lib/systemd/system/valkey-sentinel.service" "redis_unit_file_t" - rlSEMatchPathCon "/usr/lib/systemd/system/valkey.service" "redis_unit_file_t" - rlPhaseEnd - - if rpm -q valkey-rdma >& /dev/null ; then - rlPhaseStartTest "RHEL-154814 + RHEL-161115" - rlSESearchRule "allow redis_t redis_t : netlink_rdma_socket { getattr create setopt bind } [ ]" - rlPhaseEnd - fi - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- ${SERVICE_NAME} service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlWatchdog "valkey-cli --stat" 10 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - SERVICE_NAME="valkey-sentinel" - PROCESS_NAME="valkey-sentinel" - - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlPhaseStartTest "real scenario -- ${SERVICE_NAME} service" - if ! rlSEDefined ${PROCESS_CONTEXT} ; then - PROCESS_CONTEXT="unconfined_service_t" - fi - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlWatchdog "valkey-cli --stat -u valkey://default:PASSWORD@localhost:26379/0" 10 - rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlServiceRestore valkey valkey-sentinel - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile deleted file mode 100644 index 1a55b01..0000000 --- a/selinux-policy/virt-install-additional/Makefile +++ /dev/null @@ -1,82 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/virt-install-additional -# Description: SELinux interferes with virt-install and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/virt-install-additional -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with virt-install and related programs" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 30m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit usbutils lsscsi" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Architectures: aarch64 s390x x86_64" >> $(METADATA) - @echo "Bug: RHEL-56029" >> $(METADATA) # RHEL-9 - @echo "Bug: RHEL-65038" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-65266" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-65373" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-65383" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-65385" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-65789" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-69118" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-69920" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-74230" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-76104" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-98559" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-101417" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-236185" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/virt-install-additional/PURPOSE b/selinux-policy/virt-install-additional/PURPOSE deleted file mode 100644 index abe4221..0000000 --- a/selinux-policy/virt-install-additional/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/virt-install-additional -Author: Milos Malik - -SELinux interferes with virt-install and related programs. -Also covers: numad. diff --git a/selinux-policy/virt-install-additional/dimm.xml b/selinux-policy/virt-install-additional/dimm.xml deleted file mode 100644 index 326c928..0000000 --- a/selinux-policy/virt-install-additional/dimm.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - 524287 - 0 - - diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf deleted file mode 100644 index cdd36ae..0000000 --- a/selinux-policy/virt-install-additional/main.fmf +++ /dev/null @@ -1,68 +0,0 @@ -summary: SELinux interferes with virt-install and related programs. -description: |+ - SELinux interferes with virt-install and related programs. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - /usr/sbin/service - - setools-console - - virt-install - - libvirt-client - - numad - - nbdkit - - usbutils - - lsscsi -environment: - AVC_ERROR: +no_avc_check -duration: 30m -enabled: true -tag: - - kernel-rt - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - failinfedora - - NoRHIVOS - - avoidImageMode -link: - - verifies: https://issues.redhat.com/browse/RHEL-56029 - - verifies: https://issues.redhat.com/browse/RHEL-65038 - - verifies: https://issues.redhat.com/browse/RHEL-65266 - - verifies: https://issues.redhat.com/browse/RHEL-65373 - - verifies: https://issues.redhat.com/browse/RHEL-65383 - - verifies: https://issues.redhat.com/browse/RHEL-65385 - - verifies: https://issues.redhat.com/browse/RHEL-65789 - - verifies: https://issues.redhat.com/browse/RHEL-69118 - - verifies: https://issues.redhat.com/browse/RHEL-69920 - - verifies: https://issues.redhat.com/browse/RHEL-74230 - - verifies: https://issues.redhat.com/browse/RHEL-76104 - - verifies: https://issues.redhat.com/browse/RHEL-98559 - - verifies: https://issues.redhat.com/browse/RHEL-101417 - - verifies: https://issues.redhat.com/browse/RHEL-236185 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - because: the test is not relevant for these RHELs - - enabled: false - when: distro == ppc64le - because: the virt-install package is not available there -extra-summary: /CoreOS/selinux-policy/Regression/virt-install-additional -extra-task: /CoreOS/selinux-policy/Regression/virt-install-additional -extra-nitrate: TC#0617996 -id: a2688b1a-bb0f-4489-bfd0-ef573d832d8a diff --git a/selinux-policy/virt-install-additional/nodedev.xml b/selinux-policy/virt-install-additional/nodedev.xml deleted file mode 100644 index 7dcb0df..0000000 --- a/selinux-policy/virt-install-additional/nodedev.xml +++ /dev/null @@ -1,7 +0,0 @@ - -PLACEHOLDER - - -8d312cf6-f92a-485c-8db8-ba9299848f46 - - diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh deleted file mode 100755 index 35afc89..0000000 --- a/selinux-policy/virt-install-additional/runtest.sh +++ /dev/null @@ -1,385 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/virt-install-additional -# Description: SELinux interferes with virt-install and related programs -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm virt-install - - rlRun "yum -y install libvirt\* qemu\* --skip-broken" - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "RHEL-65038" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t svirt_tcg_t : lnk_file { read } [ ]" - rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getrlimit } [ ]" - rlSESearchRule "allow virtqemud_t svirt_t : process { getrlimit } [ ]" - fi - if rlIsRHEL 8 ; then - rlRun "service libvirtd start" - fi - rlRun "service virtqemud start" - rlRun "service virtnetworkd start" - rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test1 --cpu mode=maximum,check=none,migratable=on,numa.cell.id=0,numa.cell.cpus=0,numa.cell.memory=512000,numa.cell.unit="KiB" --memory maxMemory.slots=16,maxMemory=4096" 0,1 - sleep 30 - rlRun "virsh list" - rlRun "virsh list | grep 'test1.*running'" - rlWatchdog "virsh attach-device test1 dimm.xml" 30 - sleep 10 - rlRun "virsh destroy test1" - rlRun "virsh undefine test1" 0,1 - rlRun "service virtstoraged stop" - rlRun "service virtnetworkd stop" - rlRun "service virtqemud stop" - if rlIsRHEL 8 ; then - rlRun "service libvirtd stop" - fi - rlPhaseEnd - - rlPhaseStartTest "RHEL-65373" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t virtqemud_t : tun_socket { relabelto relabelfrom } [ ]" - fi - if rlIsRHEL 8 ; then - rlRun "service libvirtd start" - fi - rlRun "service virtqemud start" - rlRun "service virtnetworkd start" - rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test2 --network type=network,mac.address='52:54:00:ee:01:68',source=default,model.type=virtio,driver.queues=4" 0,1 - sleep 30 - rlRun "virsh list" - rlRun "virsh list | grep 'test2.*running'" - rlRun "virsh destroy test2" - rlRun "virsh undefine test2" 0,1 - rlRun "service virtstoraged stop" - rlRun "service virtnetworkd stop" - rlRun "service virtqemud stop" - if rlIsRHEL 8 ; then - rlRun "service libvirtd stop" - fi - rlPhaseEnd - - rlPhaseStartTest "RHEL-65383" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" - fi - if rlIsRHEL 8 ; then - rlRun "service libvirtd start" - fi - rlRun "service virtqemud start" - rlRun "service virtnetworkd start" - rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test3 --network type=network,mac.address='52:54:00:23:f2:12',source=default,model.type=virtio --xml xpath.set=./devices/interface/port/@isolated=yes" 0,1 - sleep 30 - rlRun "virsh list" - rlRun "virsh list | grep 'test3.*running'" - rlRun "virsh destroy test3" - rlRun "virsh undefine test3" 0,1 - rlRun "service virtstoraged stop" - rlRun "service virtnetworkd stop" - rlRun "service virtqemud stop" - if rlIsRHEL 8 ; then - rlRun "service libvirtd stop" - fi - rlPhaseEnd - - rlPhaseStartTest "RHEL-65789" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t numad_exec_t : file { getattr open read map execute } [ ]" - rlSESearchRule "allow virtqemud_t numad_t : process { transition } [ ]" - rlSESearchRule "type_transition virtqemud_t numad_exec_t : process numad_t" - fi - if rlIsRHEL 8 ; then - rlRun "service libvirtd start" - fi - rlRun "service virtqemud start" - rlRun "service virtnetworkd start" - rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test4 --numatune memory.mode='strict',memory.placement='auto'" 0,1 - sleep 30 - rlRun "virsh list" - rlRun "virsh list | grep 'test4.*running'" - rlRun "virsh destroy test4" - rlRun "virsh undefine test4" 0,1 - rlRun "service virtstoraged stop" - rlRun "service virtnetworkd stop" - rlRun "service virtqemud stop" - if rlIsRHEL 8 ; then - rlRun "service libvirtd stop" - fi - rlPhaseEnd - - rlPhaseStartTest "RHEL-56029 + RHEL-69118" - if rlIsRHEL 9 || rlIsCentOS 9 ; then - rlSESearchRule "allow virtd_t nbdkit_exec_t : file { entrypoint } [ ]" - elif rlIsRHEL 10 || rlIsCentOS 10 ; then - rlSESearchRule "allow virtqemud_t nbdkit_exec_t : file { getattr open read map execute } [ ]" - rlSESearchRule "allow virtqemud_t nbdkit_t : process { transition } [ ]" - rlSESearchRule "type_transition virtqemud_t nbdkit_exec_t : process nbdkit_t" - fi - if rlIsRHEL 8 ; then - rlRun "service libvirtd start" - fi - rlFileBackup /etc/libvirt/qemu.conf - rlRun "sed -i 's/^.*storage_use_nbdkit.*=.*$/storage_use_nbdkit = 1/' /etc/libvirt/qemu.conf" - rlRun "grep storage_use_nbdkit /etc/libvirt/qemu.conf" - rlRun "service virtqemud start" - rlRun "service virtnetworkd start" - rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=localhost,source.host0.port=22 --wait 0 --name test5" 0,1 - sleep 30 - rlRun "virsh list" - rlRun "virsh list | grep 'test5.*running'" - rlRun "virsh destroy test5" - rlRun "virsh undefine test5" 0,1 - rlRun "service virtstoraged stop" - rlRun "service virtnetworkd stop" - rlRun "service virtqemud stop" - if rlIsRHEL 8 ; then - rlRun "service libvirtd stop" - fi - rlFileRestore - rlPhaseEnd - - rlPhaseStartTest "RHEL-69920" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t svirt_t : process { getsched } [ ]" - rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getsched } [ ]" - fi - if rlIsRHEL 8 ; then - rlRun "service libvirtd start" - fi - rlRun "service virtqemud start" - rlRun "service virtnetworkd start" - rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test6" 0,1 - sleep 30 - rlRun "virsh vcpuinfo test6" - rlRun "virsh list" - rlRun "virsh list | grep 'test6.*running'" - rlRun "virsh destroy test6" - rlRun "virsh undefine test6" 0,1 - rlRun "service virtstoraged stop" - rlRun "service virtnetworkd stop" - rlRun "service virtqemud stop" - if rlIsRHEL 8 ; then - rlRun "service libvirtd stop" - fi - rlPhaseEnd - - rlPhaseStartTest "RHEL-74230" - rlSEMatchPathCon "/dev/bus/usb/001/001" "usb_device_t" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { getattr } [ ]" - rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { open read write lock setattr } [ virt_use_usb ]" - fi - if rlIsRHEL 8 ; then - rlRun "service libvirtd start" - fi - rlRun "service virtqemud start" - rlRun "service virtnetworkd start" - rlRun "service virtstoraged start" - rlRun "service virtnodedevd start" - rlRun "lsusb -t" - # USB devices may not be available - rlRun "virsh nodedev-list | grep usb" 0,1 - for USB_ID in `virsh nodedev-list | grep usb` ; do - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${USB_ID} --host-device ${USB_ID}" 0,1 - done - sleep 10 - rlRun "virsh list" - for VM_NAME in `virsh list --name` ; do - rlRun "virsh destroy ${VM_NAME}" - rlRun "virsh undefine ${VM_NAME}" 0,1 - done - rlRun "service virtnodedevd stop" - rlRun "service virtstoraged stop" - rlRun "service virtnetworkd stop" - rlRun "service virtqemud stop" - if rlIsRHEL 8 ; then - rlRun "service libvirtd stop" - fi - rlPhaseEnd - - rlPhaseStartTest "RHEL-76104" - rlSEMatchPathCon "/dev/sg0" "scsi_generic_device_t" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t scsi_generic_device_t : chr_file { getattr open read write lock setattr } [ ]" - fi - rlRun "modprobe scsi_debug ptype=5" - sleep 2 - rlRun "lsscsi -gs" - if rlIsRHEL 8 ; then - rlRun "service libvirtd start" - fi - rlRun "service virtqemud start" - rlRun "service virtnetworkd start" - rlRun "service virtstoraged start" - rlRun "service virtnodedevd start" - # SCSI devices may not be available - rlRun "virsh nodedev-list | grep scsi" 0,1 - for SCSI_ID in `virsh nodedev-list | grep scsi` ; do - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${SCSI_ID} --host-device ${SCSI_ID}" 0,1 - done - sleep 10 - rlRun "virsh list" - for VM_NAME in `virsh list --name` ; do - rlRun "virsh destroy ${VM_NAME}" - rlRun "virsh undefine ${VM_NAME}" 0,1 - done - rlRun "service virtnodedevd stop" - rlRun "service virtstoraged stop" - rlRun "service virtnetworkd stop" - rlRun "service virtqemud stop" - if rlIsRHEL 8 ; then - rlRun "service libvirtd stop" - fi - rlRun "modprobe -r scsi_debug" - rlPhaseEnd - - rlPhaseStartTest "RHEL-65266" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" - fi - rlRun "service virtqemud start" - rlRun "service virtnodedevd start" - rlRun "mkdir -p devices" - rlRun "pushd devices" - rlRun "virsh nodedev-list" - for I in `virsh nodedev-list` ; do - rlRun "virsh nodedev-dumpxml $I > $I" - done - if grep balloon * ; then - J=`grep -l balloon *` - rlRun "virsh nodedev-reattach $J" - else - rlLog "no balloon device was found - cannot reattach it" - fi - rlRun "popd" - rlRun "rm -rf devices" - sleep 2 - rlRun "service virtnodedevd stop" - rlRun "service virtqemud stop" - rlPhaseEnd - - rlPhaseStartTest "RHEL-65385" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" - fi - if rlIsRHEL 8 ; then - rlRun "service libvirtd start" - fi - rlRun "service virtqemud start" - rlRun "service virtnetworkd start" - rlRun "virsh net-list" - rlRun "virsh net-dumpxml default > default.xml" - rlRun "virsh net-destroy default" - rlRun "virsh net-undefine default" - rlRun "sed -i \"s/^\(.*bridge\) \(.*\)$/\1 macTableManager='libvirt' \2/\" default.xml" - rlRun "virsh net-create ./default.xml" - sleep 2 - rlRun "virsh net-list" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test7" 0,1 - sleep 10 - rlRun "virsh list" - rlRun "virsh list | grep 'test7.*running'" - rlRun "virsh destroy test7" - rlRun "virsh undefine test7" 0,1 - rlRun "service virtnetworkd stop" - rlRun "service virtqemud stop" - if rlIsRHEL 8 ; then - rlRun "service libvirtd stop" - fi - rlPhaseEnd - - rlPhaseStartTest "RHEL-98559" - if rlSEDefined "virtnodedevd_t mdevctl_conf_t" ; then - rlSEMatchPathCon "/etc/mdevctl.d" "mdevctl_conf_t" - rlSESearchRule "allow virtnodedevd_t mdevctl_conf_t : dir { create } [ ]" - fi - rlRun "service virtqemud start" - rlRun "service virtnodedevd start" - rlRun "virsh nodedev-list | grep pci" - LAST_PCI_DEVICE=`virsh nodedev-list | grep pci | tail -n 1` - rlRun "sed -i \"s/PLACEHOLDER/${LAST_PCI_DEVICE}/\" nodedev.xml" - rlRun "cat nodedev.xml" - rlRun "virsh nodedev-define ./nodedev.xml" - sleep 1 - rlRun "service virtnodedevd stop" - rlRun "service virtqemud stop" - rlPhaseEnd - - rlPhaseStartTest "RHEL-101417" - if [ -d /sys/bus/pci/devices ] ; then - rlRun "find /sys/bus/pci/devices -type f -name config -ls" - fi - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" - fi - rlRun "service virtqemud start" - rlRun "service virtnodedevd start" - rlRun "virsh nodedev-list | grep pci" - for I in `virsh nodedev-list | grep pci` ; do - rlRun "virsh nodedev-reset $I" 0,1 - sleep 1 - done - rlRun "service virtnodedevd stop" - rlRun "service virtqemud stop" - rlPhaseEnd - - rlPhaseStartTest "RHEL-236185" - rlSEMatchPathCon "/usr/bin/udevadm" "udev_exec_t" - if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t udev_exec_t : file { execute map } [ ]" - rlSESearchRule "type_transition virtqemud_t udev_exec_t : process udev_t" - rlSESearchRule "allow virtqemud_t udev_t : process { transition } [ ]" - fi - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/virtualization-daemons/Makefile b/selinux-policy/virtualization-daemons/Makefile deleted file mode 100644 index 3ae25e6..0000000 --- a/selinux-policy/virtualization-daemons/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Regression/virtualization-daemons -# Description: Various virtualization daemons are confined by SELinux -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Regression/virtualization-daemons -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Various virtualization daemons are confined by SELinux" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: libvirt" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service libvirt-daemon libvirt-daemon-common libvirt-client libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-lxc libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage-core libvirt-daemon-driver-vbox">> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: 2291273" >> $(METADATA) # Fedora 41 - @echo "Bug: RHEL-40834" >> $(METADATA) # RHEL-10 - @echo "Bug: RHEL-77620" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/virtualization-daemons/PURPOSE b/selinux-policy/virtualization-daemons/PURPOSE deleted file mode 100644 index e3776a9..0000000 --- a/selinux-policy/virtualization-daemons/PURPOSE +++ /dev/null @@ -1,6 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Regression/virtualization-daemons -Author: Milos Malik - -Various virtualization daemons are confined by SELinux. Do they work -as expected? - diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf deleted file mode 100644 index 73b3f8c..0000000 --- a/selinux-policy/virtualization-daemons/main.fmf +++ /dev/null @@ -1,62 +0,0 @@ -summary: SELinux interferes with various virtualization daemons. -description: |+ - SELinux interferes with various virtualization daemons. - -contact: Milos Malik -component: - - selinux-policy -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - /usr/sbin/service - - libvirt-client - - libvirt-daemon - - libvirt-daemon-common - - libvirt-daemon-driver-interface - - libvirt-daemon-driver-libxl - - libvirt-daemon-driver-lxc - - libvirt-daemon-driver-network - - libvirt-daemon-driver-nodedev - - libvirt-daemon-driver-nwfilter - - libvirt-daemon-driver-qemu - - libvirt-daemon-driver-secret - - libvirt-daemon-driver-storage-core - - libvirt-daemon-driver-vbox -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2291273 - - verifies: https://issues.redhat.com/browse/RHEL-40834 - - verifies: https://issues.redhat.com/browse/RHEL-77620 -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted - - failinfedora - - NoRHIVOS - - avoidImageMode -adjust+: - - enabled: false - when: distro < centos-stream-9 - because: the virtualization daemons are not available there - - enabled: false - when: distro < rhel-9 - because: the virtualization daemons are not available there -extra-nitrate: TC#0617680 -id: 1f7a8a37-7977-4ee0-8b8a-979c03aff369 diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh deleted file mode 100755 index a142de9..0000000 --- a/selinux-policy/virtualization-daemons/runtest.sh +++ /dev/null @@ -1,223 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Regression/virtualization-daemons -# Description: Various virtualization daemons are confined by SELinux -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" -SERVICE_NAMES="libvirtd virtinterfaced virtlockd virtlogd virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd virtxend" -if seinfo -a | grep -q virt_driver_domain ; then -ALL_TUPLES="libvirtd:libvirtd:virtd_t \ - virtinterfaced:virtinterfaced:virtinterfaced_t \ - virtlockd:virtlockd:virtlogd_t \ - virtlogd:virtlogd:virtlogd_t \ - virtlxcd:virtlxcd:virtd_lxc_t \ - virtnetworkd:virtnetworkd:virtnetworkd_t \ - virtnodedevd:virtnodedevd:virtnodedevd_t \ - virtnwfilterd:virtnwfilterd:virtnwfilterd_t \ - virtproxyd:virtproxyd:virtproxyd_t \ - virtqemud:virtqemud:virtqemud_t \ - virtsecretd:virtsecretd:virtsecretd_t \ - virtstoraged:virtstoraged:virtstoraged_t \ - virtvboxd:virtvboxd:virtvboxd_t" -# virtxend:virtxend:virtxend_t" -else -ALL_TUPLES="libvirtd:libvirtd:virtd_t \ - virtinterfaced:virtinterfaced:virtd_t \ - virtlockd:virtlockd:virtlogd_t \ - virtlogd:virtlogd:virtlogd_t \ - virtlxcd:virtlxcd:virtd_t \ - virtnetworkd:virtnetworkd:virtd_t \ - virtnodedevd:virtnodedevd:virtd_t \ - virtnwfilterd:virtnwfilterd:virtd_t \ - virtproxyd:virtproxyd:virtd_t \ - virtqemud:virtqemud:virtd_t \ - virtsecretd:virtsecretd:virtd_t \ - virtstoraged:virtstoraged:virtd_t \ - virtvboxd:virtvboxd:virtd_t" -# virtxend:virtxend:virtd_t -fi -INSTALL_OPTION="" -if yum --help | grep -q use-host-config ; then - INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" -fi -if yum install --help | grep -q skip-broken ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" -fi -if yum install --help | grep -q skip-unavailable ; then - INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" -fi - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - rlRun "rpm -qa libvirt\*" - - rlServiceStop ${SERVICE_NAMES} - rlFileBackup /etc/shadow - rlRun "yum -y install libvirt\* -x \*devel ${INSTALL_OPTION}" 0-255 - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "SELinux contexts and rules" - if seinfo -a | grep -q virt_driver_domain ; then - rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtinterfaced_exec_t" - rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_lxc_exec_t" - rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtnetworkd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtnodedevd" "virtnodedevd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtnwfilterd" "virtnwfilterd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtproxyd" "virtproxyd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtqemud" "virtqemud_exec_t" - rlSEMatchPathCon "/usr/sbin/virtsecretd" "virtsecretd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtstoraged" "virtstoraged_exec_t" - rlSEMatchPathCon "/usr/sbin/virtvboxd" "virtvboxd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtxend" "virtxend_exec_t" - else - rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtnodedevd" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtnwfilterd" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtproxyd" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtqemud" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtsecretd" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtstoraged" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtvboxd" "virtd_exec_t" - rlSEMatchPathCon "/usr/sbin/virtxend" "virtd_exec_t" - fi - rlPhaseEnd - - rlPhaseStartTest "real scenario -- standalone service" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" - # start all the services - for TUPLE in ${ALL_TUPLES} ; do - SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` - PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` - PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - fi - done - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - # restart all the services - for TUPLE in ${ALL_TUPLES} ; do - SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` - PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` - PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "virt-admin -c ${SERVICE_NAME}:///system exit" 0,1 - fi - done - # stop all the services - for TUPLE in ${ALL_TUPLES} ; do - SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` - PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` - PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 - fi - done - rlPhaseEnd - - if seinfo -a | grep -q virt_driver_domain ; then - rlPhaseStartTest "RHEL-77620" - rlSEMatchPathCon "/usr/bin/virt-admin" "bin_t" - rlSESearchRule "type_transition init_t bin_t : process unconfined_service_t" - rlSESearchRule "allow virtqemud_t unconfined_service_t : dir { search } [ ]" - rlSESearchRule "allow virtqemud_t unconfined_service_t : file { getattr open read } [ ]" - rlPhaseEnd - fi - - rlPhaseStartTest "real scenario -- admin sockets" - # start all admin sockets - for TUPLE in ${ALL_TUPLES} ; do - SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` - PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` - PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then - rlRun "systemctl start ${SERVICE_NAME}-admin.socket" - fi - done - # connect to the services via admin sockets - for TUPLE in ${ALL_TUPLES} ; do - SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` - PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` - PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then - rlRun "virt-admin -c ${SERVICE_NAME}:///system client-list admin" 0,1 - rlRun "systemd-run virt-admin -c ${SERVICE_NAME}:///system server-list" 0,1 - fi - done - rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - # stop all admin sockets - for TUPLE in ${ALL_TUPLES} ; do - SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` - PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` - PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then - rlRun "systemctl stop ${SERVICE_NAME}-admin.socket" - fi - done - rlPhaseEnd - - if seinfo -a | grep -q virt_driver_domain ; then - rlPhaseStartTest "bz#2291273 + RHEL-40834" - rlSESearchRule "allow virtnetworkd_t unconfined_t : dir { search } [ ]" - rlSESearchRule "allow virtnetworkd_t unconfined_t : file { open read } [ ]" - rlSESearchRule "allow virtnodedevd_t unconfined_t : dir { search } [ ]" - rlSESearchRule "allow virtnodedevd_t unconfined_t : file { open read } [ ]" - rlSESearchRule "allow virtnwfilterd_t unconfined_t : dir { search } [ ]" - rlSESearchRule "allow virtnwfilterd_t unconfined_t : file { open read } [ ]" - rlSESearchRule "allow virtsecretd_t unconfined_t : dir { search } [ ]" - rlSESearchRule "allow virtsecretd_t unconfined_t : file { open read } [ ]" - rlSESearchRule "allow virtstoraged_t unconfined_t : dir { search } [ ]" - rlSESearchRule "allow virtstoraged_t unconfined_t : file { open read } [ ]" - rlSESearchRule "allow virtvboxd_t unconfined_t : dir { search } [ ]" - rlSESearchRule "allow virtvboxd_t unconfined_t : file { open read } [ ]" - rlPhaseEnd - fi - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - - rlFileRestore - rlServiceRestore ${SERVICE_NAMES} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/selinux-policy/watch-permissions/Makefile b/selinux-policy/watch-permissions/Makefile deleted file mode 100644 index 52ffa08..0000000 --- a/selinux-policy/watch-permissions/Makefile +++ /dev/null @@ -1,68 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Sanity/watch-permissions -# Description: Are various watch permissions defined in SELinux policy? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Sanity/watch-permissions -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Are various watch permissions defined in SELinux policy?" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit git libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 1915034" >> $(METADATA) # Fedora rawhide - - rhts-lint $(METADATA) - diff --git a/selinux-policy/watch-permissions/PURPOSE b/selinux-policy/watch-permissions/PURPOSE deleted file mode 100644 index 6cdb8e4..0000000 --- a/selinux-policy/watch-permissions/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Sanity/watch-permissions -Author: Milos Malik - -Description: Are various watch permissions defined in SELinux policy? - diff --git a/selinux-policy/watch-permissions/main.fmf b/selinux-policy/watch-permissions/main.fmf deleted file mode 100644 index ad23040..0000000 --- a/selinux-policy/watch-permissions/main.fmf +++ /dev/null @@ -1,33 +0,0 @@ -path: /selinux-policy/watch-permissions -contact: Milos Malik -test: ./runtest.sh -framework: beakerlib -component: - - selinux-policy -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - audit - - git - - libselinux - - libselinux-utils - - policycoreutils - - setools-console - - selinux-policy - - selinux-policy-targeted -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915034 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 - because: the watch permission is not defined there -extra-nitrate: TC#0615395 -id: c4421242-0b97-4a1e-abbb-1dbe5dd21355 -tag: - - NoRHIVOS diff --git a/selinux-policy/watch-permissions/runtest.sh b/selinux-policy/watch-permissions/runtest.sh deleted file mode 100755 index aa26229..0000000 --- a/selinux-policy/watch-permissions/runtest.sh +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Sanity/watch-permissions -# Description: Are various watch permissions defined in SELinux policy? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1915034" - for PERM in watch watch_mount watch_sb watch_with_perm watch_reads ; do - rlRun "seinfo --common file -x | grep -w ${PERM}" - done - rlRun "seinfo -c filesystem -x | grep -w watch" - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/setools/apol/Makefile b/setools/apol/Makefile deleted file mode 100644 index c3390e4..0000000 --- a/setools/apol/Makefile +++ /dev/null @@ -1,65 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/setools/Sanity/apol -# Description: basic apol testing -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/setools/Sanity/apol -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: basic apol test" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: setools" >> $(METADATA) - @echo "Requires: setools-console setools-gui tigervnc-server selinux-policy-mls selinux-policy-targeted gnome-session-xsession gnome-shell" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: RHEL-29967" >> $(METADATA) # RHEL-10 - - rhts-lint $(METADATA) - diff --git a/setools/apol/PURPOSE b/setools/apol/PURPOSE deleted file mode 100644 index 0b80714..0000000 --- a/setools/apol/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/setools/Sanity/apol -Author: Milos Malik - -Is apol able to run? - diff --git a/setools/apol/main.fmf b/setools/apol/main.fmf deleted file mode 100644 index 43a9e88..0000000 --- a/setools/apol/main.fmf +++ /dev/null @@ -1,38 +0,0 @@ -summary: basic apol test -description: |+ - Is apol able to run? - -contact: Milos Malik -component: - - setools -test: ./runtest.sh -framework: beakerlib -require: - - type: library - name: /selinux-policy/Library/common - nick: selinux-policy -recommend: - - gnome-shell - - gnome-session-xsession - - setools-console - - setools-gui - - tigervnc-server - - selinux-policy-mls - - selinux-policy-targeted -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted -link: - - relates: https://issues.redhat.com/browse/RHEL-29967 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-10 - continue: false -extra-summary: /CoreOS/setools/Sanity/apol -extra-task: /CoreOS/setools/Sanity/apol -extra-nitrate: TC#0617470 diff --git a/setools/apol/runtest.sh b/setools/apol/runtest.sh deleted file mode 100755 index 32f2aa4..0000000 --- a/setools/apol/runtest.sh +++ /dev/null @@ -1,79 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/setools/Sanity/apol -# Description: basic apol testing -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2024 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlRun "rpm -qa | grep setools" - for POLICY_KIND in mls targeted ; do - rlAssertRpm selinux-policy-${POLICY_KIND} - done - rlFileBackup /etc/tigervnc/vncserver.users - rlPhaseEnd - - rlPhaseStartTest "real scenario -- RHEL-29967" - USER_NAME="toor" - USER_SECRET="S3kr3t${RANDOM}" - if ! grep -q ":10=${USER_NAME}" /etc/tigervnc/vncserver.users ; then - rlRun "echo -en '\n:10=${USER_NAME}\n' >> /etc/tigervnc/vncserver.users" - fi - rlRun "useradd -o -u 0 -g 0 ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "mkdir -p /home/${USER_NAME}/.config" - rlRun "mkdir -p /home/${USER_NAME}/.vnc" - rlRun "echo ${USER_SECRET} | vncpasswd -f > /home/${USER_NAME}/.vnc/passwd" - rlRun "chmod go= /home/${USER_NAME}/.vnc/passwd" - rlRun "ls -l /home/${USER_NAME}/.vnc/" - rlRun "restorecon -RvF /home/${USER_NAME}" - rlRun "systemctl enable vncserver@:10.service" - rlRun "systemctl start vncserver@:10.service" - sleep 15 - rlRun "cat /home/${USER_NAME}/.vnc/*.log" - rlRun "systemctl status vncserver@:10.service" - for POLICY_KIND in mls targeted ; do - rlRun "cp /etc/selinux/${POLICY_KIND}/policy/policy.* /home/${USER_NAME}/policy.${POLICY_KIND}" - rlWatchdog "DISPLAY=:10 apol -v /home/${USER_NAME}/policy.${POLICY_KIND} >& output.txt" 30 - rlRun "grep -i 'success.*open.*permission map' output.txt" - rlRun "grep -i 'success.*open.*policy' output.txt" - rlRun "grep -i -e traceback -e error output.txt" 1 - done - rlRun "systemctl stop vncserver@:10.service" - rlRun "systemctl status vncserver@:10.service" 3 - rlRun "systemctl disable vncserver@:10.service" - sleep 15 - rlRun "userdel -rfZ ${USER_NAME}" - rlPhaseEnd - - rlPhaseStartCleanup - rlFileRestore - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/setools/rebuild-from-srpm/main.fmf b/setools/rebuild-from-srpm/main.fmf deleted file mode 100644 index ae3136d..0000000 --- a/setools/rebuild-from-srpm/main.fmf +++ /dev/null @@ -1,33 +0,0 @@ -summary: Can setools be built from its source RPM? -contact: Milos Malik -component: - - setools -test: ./runtest.sh -framework: beakerlib -recommend: - - dnf-utils - - rpm-build - - libsepol - - libsemanage - - libselinux - - policycoreutils -duration: 10m -enabled: true -tier: 1 -tag: - - CI-Tier-1 - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - targeted - - avoidImageMode -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2251915 - - verifies: https://issues.redhat.com/browse/RHEL-18067 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0616295 -id: 37430912-7a9e-40e7-a569-cbef9529b9e3 diff --git a/setools/rebuild-from-srpm/runtest.sh b/setools/rebuild-from-srpm/runtest.sh deleted file mode 100755 index cf031ab..0000000 --- a/setools/rebuild-from-srpm/runtest.sh +++ /dev/null @@ -1,36 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm libsepol - rlAssertRpm libsemanage - rlAssertRpm libselinux - rlAssertRpm policycoreutils - if ! rpm -q rpm-build ; then - rlRun "yum -y install rpm-build" 0-255 - fi - - rlRun "rm -f setools*.src.rpm" - rlRun "yumdownloader --source setools" - rlRun "ls -l setools*src.rpm" - rlPhaseEnd - - rlPhaseStartTest "bz#2251915 + RHEL-18067" - if rlIsRHEL ; then - rlRun "yum-builddep -y setools --enablerepo '*CRB'" - elif rlIsCentOS ; then - rlRun "yum-builddep -y setools --enablerepo crb" - else # Fedora - rlRun "yum-builddep -y setools" - fi - rlRun "rpmbuild --rebuild setools*.src.rpm" - rlRun "ls -lR ~/rpmbuild/RPMS | grep setools" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f setools*.src.rpm" - rlPhaseEnd -rlJournalEnd - diff --git a/setools/seinfo/Makefile b/setools/seinfo/Makefile deleted file mode 100644 index 1906663..0000000 --- a/setools/seinfo/Makefile +++ /dev/null @@ -1,77 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/setools/Sanity/seinfo -# Description: Does seinfo work well? Does it support all features? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/setools/Sanity/seinfo -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does seinfo work well? Does it support all features?" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 20m" >> $(METADATA) - @echo "RunFor: setools" >> $(METADATA) - @echo "Requires: setools" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Requires: diffutils" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 499247" >> $(METADATA) # Fedora - @echo "Bug: 584286" >> $(METADATA) # RHEL-5 - @echo "Bug: 649699" >> $(METADATA) # RHEL-5 - @echo "Bug: 650092" >> $(METADATA) # RHEL-6 - @echo "Bug: 739628" >> $(METADATA) # RHEL-6 - @echo "Bug: 928705" >> $(METADATA) # RHEL-7 - @echo "Bug: 1581761" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/setools/seinfo/PURPOSE b/setools/seinfo/PURPOSE deleted file mode 100644 index 206824a..0000000 --- a/setools/seinfo/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/setools/Sanity/seinfo -Author: Milos Malik - -Does seinfo work well? Does it support all features? - diff --git a/setools/seinfo/main.fmf b/setools/seinfo/main.fmf deleted file mode 100644 index 0803d4e..0000000 --- a/setools/seinfo/main.fmf +++ /dev/null @@ -1,45 +0,0 @@ -summary: Does seinfo work well? Does it support all features? -description: |+ - Does seinfo work well? Does it support all features? - -contact: Milos Malik -component: - - setools -test: ./runtest.sh -framework: beakerlib -recommend: - - setools - - setools-console - - selinux-policy - - selinux-policy-targeted - - grep - - diffutils -duration: 20m -enabled: true -tag: - - NoRHEL4 - - TIPpass_Security - - TipWaived5 - - TipWaived6 - - f31friendly - - f32friendly - - failinrhel8ci - - targeted -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=499247 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=584286 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=649699 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=650092 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739628 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=928705 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1581761 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=920981 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1581848 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0067249 -extra-summary: /CoreOS/setools/Sanity/seinfo -extra-task: /CoreOS/setools/Sanity/seinfo diff --git a/setools/seinfo/runtest.sh b/setools/seinfo/runtest.sh deleted file mode 100755 index 46e4b4e..0000000 --- a/setools/seinfo/runtest.sh +++ /dev/null @@ -1,198 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/setools/Sanity/seinfo -# Description: Does seinfo work well? Does it support all features? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="setools" - -rlJournalStart - rlPhaseStartSetup - if rlIsRHEL 5 ; then - rlAssertRpm ${PACKAGE} - else - rlAssertRpm ${PACKAGE}-console - fi - rlAssertRpm selinux-policy - rlAssertRpm selinux-policy-targeted - SHORT_OUTPUT=`mktemp` - LONG_OUTPUT=`mktemp` - rlPhaseEnd - - if seinfo --version | grep -q '3\.3' ; then - rlPhaseStartTest "bz#499247 + bz#584286" - rlRun "seinfo" - rlRun "seinfo --version" - rlRun "seinfo --stats" - for CLASS in "capability" ; do - rlRun "SIMPLE_COUNT=\`seinfo -c${CLASS} | wc -l\`" - rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 - rlRun "EXPANDED_COUNT=\`seinfo -x -c${CLASS} | wc -l\`" - rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 - done - - for TYPE in "root_t" ; do - rlRun "SIMPLE_COUNT=\`seinfo -t${TYPE} | wc -l\`" - rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 - rlRun "EXPANDED_COUNT=\`seinfo -x -t${TYPE} | wc -l\`" - rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 - done - - if ! rlIsRHEL 5 ; then - ATTRIBUTE="domain" - else - ATTRIBUTE="@ttr0135" - fi - rlRun "SIMPLE_COUNT=\`seinfo -a${ATTRIBUTE} | wc -l\`" - rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 - rlRun "EXPANDED_COUNT=\`seinfo -x -a${ATTRIBUTE} | wc -l\`" - rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 - - for ROLE in "sysadm_r" ; do - rlRun "SIMPLE_COUNT=\`seinfo -r${ROLE} | wc -l\`" - rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 - rlRun "EXPANDED_COUNT=\`seinfo -x -r${ROLE} | wc -l\`" - rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 - done - - for USER in "root" ; do - rlRun "SIMPLE_COUNT=\`seinfo -u${USER} | wc -l\`" - rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 - rlRun "EXPANDED_COUNT=\`seinfo -x -u${USER} | wc -l\`" - rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 - done - - for BOOLEAN in "ftpd_connect_db" ; do - rlRun "SIMPLE_COUNT=\`seinfo -b${BOOLEAN} | wc -c\`" - rlAssertGreater "the output without details should be short" ${SIMPLE_COUNT} 10 - rlRun "EXPANDED_COUNT=\`seinfo -x -b${BOOLEAN} | wc -c\`" - rlAssertGreater "the output with details should be longer" ${EXPANDED_COUNT} ${SIMPLE_COUNT} - done - - if rlIsRHEL 5 ; then - for OPTION_PAIR in \ - "-c|--classes" \ - "-t|--types" \ - "-a|--attribs" \ - "-r|--roles" \ - "-u|--users" \ - "-b|--boolean" \ - "-S|--sensitivities" \ - "-C|--categories" \ - "-f|--fs_use" \ - "-g|--genfscon" \ - "-n|--netifcon" \ - "-o|--nodecon" \ - "-p|--portcon" \ - "-i|--initialsid" ; do - SHORT_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 1` - rlRun "seinfo ${SHORT_OPTION} >& ${SHORT_OUTPUT}" - LONG_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 2` - rlRun "seinfo ${LONG_OPTION} >& ${LONG_OUTPUT}" - rlRun "diff ${SHORT_OUTPUT} ${LONG_OUTPUT} >& /dev/null" - done - else - for OPTION_PAIR in \ - "-c|--class" \ - "-t|--type" \ - "-a|--attribute" \ - "-r|--role" \ - "-u|--user" \ - "-b|--bool" ; do - SHORT_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 1` - rlRun "seinfo ${SHORT_OPTION} >& ${SHORT_OUTPUT}" - LONG_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 2` - rlRun "seinfo ${LONG_OPTION} >& ${LONG_OUTPUT}" - rlRun "diff ${SHORT_OUTPUT} ${LONG_OUTPUT} >& /dev/null" - done - fi - rlPhaseEnd - fi - - if false ; then # both bugs were closed as WONTFIX - rlPhaseStartTest "bz#649699 + bz#650092" - for SHORT_OPTION in "-c" "-t" "-a" "-r" "-u" "-b" ; do - rlRun "seinfo ${SHORT_OPTION}xyz" 1-255 - done - for LONG_OPTION in "--class" "--sensitivity" "--category" "--type" "--attribute" \ - "--role" "--user" "--bool" "--constrain" "--initialsid" "--fs_use" "--genfscon" \ - "--netifcon" "--nodecon" "--all" "--portcon --protocol" "--expand" "--stats" \ - "--version" "--help"; do - rlRun "seinfo ${LONG_OPTION}=xyz" 1-255 - done - rlPhaseEnd - fi - - rlPhaseStartTest "bz#739628" - rlRun "seinfo -r | grep -v -e Roles: -e _r$ -e ^$" 1 - rlRun "seinfo -u | grep -v -e Users: -e _u$ -e ^$ -e root$" 1 - rlRun "seinfo -t | grep -v -e Types: -e _t$ -e ^$" 1 - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest "bz#928705 + bz#1581761" - rlRun "seinfo -tspamc_t -x | grep -i alias" - rlRun "seinfo -tspamc_t -x | grep spamc_t" - rlRun "seinfo -tspamc_t -x | grep spamassassin_t" - rlRun "seinfo -tspamassassin_t -x | grep -i alias" - rlRun "seinfo -tspamassassin_t -x | grep spamassassin_t" - rlRun "seinfo -tspamassassin_t -x | grep -i spamc_t" - rlPhaseEnd - fi - - rlPhaseStartTest "bz#1029837" - # there is a difference when seinfo analyzes the policy file stored under /etc/selinux and the active policy stored in the SELinux file-system - if rlIsRHEL 5 6 ; then - SELINUX_FS="/selinux" - else - SELINUX_FS="/sys/fs/selinux" - fi - rlRun "seinfo ${SELINUX_FS}/policy" - for POLICY_TYPE in minimum mls targeted ; do - if [ -f /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then - rlRun "seinfo /etc/selinux/${POLICY_TYPE}/policy/policy.*" - fi - done - rlPhaseEnd - - if seinfo --version | grep '^4\.' ; then - rlPhaseStartTest "additional v.4 features in comparison to v.3" - for OPTION in "common" "default" "typebounds" "validatetrans" ; do - rlRun "seinfo --${OPTION}" - rlRun "seinfo --${OPTION} | grep -i ${OPTION}" - done - rlPhaseEnd - fi - - rlPhaseStartCleanup - rm -f ${SHORT_OUTPUT} - rm -f ${LONG_OUTPUT} - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/setools/sesearch/Makefile b/setools/sesearch/Makefile deleted file mode 100644 index 93c7504..0000000 --- a/setools/sesearch/Makefile +++ /dev/null @@ -1,77 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/setools/Sanity/sesearch -# Description: Does sesearch work well? Does it support all features? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/setools/Sanity/sesearch -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does sesearch work well? Does it support all features?" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: setools" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "Requires: python3-setools" >> $(METADATA) - @echo "Requires: selinux-policy" >> $(METADATA) - @echo "Requires: selinux-policy-targeted" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - @echo "Bug: 526460" >> $(METADATA) # Fedora 11 - @echo "Bug: 583915" >> $(METADATA) # RHEL-6 - @echo "Bug: 602166" >> $(METADATA) # RHEL-6 - @echo "Bug: 649711" >> $(METADATA) # RHEL-5 - @echo "Bug: 650094" >> $(METADATA) # RHEL-6 - @echo "Bug: 836213" >> $(METADATA) # RHEL-7 - @echo "Bug: 924588" >> $(METADATA) # RHEL-7 - @echo "Bug: 1029837" >> $(METADATA) # RHEL-7 - @echo "Bug: 1595582" >> $(METADATA) # RHEL-8 - - rhts-lint $(METADATA) - diff --git a/setools/sesearch/PURPOSE b/setools/sesearch/PURPOSE deleted file mode 100644 index 9524a62..0000000 --- a/setools/sesearch/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/setools/Sanity/sesearch -Author: Milos Malik - -Does sesearch work well? Does it support all features? - diff --git a/setools/sesearch/main.fmf b/setools/sesearch/main.fmf deleted file mode 100644 index 5ea16da..0000000 --- a/setools/sesearch/main.fmf +++ /dev/null @@ -1,44 +0,0 @@ -summary: Does sesearch work well? Does it support all features? -description: |+ - Does sesearch work well? Does it support all features? - -contact: Milos Malik -component: - - setools -test: ./runtest.sh -framework: beakerlib -recommend: - - setools-console - - python3-setools - - selinux-policy - - selinux-policy-targeted -duration: 15m -enabled: true -tag: - - NoRHEL4 - - TIPpass_Security - - TierCandidatesFAIL - - TipWaived7 - - f32friendly - - f33friendly - - targeted -tier: 1 -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=526460 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=583915 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=602166 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=649711 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=650094 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=836213 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924588 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1029837 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595582 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=920981 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595572 -adjust+: - - enabled: false - when: distro == rhel-4 - continue: false -extra-nitrate: TC#0062271 -extra-summary: /CoreOS/setools/Sanity/sesearch -extra-task: /CoreOS/setools/Sanity/sesearch diff --git a/setools/sesearch/runtest.sh b/setools/sesearch/runtest.sh deleted file mode 100755 index feb7a22..0000000 --- a/setools/sesearch/runtest.sh +++ /dev/null @@ -1,141 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/setools/Sanity/sesearch -# Description: Does sesearch work well? Does it support all features? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="setools" - -rlJournalStart - rlPhaseStartSetup - if rlIsRHEL 5 ; then - rlAssertRpm ${PACKAGE} - elif rlIsRHEL 6 7 ; then - rlAssertRpm ${PACKAGE}-libs - rlAssertRpm ${PACKAGE}-console - else - rlAssertRpm ${PACKAGE}-console - fi - rlPhaseEnd - - if rlIsRHEL '<=7' ; then - rlPhaseStartTest "Records counting" - if rlIsRHEL 5 6 ; then - rlRun "MAX_COUNT=\`sesearch --all | wc -l\`" - else - rlRun "MAX_COUNT=\`sesearch --allow --auditallow --dontaudit --type --role_allow --role_trans --range_trans | wc -l\`" - fi - if rlIsRHEL 5 ; then - for PARAM in "allow" "neverallow" "audit" "role_trans" "type" ; do - rlRun "FULL_COUNT=\`sesearch --${PARAM} | wc -l\`" - rlRun "echo \${FULL_COUNT}" - rlRun "FILTERED_COUNT=\`sesearch --${PARAM} | grep ${PARAM} | wc -l\`" - rlRun "echo \${FILTERED_COUNT}" - rlAssertGreaterOrEqual "the difference must be between 0 and 2" 2 $((FULL_COUNT - FILTERED_COUNT)) - rlAssertGreaterOrEqual "the difference must be between 0 and 2" $((FULL_COUNT - FILTERED_COUNT)) 0 - rlAssertGreaterOrEqual "number of all rules must be greater or equal to this number" ${MAX_COUNT} ${FULL_COUNT} - done - - rlRun "FULL_COUNT=\`sesearch --rangetrans | wc -l\`" - rlRun "echo \${FULL_COUNT}" - rlRun "FILTERED_COUNT=\`sesearch --rangetrans | grep range_trans | wc -l\`" - rlRun "echo \${FILTERED_COUNT}" - rlAssertGreaterOrEqual "the difference must be between 0 and 2" 2 $((FULL_COUNT - FILTERED_COUNT)) - rlAssertGreaterOrEqual "the difference must be between 0 and 2" $((FULL_COUNT - FILTERED_COUNT)) 0 - rlAssertGreaterOrEqual "number of all rules must be greater or equal to this number" ${MAX_COUNT} ${FULL_COUNT} - else - for PARAM in "allow" "neverallow" "auditallow" "dontaudit" "range_trans" "role_trans" "type" ; do - rlRun "FULL_COUNT=\`sesearch --${PARAM} | grep -v -e 'Found ' -e '^$' | wc -l\`" - rlRun "echo \${FULL_COUNT}" - rlRun "FILTERED_COUNT=\`sesearch --${PARAM} | grep -v -e 'Found ' -e '^$' | grep ${PARAM} | wc -l\`" - rlRun "echo \${FILTERED_COUNT}" - rlAssertEquals "these 2 numbers should be equal" ${FULL_COUNT} ${FILTERED_COUNT} - rlAssertGreater "number of all rules must be greater than any of these numbers" ${MAX_COUNT} ${FULL_COUNT} - done - fi - - rlRun "FULL_COUNT=\`sesearch --role_allow | wc -l\`" - rlRun "echo \${FULL_COUNT}" - rlRun "FILTERED_COUNT=\`sesearch --role_allow | grep allow | wc -l\`" - rlRun "echo \${FILTERED_COUNT}" - rlAssertGreaterOrEqual "the difference must be between 0 and 2" 2 $((FULL_COUNT - FILTERED_COUNT)) - rlAssertGreaterOrEqual "the difference must be between 0 and 2" $((FULL_COUNT - FILTERED_COUNT)) 0 - rlAssertGreaterOrEqual "number of all rules must be greater or equal to this number" ${MAX_COUNT} ${FULL_COUNT} - rlPhaseEnd - fi - - rlPhaseStartTest "bz#649711 + bz#650094 + bz#924588" - rlLog "All three bugs were closed as WONTFIX, so this phase was commented out" - #for SHORT_OPTION in "-s" "-t" "-c" ; do - #rlRun "sesearch -A ${SHORT_OPTION} xxx" 1-255 - #done - - #for LONG_OPTION in "--source" "--target" "--class" ; do - #rlRun "sesearch --allow ${LONG_OPTION}=xxx" 1-255 - #done - rlPhaseEnd - - if rlIsRHEL '<=7' ; then - rlPhaseStartTest "bz#836213" - rlRun "sesearch -s ipsec_t -t ipsec_mgmt_t -c process --allow 2>&1 | grep -i \"found .* av rules\"" - rlRun "sesearch -s ipsec_t -t ipsec_mgmt_t -c process --dontaudit 2>&1 | grep -i \"found .* av rules\"" - rlRun "sesearch -s ipsec_t -t ipsec_mgmt_t -c process --all 2>&1 | grep -i \"found .* av rules\"" - rlPhaseEnd - fi - - rlPhaseStartTest "bz#1029837" - if rlIsRHEL 5 6 ; then - SELINUX_FS="/selinux" - else - SELINUX_FS="/sys/fs/selinux" - fi - rlRun "sesearch -T ${SELINUX_FS}/policy >/dev/null" - for POLICY_TYPE in minimum mls targeted ; do - if [ -f /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then - rlRun "sesearch -T /etc/selinux/${POLICY_TYPE}/policy/policy.* >/dev/null" - fi - done - rlPhaseEnd - - rlPhaseStartTest "bz#1595582" - REFERENCE_FILE=`mktemp` - OUTPUT_FILE=`mktemp` - REAL_TYPE="spamc_home_t" - rlRun "sesearch -t ${REAL_TYPE} --allow --dontaudit --auditallow | sort > ${REFERENCE_FILE}" - for ALIAS in spamassassin_home_t pyzor_home_t razor_home_t ; do - rlRun "sesearch -t ${ALIAS} --allow --dontaudit --auditallow | sort > ${OUTPUT_FILE}" - rlRun "diff ${REFERENCE_FILE} ${OUTPUT_FILE}" - done - rm -f ${REFERENCE_FILE} ${OUTPUT_FILE} - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd - rlJournalPrintText -rlJournalEnd - diff --git a/setroubleshoot/independent-on-initscripts/main.fmf b/setroubleshoot/independent-on-initscripts/main.fmf deleted file mode 100644 index c1563a5..0000000 --- a/setroubleshoot/independent-on-initscripts/main.fmf +++ /dev/null @@ -1,20 +0,0 @@ -summary: Is setroubleshoot still dependent on initscripts* packages? -contact: Milos Malik -component: - - setroubleshoot -test: ./test.sh -framework: beakerlib -recommend: - - setroubleshoot-server -duration: 5m -enabled: true -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2365614 - - verifies: https://issues.redhat.com/browse/RHEL-90842 -adjust+: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, - centos-stream-9 - continue: false -extra-nitrate: TC#0619234 -id: 945c84e9-8e15-4ab6-a2be-65841c8e0a8a diff --git a/setroubleshoot/independent-on-initscripts/test.sh b/setroubleshoot/independent-on-initscripts/test.sh deleted file mode 100755 index 7d1e6a4..0000000 --- a/setroubleshoot/independent-on-initscripts/test.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm setroubleshoot-server - rlPhaseEnd - - rlPhaseStartTest "bz#2365614" - rlRun "rpm -q --requires setroubleshoot-server | grep initscripts" 1 - rlRun "rpm -q --scripts setroubleshoot-server | grep service" 1 - rlRun "rpm -q --scripts setroubleshoot-server | grep 'auditctl.*reload'" - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalEnd diff --git a/tests-pr.yml b/tests-pr.yml new file mode 100644 index 0000000..5b5e020 --- /dev/null +++ b/tests-pr.yml @@ -0,0 +1,39 @@ +- hosts: localhost + tags: + - classic + + pre_tasks: + - name: Generate list of tests in this PR + shell: | + git fetch https://src.fedoraproject.org/tests/selinux.git master:upstream-master + git log --format= --stat --name-only upstream-master..HEAD | sed '/\//!d;s#\(.*\)/.*#\1#' | sort -u | xargs + delegate_to: localhost + register: tests_list + + - name: Set tests + set_fact: + tests: "{{ tests_list.stdout.split(' ') }}" + + # Update to the latest kernel to allow installing kernel-* packages + # matching the running kernel version. + # See: https://pagure.io/fedora-ci/general/issue/162 + # May be removed once the issue above is resolved. + - name: Update kernel packages and reboot + block: + - name: Update kernel-core + shell: dnf update -y kernel-core + + - name: Restart host + shell: sleep 2 && shutdown -r now "Ansible updates triggered" + async: 1 + poll: 0 + ignore_errors: true + + - name: Wait for host to come back + wait_for_connection: + delay: 10 + timeout: 300 + + roles: + - role: standard-test-beakerlib +